Skip to content

Bump the github-actions group across 1 directory with 7 updates - #340

Merged
bjosv merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-37abecd103
Aug 20, 2026
Merged

Bump the github-actions group across 1 directory with 7 updates#340
bjosv merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-37abecd103

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 7 updates in the / directory:

Package From To
actions/checkout 7.0.0 7.0.1
vmactions/freebsd-vm 1.5.2 1.5.3
lukka/get-cmake 4.4.0 4.4.2
vapier/coverity-scan-action 1.8.0 1.9.0
release-drafter/release-drafter 7.6.0 7.7.0
rojopolis/spellcheck-github-actions 0.63.0 0.66.0
taiki-e/install-action 2.83.4 2.85.13

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates vmactions/freebsd-vm from 1.5.2 to 1.5.3

Release notes

Sourced from vmactions/freebsd-vm's releases.

v1.5.3

support major release:

release: 15

release: 14


release: 13


release: 12

Commits
  • 83b151f Update vmactions/freebsd-vm from base-vm
  • e9ea2ce Generated from base-vm
  • 7f9ed70 Bump versions from upstream releases
  • 59e13a9 Update vmactions/freebsd-vm from base-vm
  • f28fc27 Generated from base-vm
  • c267d2f Update version to v1.5.2
  • a56f3ba Update vmactions/freebsd-vm from base-vm
  • 4a50e07 Generated from base-vm
  • ff9b16b Update vmactions/freebsd-vm from base-vm
  • d6a581b Generated from base-vm
  • Additional commits viewable in compare view

Updates lukka/get-cmake from 4.4.0 to 4.4.2

Release notes

Sourced from lukka/get-cmake's releases.

CMake v4.4.2

The get-cmake action downloads and caches CMake and Ninja on your workflows. Versions can be specified using semantic versioning ranges using cmakeVersion and ninjaVersion inputs.

Changes:

  • latest is now using CMake version v4.4.2, use this one-liner e.g.: uses: lukka/get-cmake@latest

Enjoy!

Commits

Updates vapier/coverity-scan-action from 1.8.0 to 1.9.0

Release notes

Sourced from vapier/coverity-scan-action's releases.

Robustify coverity download

What's Changed

Full Changelog: vapier/coverity-scan-action@v1.8.0...v1.9.0

Commits
  • 1b6fd4e fix & document dry-run mode
  • 5161799 define Author & update action reference docs
  • a0c48fc Make curl fail if the token is invalid (server returns 401)
  • 34f20a1 update to actions/cache@v6
  • cc50334 add permissions section
  • 1f35cc3 update to actions/checkout@v7
  • b7070ef clarify project URL encoding
  • 237e9d8 Add app-mesh to the list of users of coverity-scan-action
  • 8b9716c Add libexpat to the list of users of coverity-scan-action
  • a201da2 Add a dry_run option
  • Additional commits viewable in compare view

Updates release-drafter/release-drafter from 7.6.0 to 7.7.0

Release notes

Sourced from release-drafter/release-drafter's releases.

v7.7.0

What's Changed

New

Dependency Updates

Bug Fixes

Maintenance

New Contributors

  • No new contributors

Full Changelog: release-drafter/release-drafter@v7.6.0...v7.7.0

Commits

Updates rojopolis/spellcheck-github-actions from 0.63.0 to 0.66.0

Release notes

Sourced from rojopolis/spellcheck-github-actions's releases.

0.66.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.65.0...0.66.0

0.65.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.64.0...0.65.0

0.64.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.63.1...0.64.0

0.63.1

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.63.0...0.63.1

Changelog

Sourced from rojopolis/spellcheck-github-actions's changelog.

Change Log for spellcheck-github-actions

0.66.0, 2026-08-11, maintenance release, update not required

  • Docker image updated to Python 3.14.7-slim-trixie via PR #391 from Dependabot.

0.65.0, 2026-08-08, security release, update recommended

  • Bumped lxml from 5.4.0 to 6.1.1 to address CVE-2026-41066 (XXE via iterparse()/ETCompatXMLParser defaulting resolve_entities=True) and libxslt vulnerabilities CVE-2025-7424 and CVE-2025-11731, via PR #388 from Dependabot.

  • Bumped pymdown-extensions from 10.21.3 to 11.0.1 to address CVE-2026-67422 (ReDoS in the caret, tilde, betterem, and magiclink inline processors) and CVE-2026-61632 (path traversal in the b64 extension).

  • Bumped soupsieve from 2.6 to 2.9.2 to address CVE-2026-49476 (memory exhaustion via large comma-separated selector lists) and CVE-2026-49477 (ReDoS via the selector parser).

0.64.0, 2026-07-31, maintenance release, update not required

  • Adopted pip-compile (pip-tools) for Python dependency management via PR #380. requirements.in is now the source of truth for direct dependencies (pyspelling, pymdown-extensions); requirements.txt is generated from it rather than hand-maintained, so transitive pins can no longer silently fall out of sync the way bracex did in issue #378.

    • backrefs and zipp are dropped from requirements.txt. Neither is part of the resolved dependency graph for pyspelling + pymdown-extensions on the Python version this image ships (verified against each package's own declared metadata and the installed package list in the built image) — they were stale manual pins, not active dependencies. In particular, zipp was originally pinned in PR #204 to patch CVE-2024-5569; that dependency chain (pyspelling → importlib-metadata → zipp) no longer exists, so removing the pin does not reintroduce the vulnerability — the package simply isn't installed, pinned or not.

    • .github/dependabot.yml's pip ecosystem entry already set versioning-strategy: lockfile-only, which expects exactly this requirements.in/requirements.txt split; this change makes that existing setting apply as intended.

0.63.1, 2026-07-30, bug fix release, update recommended

  • Fixed sources glob patterns that combine brace expansion with the SPLIT/GLOBSTAR flags (e.g. **/*.{c,h}|!build/**) silently matching zero files and causing the action to fail with RuntimeError: None of the source targets from the configuration match any files. The pinned bracex dependency (2.5.post1) predated the version wcmatch requires for correct parsing of such patterns; bumped to 3.0.1 via PR #379. Addresses issue #378, reported by @​arkq.

0.63.0, 2026-07-01, maintenance release, update not required

  • Docker based image updated for Python 3.14.6 slim trixie via PR #364 from Dependabot.

0.62.0, 2026-06-19, security release, update recommended

  • Bumped lxml from 5.3.0 to 5.4.0 to address known CVEs via PR #357.

  • Bumped pymdown-extensions to patched version 10.21.3 via PR #358.

  • Bumped Markdown from 3.7 to 3.8.1 to patched version via PR #359.

  • Cleaned up GitHub Actions workflows using zizmor and removed ratchet annotations via PR #355 and PR #356.

  • Clarified examples in README.

0.61.0, 2026-06-14, minor feature release, update not required

  • Docker based image updated for Python 3.14.5 slim trixie via PR #344 from Dependabot.

0.60, 2026-03-14, minor feature release, update not required

  • Docker based image updated for Python 3.14.3 slim trixie via PR #325 from Dependabot.

... (truncated)

Commits
  • c1934c5 Prepare release 0.66.0 (#392)
  • 37a9b64 Merge pull request #391 from rojopolis/dependabot/docker/python-3.14.7-slim-t...
  • 7ad126c Bump python from 3.14.6-slim-trixie to 3.14.7-slim-trixie
  • fcc5ca8 Release 0.65.0 (#389)
  • f7c4783 Bump lxml from 5.4.0 to 6.1.1 (#388)
  • ef5beca Merge pull request #387 from rojopolis/dependabot/github_actions/docker/login...
  • 43ad8fd Merge pull request #386 from rojopolis/dependabot/github_actions/rojopolis/sp...
  • 4441ce6 Bump docker/login-action from 4.5.1 to 4.6.0
  • 55afec6 Bump rojopolis/spellcheck-github-actions from 0.63.0 to 0.64.0
  • 07dfc2d Corrected release date
  • Additional commits viewable in compare view

Updates taiki-e/install-action from 2.83.4 to 2.85.13

Release notes

Sourced from taiki-e/install-action's releases.

2.85.13

  • Update tombi@latest to 1.3.3.

  • Update mise@latest to 2026.8.5.

  • Update kingfisher@latest to 1.113.0.

  • Update cargo-shear@latest to 1.13.4.

  • Update bpf-linker@latest to 0.11.0.

2.85.12

  • Update zola@latest to 0.23.3.

  • Update wasm-tools@latest to 1.256.0.

  • Update tombi@latest to 1.2.10.

  • Update syft@latest to 1.51.0.

  • Update prek@latest to 0.4.13.

  • Update mise@latest to 2026.8.4.

  • Update editorconfig-checker@latest to 3.11.1.

  • Update cargo-tarpaulin@latest to 0.37.1.

  • Update cargo-rdme@latest to 2.2.1.

  • Update biome@latest to 2.5.8.

2.85.11

  • Update zola@latest to 0.23.2.

  • Update wasm-bindgen@latest to 0.2.127.

  • Update uv@latest to 0.12.3.

  • Update osv-scanner@latest to 2.5.0.

  • Update mise@latest to 2026.8.3.

  • Update kingfisher@latest to 1.112.0.

  • Update editorconfig-checker@latest to 3.10.0.

2.85.10

  • Update uv@latest to 0.12.2.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.86.1] - 2026-08-15

  • Fix an issue where oxfmt was　accidentally installed as oxfmt-{target}{exe}. (#1969)

[2.86.0] - 2026-08-15

[2.85.14] - 2026-08-15

  • Update uv@latest to 0.12.4.

  • Update trivy@latest to 0.74.0.

  • Update tombi@latest to 1.4.0.

  • Update mdbook-mermaid@latest to 0.17.1.

  • Update cargo-xwin@latest to 0.23.1.

[2.85.13] - 2026-08-13

  • Update tombi@latest to 1.3.3.

  • Update mise@latest to 2026.8.5.

  • Update kingfisher@latest to 1.113.0.

  • Update cargo-shear@latest to 1.13.4.

  • Update bpf-linker@latest to 0.11.0.

[2.85.12] - 2026-08-12

  • Update zola@latest to 0.23.3.

  • Update wasm-tools@latest to 1.256.0.

... (truncated)

Commits
  • 82cd3e7 Release 2.85.13
  • 4dd6c67 Update tombi@latest to 1.3.3
  • 91cb1bb Update mise@latest to 2026.8.5
  • 83d968e Update kingfisher@latest to 1.113.0
  • f7ab7f5 Update cargo-xwin manifest
  • 3faddd9 Update cargo-shear@latest to 1.13.4
  • b4cb4b2 Update bpf-linker@latest to 0.11.0
  • b20dedc Release 2.85.12
  • 952d13c ci: Skip cargo-rdme on x86_64 macOS
  • c8724e7 Update zola@latest to 0.23.3
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
taiki-e/install-action [< 2.63, > 2.62.12]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group across 1 directory with 7 updates
1d54c72 
Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.5.2` | `1.5.3` |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.4.0` | `4.4.2` |
| [vapier/coverity-scan-action](https://github.com/vapier/coverity-scan-action) | `1.8.0` | `1.9.0` |
| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.6.0` | `7.7.0` |
| [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) | `0.63.0` | `0.66.0` |
| [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.83.4` | `2.85.13` |



Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `vmactions/freebsd-vm` from 1.5.2 to 1.5.3
- [Release notes](https://github.com/vmactions/freebsd-vm/releases)
- [Commits](vmactions/freebsd-vm@77ed28d...83b151f)

Updates `lukka/get-cmake` from 4.4.0 to 4.4.2
- [Release notes](https://github.com/lukka/get-cmake/releases)
- [Changelog](https://github.com/lukka/get-cmake/blob/main/RELEASE_PROCESS.md)
- [Commits](lukka/get-cmake@e690607...fffaaaf)

Updates `vapier/coverity-scan-action` from 1.8.0 to 1.9.0
- [Release notes](https://github.com/vapier/coverity-scan-action/releases)
- [Commits](vapier/coverity-scan-action@2068473...1b6fd4e)

Updates `release-drafter/release-drafter` from 7.6.0 to 7.7.0
- [Release notes](https://github.com/release-drafter/release-drafter/releases)
- [Commits](release-drafter/release-drafter@eada3c9...34d8067)

Updates `rojopolis/spellcheck-github-actions` from 0.63.0 to 0.66.0
- [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases)
- [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md)
- [Commits](rojopolis/spellcheck-github-actions@e619e00...c1934c5)

Updates `taiki-e/install-action` from 2.83.4 to 2.85.13
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@07b4745...82cd3e7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: vmactions/freebsd-vm
  dependency-version: 1.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: lukka/get-cmake
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: vapier/coverity-scan-action
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: release-drafter/release-drafter
  dependency-version: 7.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: rojopolis/spellcheck-github-actions
  dependency-version: 0.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.85.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 17, 2026
@bjosv
bjosv merged commit 5c6de88 into main Aug 20, 2026
103 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-37abecd103 branch August 20, 2026 07:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bjosv