Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 19, 2025

Bumps the github-owned-actions group with 6 updates:

Package From To
github/codeql-action 3.30.3 4.30.9
actions/stale 10.0.0 10.1.0
github/cleanowners 1.2.6 1.2.9
github/contributors 1.7.1 1.7.4
actions/dependency-review-action 4.7.3 4.8.1
github/evergreen 1.24.2 1.24.5

Updates github/codeql-action from 3.30.3 to 4.30.9

Release notes

Sourced from github/codeql-action's releases.

v4.30.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

v4.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.30.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

See the full CHANGELOG.md for more information.

v3.30.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

v3.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

  • Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

3.30.4 - 25 Sep 2025

  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
  • Update default CodeQL bundle version to 2.23.1. #3118

3.30.3 - 10 Sep 2025

No user facing changes.

3.30.2 - 09 Sep 2025

  • Fixed a bug which could cause language autodetection to fail. #3084
  • Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #3064

3.30.1 - 05 Sep 2025

  • Update default CodeQL bundle version to 2.23.0. #3077

3.30.0 - 01 Sep 2025

... (truncated)

Commits
  • 16140ae Merge pull request #3213 from github/update-v4.30.9-70205d3d1
  • 30db5fe Update changelog for v4.30.9
  • 70205d3 Merge pull request #3211 from github/mbg/init/starting-partial-config
  • 697c209 Merge remote-tracking branch 'origin/main' into mbg/init/starting-partial-config
  • 1bd53ba Merge pull request #3205 from github/update-bundle/codeql-bundle-v2.23.3
  • cac4df0 Rebuild
  • 77e5c0d Merge branch 'main' into update-bundle/codeql-bundle-v2.23.3
  • 97a4f75 Merge pull request #3204 from github/mbg/setup-codeql
  • 2d5512b Merge remote-tracking branch 'origin/main' into mbg/init/starting-partial-config
  • fa7bdf0 Call getAnalysisKinds a second time, and ignore exceptions thrown during th...
  • Additional commits viewable in compare view

Updates actions/stale from 10.0.0 to 10.1.0

Release notes

Sourced from actions/stale's releases.

v10.1.0

What's Changed

New Contributors

Full Changelog: actions/stale@v10...v10.1.0

Commits

Updates github/cleanowners from 1.2.6 to 1.2.9

Release notes

Sourced from github/cleanowners's releases.

v1.2.9

Changelog

🧰 Maintenance

See details of all code changes since previous release

v1.2.8

Changelog

🧰 Maintenance

See details of all code changes since previous release

v1.2.7

Changelog

🐛 Bug Fixes

🧰 Maintenance

See details of all code changes since previous release

Commits
  • 5128e46 chore(deps): bump github/codeql-action from 3.30.6 to 4.30.8 (#293)
  • c58d67d chore(deps): bump github/contributors in the dependencies group (#292)
  • c004be3 chore(deps): bump python in the dependencies group (#291)
  • 6b930c2 chore(deps): bump pylint from 3.3.9 to 4.0.0 (#290)
  • 2308376 chore(deps): bump the dependencies group with 4 updates (#285)
  • f1431fe Merge pull request #286 from github/dependabot/pip/dependencies-279466ea4d
  • 371a73a Merge pull request #287 from github/dependabot/docker/python-5f55cdf
  • a1bd14a Merge pull request #288 from github/dependabot/github_actions/peter-evans/cre...
  • 313480b chore(deps): bump peter-evans/create-issue-from-file from 5.0.1 to 6.0.0
  • b177f9b chore(deps): bump python from 58c30f5 to 5f55cdf
  • Additional commits viewable in compare view

Updates github/contributors from 1.7.1 to 1.7.4

Release notes

Sourced from github/contributors's releases.

v1.7.4

Changelog

🧰 Maintenance

See details of all code changes since previous release

v1.7.3

Changelog

🧰 Maintenance

See details of all code changes since previous release

v1.7.2

Changelog

🐛 Bug Fixes

🧰 Maintenance

See details of all code changes since previous release

Commits
  • 2685bb0 chore(deps): bump github/contributors in the dependencies group (#345)
  • 4714b34 chore(deps): bump python in the dependencies group (#344)
  • c55a898 chore(deps): bump github/codeql-action from 3.30.6 to 4.30.8 (#346)
  • 053a43b chore(deps): bump pylint from 3.3.9 to 4.0.0 (#347)
  • 615f747 chore(deps): bump the dependencies group with 4 updates (#339)
  • ce2524b Merge pull request #342 from github/dependabot/pip/dependencies-279466ea4d
  • b11a7d0 Merge pull request #340 from github/dependabot/github_actions/peter-evans/cre...
  • 29a85ab Merge pull request #341 from github/dependabot/docker/python-5f55cdf
  • e2f7848 chore(deps): bump pylint from 3.3.8 to 3.3.9 in the dependencies group
  • 2d9c549 chore(deps): bump python from 58c30f5 to 5f55cdf
  • Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.7.3 to 4.8.1

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action v4.8.1

What's Changed

Full Changelog: actions/dependency-review-action@v4...v4.8.1

v4.8.0

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4...v4.8.0

Commits
  • 40c09b7 Merge pull request #1001 from actions/ahpook/v4.8.1-release
  • 4552948 Bump version for 4.8.1 release
  • e63da9a Merge pull request #1000 from actions/ahpook/deprecation-redux
  • 71365c7 (bug) Fix spamming link test in deprecation warning (again)
  • 56339e5 Merge pull request #988 from actions/brrygrdn/rc-4.8.0
  • 1688b74 Bump to a 4.8.0
  • 31c9f17 Merge pull request #987 from actions/rc-4.7.4
  • eacde78 Update version
  • 8151009 Merge pull request #986 from actions/brrygrdn/rc-4.7.4
  • b472ec9 Add a quick regression test for the artefact summary
  • Additional commits viewable in compare view

Updates github/evergreen from 1.24.2 to 1.24.5

Release notes

Sourced from github/evergreen's releases.

v1.24.5

Changelog

🧰 Maintenance

See details of all code changes since previous release

v1.24.4

Changelog

🧰 Maintenance

See details of all code changes since previous release

v1.24.3

Changelog

🐛 Bug Fixes

🧰 Maintenance

See details of all code changes since previous release

Commits
  • de85d31 chore(deps): bump pylint from 3.3.9 to 4.0.0 (#435)
  • cac2447 chore(deps): bump github/codeql-action from 3.30.6 to 4.30.8 (#434)
  • f8310b1 chore(deps): bump github/contributors in the dependencies group (#433)
  • acbf2dd chore(deps): bump python in the dependencies group (#432)
  • b88f390 chore(deps): bump the dependencies group with 4 updates (#428)
  • 4fc4a64 Merge pull request #429 from github/dependabot/github_actions/peter-evans/cre...
  • 77f3f4d Merge pull request #427 from github/dependabot/docker/python-5f55cdf
  • cd27bd2 Merge pull request #430 from github/dependabot/pip/dependencies-279466ea4d
  • c378aae chore(deps): bump pylint from 3.3.8 to 3.3.9 in the dependencies group
  • 2f68dbd chore(deps): bump peter-evans/create-issue-from-file from 5.0.1 to 6.0.0
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-owned-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.30.3` | `4.30.9` |
| [actions/stale](https://github.com/actions/stale) | `10.0.0` | `10.1.0` |
| [github/cleanowners](https://github.com/github/cleanowners) | `1.2.6` | `1.2.9` |
| [github/contributors](https://github.com/github/contributors) | `1.7.1` | `1.7.4` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.7.3` | `4.8.1` |
| [github/evergreen](https://github.com/github/evergreen) | `1.24.2` | `1.24.5` |


Updates `github/codeql-action` from 3.30.3 to 4.30.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@192325c...16140ae)

Updates `actions/stale` from 10.0.0 to 10.1.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@3a9db7e...5f858e3)

Updates `github/cleanowners` from 1.2.6 to 1.2.9
- [Release notes](https://github.com/github/cleanowners/releases)
- [Commits](github/cleanowners@687c799...5128e46)

Updates `github/contributors` from 1.7.1 to 1.7.4
- [Release notes](https://github.com/github/contributors/releases)
- [Commits](github/contributors@a274afd...2685bb0)

Updates `actions/dependency-review-action` from 4.7.3 to 4.8.1
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@595b5ae...40c09b7)

Updates `github/evergreen` from 1.24.2 to 1.24.5
- [Release notes](https://github.com/github/evergreen/releases)
- [Commits](github/evergreen@4e2fef1...de85d31)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.30.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-owned-actions
- dependency-name: actions/stale
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-owned-actions
- dependency-name: github/cleanowners
  dependency-version: 1.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-owned-actions
- dependency-name: github/contributors
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-owned-actions
- dependency-name: actions/dependency-review-action
  dependency-version: 4.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-owned-actions
- dependency-name: github/evergreen
  dependency-version: 1.24.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-owned-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 19, 2025
@github-actions
Copy link
Contributor

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/github/codeql-action/upload-sarif 16140ae1a102900babc80a33c44059580f687047 UnknownUnknown
actions/actions/stale 5f858e3efba33a5ca4407a664cc011ad407f2008 🟢 5.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
actions/github/cleanowners 5128e4614bd2f1820cdc670392eb5d6a365b3b64 🟢 7.5
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Code-Review⚠️ 0Found 0/2 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Security-Policy🟢 10security policy file detected
Contributors🟢 10project has 13 contributing companies or organizations
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
CI-Tests🟢 1025 out of 25 merged PRs checked by a CI test -- score normalized to 10
actions/github/contributors 2685bb003d6b9eecde35e82bb1bd1df4dfb7be08 🟢 7.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/2 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Contributors🟢 10project has 13 contributing companies or organizations
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
CI-Tests🟢 1024 out of 24 merged PRs checked by a CI test -- score normalized to 10
actions/actions/dependency-review-action 40c09b7dc99638e5ddb0bfd91c1673effc064d8a 🟢 7.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 9security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Vulnerabilities🟢 64 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
actions/github/evergreen de85d31b3656847d97c180ac572307b401ec0776 🟢 7.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/2 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool🟢 10update tool detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
SAST🟢 10SAST tool is run on all commits
CI-Tests🟢 1023 out of 23 merged PRs checked by a CI test -- score normalized to 10
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Contributors🟢 10project has 15 contributing companies or organizations

Scanned Files

  • .github/workflows/_scorecard.yml
  • .github/workflows/_stale.yml
  • .github/workflows/clean-owners.yml
  • .github/workflows/contributor-report.yml
  • .github/workflows/dependency-review.yml
  • .github/workflows/evergreen-check.yml

Copy link
Member

@justaugustus justaugustus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot squash and merge

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 19, 2025

Beginning January 27, 2026, Dependabot will no longer support the @dependabot squash and merge command. Please use GitHub's native pull request controls instead. Please see the changelog announcement for additional details.

@dependabot dependabot bot merged commit 006340e into main Oct 19, 2025
2 of 3 checks passed
@dependabot dependabot bot deleted the dependabot/github_actions/github-owned-actions-f7eb335ad5 branch October 19, 2025 03:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant