ci(deps): bump the actions group across 1 directory with 9 updates by dependabot[bot] · Pull Request #54 · inferadb/engine

dependabot · 2026-01-06T07:18:34Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the actions group with 9 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.13.3`	`2.14.0`
Swatinem/rust-cache	`2.7.8`	`2.8.2`
taiki-e/install-action	`2.62.63`	`2.65.13`
actions/upload-artifact	`5.0.0`	`6.0.0`
codecov/codecov-action	`5.5.1`	`5.5.2`
github/codeql-action	`4.31.7`	`4.31.9`
dependabot/fetch-metadata	`2.3.0`	`2.5.0`
step-security/action-gh-release	`2.4.1`	`2.4.2`
docker/setup-buildx-action	`3.11.1`	`3.12.0`

Updates step-security/harden-runner from 2.13.3 to 2.14.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.14.0

What's Changed

Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.

Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

Commits

20cf305 Merge pull request #622 from step-security/feature/custom-property-skip
c51e8ee feat: skip agent install and post step on subsequent runs for GitHub-hosted r...
e152b90 feat: skip harden-runner based on repository custom property
ee1faec feat: replace skip-harden-runner with skip-on-custom-property input
1dc7c17 feat: add skip-harden-runner input to conditionally skip execution
See full diff in compare view

Updates Swatinem/rust-cache from 2.7.8 to 2.8.2

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.8.2

What's Changed

ci: address lint findings, add zizmor workflow by @woodruffw in Swatinem/rust-cache#262

feat: Implement ability to disable adding job ID + rust environment hashes to cache names by @Ryan-Brice in Swatinem/rust-cache#279

Don't overwrite env for cargo-metadata call by @MaeIsBad in Swatinem/rust-cache#285

New Contributors

@woodruffw made their first contribution in Swatinem/rust-cache#262

@Ryan-Brice made their first contribution in Swatinem/rust-cache#279

@MaeIsBad made their first contribution in Swatinem/rust-cache#285

Full Changelog: Swatinem/rust-cache@v2.8.1...v2.8.2

v2.8.1

What's Changed

Set empty CARGO_ENCODED_RUSTFLAGS in workspace metadata retrieval by @ark0f in Swatinem/rust-cache#249

chore(deps): update dependencies by @reneleonhardt in Swatinem/rust-cache#251

chore: fix dependabot groups by @reneleonhardt in Swatinem/rust-cache#253

Bump the prd-patch group with 2 updates by @dependabot[bot] in Swatinem/rust-cache#254

chore(dependabot): regenerate and commit dist/ by @reneleonhardt in Swatinem/rust-cache#257

Bump @types/node from 22.16.3 to 24.2.1 in the dev-major group by @dependabot[bot] in Swatinem/rust-cache#255

Bump typescript from 5.8.3 to 5.9.2 in the dev-minor group by @dependabot[bot] in Swatinem/rust-cache#256

Bump actions/setup-node from 4 to 5 in the actions group by @dependabot[bot] in Swatinem/rust-cache#259

Update README.md by @Propfend in Swatinem/rust-cache#234

Bump @types/node from 24.2.1 to 24.3.0 in the dev-minor group by @dependabot[bot] in Swatinem/rust-cache#258

New Contributors

@ark0f made their first contribution in Swatinem/rust-cache#249

@reneleonhardt made their first contribution in Swatinem/rust-cache#251

@dependabot[bot] made their first contribution in Swatinem/rust-cache#254

@Propfend made their first contribution in Swatinem/rust-cache#234

Full Changelog: Swatinem/rust-cache@v2...v2.8.1

v2.8.0

What's Changed

Add cache-workspace-crates feature by @jbransen in Swatinem/rust-cache#246

Feat: support warpbuild cache provider by @stegaBOB in Swatinem/rust-cache#247

New Contributors

@jbransen made their first contribution in Swatinem/rust-cache#246

@stegaBOB made their first contribution in Swatinem/rust-cache#247

Full Changelog: Swatinem/rust-cache@v2.7.8...v2.8.0

Changelog

Sourced from Swatinem/rust-cache's changelog.

Changelog

2.8.2

Don't overwrite env for cargo-metadata call

2.8.1

Set empty CARGO_ENCODED_RUSTFLAGS when retrieving metadata

Various dependency updates

2.8.0

Add support for warpbuild cache provider

Add new cache-workspace-crates feature

2.7.8

Include CPU arch in the cache key

2.7.7

Also cache cargo install metadata

2.7.6

Allow opting out of caching $CARGO_HOME/bin

Add runner OS in cache key

Adds an option to do lookup-only of the cache

2.7.5

Support Cargo.lock format cargo-lock v4

Only run macOsWorkaround() on macOS

2.7.3

Work around upstream problem that causes cache saving to hang for minutes.

2.7.2

Only key by Cargo.toml and Cargo.lock files of workspace members.

2.7.1

Update toml parser to fix parsing errors.

2.7.0

Properly cache trybuild tests.

... (truncated)

Commits

779680d 2.8.2
2ea64ef Bump smol-toml from 1.4.2 to 1.5.2 in the prd-minor group (#287)
8930d9c Bump the actions group with 3 updates (#288)
c071727 Bump @actions/io from 1.1.3 to 2.0.0 in the prd-major group (#281)
f2a41b7 Bump @types/node from 24.9.0 to 24.10.0 in the dev-minor group (#282)
e306f83 Don't overwrite env for cargo-metadata call (#285)
c911900 Merge pull request #284 from Swatinem/dependabot/github_actions/actions-baeb0...
3aaed55 Bump the actions group with 2 updates
972b315 Merge pull request #283 from Swatinem/dependabot/github_actions/actions-b360d...
07caf06 Bump taiki-e/install-action from 2.62.45 to 2.62.49 in the actions group
Additional commits viewable in compare view

Updates taiki-e/install-action from 2.62.63 to 2.65.13

Release notes

Sourced from taiki-e/install-action's releases.

2.65.13

Update cargo-nextest@latest to 0.9.118.

Update martin@latest to 1.2.0.

Update cargo-insta@latest to 1.46.0.

2.65.12

Update just@latest to 1.46.0.

Update cargo-nextest@latest to 0.9.117.

2.65.11

Update cargo-tarpaulin@latest to 0.35.0.

Update typos@latest to 1.41.0.

Update vacuum@latest to 0.23.0.

2.65.10

Update mise@latest to 2025.12.13.

Update uv@latest to 0.9.21.

2.65.9

Update cargo-llvm-cov@latest to 0.6.22.

2.65.8

Update tombi@latest to 0.7.14.

Update uv@latest to 0.9.20.

Update typos@latest to 1.40.1.

2.65.7

Update cargo-no-dev-deps@latest to 0.2.19.

Update cargo-minimal-versions@latest to 0.1.34.

Update cargo-insta@latest to 1.45.1.

Update cargo-hack@latest to 0.6.40.

Update dprint@latest to 0.51.1.

2.65.6

Update dprint@latest to 0.51.0.

Update vacuum@latest to 0.22.0.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

Update zizmor@latest to 1.20.0.

[2.65.13] - 2026-01-05

Update cargo-nextest@latest to 0.9.118.

Update martin@latest to 1.2.0.

Update cargo-insta@latest to 1.46.0.

[2.65.12] - 2026-01-02

Update just@latest to 1.46.0.

Update cargo-nextest@latest to 0.9.117.

[2.65.11] - 2026-01-01

Update cargo-tarpaulin@latest to 0.35.0.

Update typos@latest to 1.41.0.

Update vacuum@latest to 0.23.0.

[2.65.10] - 2025-12-31

Update mise@latest to 2025.12.13.

Update uv@latest to 0.9.21.

[2.65.9] - 2025-12-30

Update cargo-llvm-cov@latest to 0.6.22.

[2.65.8] - 2025-12-30

Update tombi@latest to 0.7.14.

... (truncated)

Commits

0e76c5c Release 2.65.13
0466464 Update cargo-nextest@latest to 0.9.118
389b563 Update martin@latest to 1.2.0
83028a3 Update cargo-insta@latest to 1.46.0
cc33365 Release 2.65.12
8f085a1 Update just@latest to 1.46.0
6b0d292 Update cargo-nextest@latest to 0.9.117
a983ca7 Release 2.65.11
66de739 Update cargo-tarpaulin@latest to 0.35.0
790813c Update typos@latest to 1.41.0
Additional commits viewable in compare view

Updates actions/upload-artifact from 5.0.0 to 6.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in actions/upload-artifact#719

fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in actions/upload-artifact#744

prepare release v6.0.0 for Node.js 24 support by @salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

Commits

b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
e516bc8 docs: correct description of Node.js 24 support in README
ddc45ed docs: update README to correct action name for Node.js 24 support
615b319 chore: release v6.0.0 for Node.js 24 support
017748b Merge pull request #744 from actions/fix-storage-blob
38d4c79 chore: rebuild dist
7d27270 chore: add missing license cache files for @actions/core, @actions/io, and mi...
5f643d3 chore: update license files for @actions/artifact@5.0.1 dependencies
1df1684 chore: update package-lock.json with @actions/artifact@5.0.1
b5b1a91 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
Additional commits viewable in compare view

Updates codecov/codecov-action from 5.5.1 to 5.5.2

Release notes

Sourced from codecov/codecov-action's releases.

v5.5.2

What's Changed

check gpg only when skip-validation = false by @maxweng-sentry in codecov/codecov-action#1894

chore: disable_search alignment by @freemanzMrojo in codecov/codecov-action#1881

chore(release): 5.5.2 by @thomasrockhu-codecov in codecov/codecov-action#1902

New Contributors

@maxweng-sentry made their first contribution in codecov/codecov-action#1894

@freemanzMrojo made their first contribution in codecov/codecov-action#1881

Full Changelog: codecov/codecov-action@v5.5.1...v5.5.2

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

fix: overwrite pr number on fork by @thomasrockhu-codecov in codecov/codecov-action#1871

build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @app/dependabot in codecov/codecov-action#1868

build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by @app/dependabot in codecov/codecov-action#1867

fix: update to use local app/ dir by @thomasrockhu-codecov in codecov/codecov-action#1872

docs: fix typo in README by @datalater in codecov/codecov-action#1866

Document a codecov-cli version reference example by @webknjaz in codecov/codecov-action#1774

build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by @app/dependabot in codecov/codecov-action#1861

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @app/dependabot in codecov/codecov-action#1833

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

feat: upgrade wrapper to 0.2.4 by @jviall in codecov/codecov-action#1864

Pin actions/github-script by Git SHA by @martincostello in codecov/codecov-action#1859

fix: check reqs exist by @joseph-sentry in codecov/codecov-action#1835

fix: Typo in README by @spalmurray in codecov/codecov-action#1838

docs: Refine OIDC docs by @spalmurray in codecov/codecov-action#1837

build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @app/dependabot in codecov/codecov-action#1829

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by @app/dependabot in codecov/codecov-action#1822

fix: OIDC on forks by @joseph-sentry in codecov/codecov-action#1823

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

671740a chore(release): 5.5.2 (#1902)
96b38e9 chore: disable_search alignment (#1881)
9b6d1f8 check gpg only when skip-validation = false (#1894)
See full diff in compare view

Updates github/codeql-action from 4.31.7 to 4.31.9

Release notes

Sourced from github/codeql-action's releases.

v4.31.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.9 - 16 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.8 - 11 Dec 2025

Update default CodeQL bundle version to 2.23.8. #3354

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.31.9 - 16 Dec 2025

No user facing changes.

4.31.8 - 11 Dec 2025

Update default CodeQL bundle version to 2.23.8. #3354

4.31.7 - 05 Dec 2025

Update default CodeQL bundle version to 2.23.7. #3343

4.31.6 - 01 Dec 2025

No user facing changes.

4.31.5 - 24 Nov 2025

Update default CodeQL bundle version to 2.23.6. #3321

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.

Update default CodeQL bundle version to 2.23.5. #3288

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

Bump minimum CodeQL bundle version to 2.17.6. #3223

When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

... (truncated)

Commits

5d4e8d1 Merge pull request #3371 from github/update-v4.31.9-998798e34
1dc115f Update changelog for v4.31.9
998798e Merge pull request #3352 from github/nickrolfe/jar-min-ff-cleanup
5eb7519 Merge pull request #3358 from github/henrymercer/database-upload-telemetry
d29eddb Extract version number to constant
e962687 Merge branch 'main' into henrymercer/database-upload-telemetry
19c7f96 Rename isOverlayBase
ae5de9a Use getErrorMessage in log too
0cb8633 Prefer performance.now()
c07cc0d Merge pull request #3351 from github/henrymercer/ghec-dr-determine-tools-vers...
Additional commits viewable in compare view

Updates dependabot/fetch-metadata from 2.3.0 to 2.5.0

Release notes

Sourced from dependabot/fetch-metadata's releases.

v2.5.0

What's Changed

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 by @dependabot[bot] in dependabot/fetch-metadata#628

Bump the dev-dependencies group with 11 updates by @dependabot[bot] in dependabot/fetch-metadata#629

Bump actions/create-github-app-token from 2.0.6 to 2.1.1 by @dependabot[bot] in dependabot/fetch-metadata#635

Bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @dependabot[bot] in dependabot/fetch-metadata#638

Bump actions/checkout from 4 to 5 by @dependabot[bot] in dependabot/fetch-metadata#636

Bump actions/setup-node from 4 to 5 by @dependabot[bot] in dependabot/fetch-metadata#637

Bump actions/setup-node from 5 to 6 by @dependabot[bot] in dependabot/fetch-metadata#639

Bump actions/create-github-app-token from 2.1.4 to 2.2.0 by @dependabot[bot] in dependabot/fetch-metadata#643

Bump actions/checkout from 5 to 6 by @dependabot[bot] in dependabot/fetch-metadata#642

Bump actions/create-github-app-token from 2.2.0 to 2.2.1 by @dependabot[bot] in dependabot/fetch-metadata#648

Bump js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in dependabot/fetch-metadata#644

Bump express from 5.1.0 to 5.2.1 by @dependabot[bot] in dependabot/fetch-metadata#645

Bump @modelcontextprotocol/sdk from 1.11.2 to 1.24.0 by @dependabot[bot] in dependabot/fetch-metadata#647

v2.5.0 by @fetch-metadata-action-automation[bot] in dependabot/fetch-metadata#631

Full Changelog: dependabot/fetch-metadata@v2...v2.5.0

v2.4.0

What's Changed

Bump actions/create-github-app-token from 1.11.0 to 1.11.3 by @dependabot in dependabot/fetch-metadata#598

Bump @vercel/ncc from 0.38.1 to 0.38.3 by @dependabot in dependabot/fetch-metadata#578

Add missing @octokit/request-error to package.json by @jeffwidman in dependabot/fetch-metadata#605

Bump to ESLint 9 by @jeffwidman in dependabot/fetch-metadata#606

Stop using a node16 devcontainer image by @jeffwidman in dependabot/fetch-metadata#608

Make typescript compile to "es2022" by @jeffwidman in dependabot/fetch-metadata#609

Bump the dev-dependencies group across 1 directory with 8 updates by @dependabot in dependabot/fetch-metadata#607

Tidy up examples slightly by @jeffwidman in dependabot/fetch-metadata#611

Fixup some anchor tags that weren't deeplinking by @jeffwidman in dependabot/fetch-metadata#614

Remove unnecessary hardcoding of ref by @jeffwidman in dependabot/fetch-metadata#617

Bump actions/create-github-app-token from 1.11.3 to 2.0.2 by @dependabot in dependabot/fetch-metadata#616

Enable caching of npm install/npm ci for setup-node action by @jeffwidman in dependabot/fetch-metadata#618

Add workflow to publish new version of immutable action on every release by @jeffwidman in dependabot/fetch-metadata#623

Bump actions/create-github-app-token from 2.0.2 to 2.0.6 by @dependabot in dependabot/fetch-metadata#621

v2.4.0 by @fetch-metadata-action-automation in dependabot/fetch-metadata#594

Full Changelog: dependabot/fetch-metadata@v2...v2.4.0

Commits

21025c7 v2.5.0
252291c Merge pull request #647 from dependabot/dependabot/npm_and_yarn/modelcontextp...
fa144c9 chore: Migrate jest expectation function
33c7a0b bug: Mock PR body in test
99c27ad Bump @modelcontextprotocol/sdk from 1.11.2 to 1.24.0
3837dcc Merge pull request #645 from dependabot/dependabot/npm_and_yarn/express-5.2.1
d411582 Bump express from 5.1.0 to 5.2.1
186ccbb Merge pull request #644 from dependabot/dependabot/npm_and_yarn/js-yaml-3.14.2
84c891e Bump js-yaml from 3.14.1 to 3.14.2
4542092 Merge pull request #648 from dependabot/dependabot/github_actions/actions/cre...
Additional commits viewable in compare view

Updates step-security/action-gh-release from 2.4.1 to 2.4.2

Release notes

Sourced from step-security/action-gh-release's releases.

v2.4.2

What's Changed

fix: Security updates by @github-actions[bot] in step-security/action-gh-release#59

fix: apply code build script by @github-actions[bot] in step-security/action-gh-release#62

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/action-gh-release#58

Full Changelog: step-security/action-gh-release@v2...v2.4.2

Commits

5f6a6ab Merge pull request #58 from step-security/auto-cherry-pick
e63aa94 fix: apply code build script
be1ce1e Merge branch 'main' into auto-cherry-pick
2c5a3cd workflow/package commits cherry-picked manually
c5ada9d Merge pull request #59 from step-security/npm-audit-fix
515f684 fix: apply audit fixes
b0d24e1 fix: apply audit fixes
45b01eb feat: Ensure generated release notes cannot be over 125000 characters (#684)
2b31e94 chore: bump node to 24.11.0
See full diff in compare view

Updates docker/setup-buildx-action from 3.11.1 to 3.12.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.12.0

Deprecate install input by @crazy-max in docker/setup-buildx-action#455

Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/setup-buildx-action#434

Bump brace-expansion from 1.1.11 to 1.1.12 in docker/setup-buildx-action#436

Bump form-data from 2.5.1 to 2.5.5 in docker/setup-buildx-action#432

Bump undici from 5.28.4 to 5.29.0 in docker/setup-buildx-action#435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

Commits

8d2750c Merge pull request #455 from crazy-max/install-deprecated
e81846b deprecate install input
65d18f8 Merge pull request #454 from docker/dependabot/github_actions/actions/checkout-6
000d75d build(deps): bump actions/checkout from 5 to 6
1583c0f Merge pull request #443 from nicolasleger/patch-1
ed158e7 doc: bump actions/checkout from 4 to 5
4cc794f Merge pull request #441 from docker/dependabot/github_actions/actions/checkout-5
4dfc3d6 build(deps): bump actions/checkout from 4 to 5
af1b253 Merge pull request #440 from crazy-max/k3s-build
3c6ab92 ci: k3s test with latest buildx
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.13.3` | `2.14.0` | | [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.7.8` | `2.8.2` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.62.63` | `2.65.13` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5.0.0` | `6.0.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.1` | `5.5.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.31.7` | `4.31.9` | | [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `2.3.0` | `2.5.0` | | [step-security/action-gh-release](https://github.com/step-security/action-gh-release) | `2.4.1` | `2.4.2` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.11.1` | `3.12.0` | Updates `step-security/harden-runner` from 2.13.3 to 2.14.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@v2.13.3...20cf305) Updates `Swatinem/rust-cache` from 2.7.8 to 2.8.2 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](Swatinem/rust-cache@9d47c6a...779680d) Updates `taiki-e/install-action` from 2.62.63 to 2.65.13 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@50708e9...0e76c5c) Updates `actions/upload-artifact` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...b7c566a) Updates `codecov/codecov-action` from 5.5.1 to 5.5.2 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@5a10915...671740a) Updates `github/codeql-action` from 4.31.7 to 4.31.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cf1bb45...5d4e8d1) Updates `dependabot/fetch-metadata` from 2.3.0 to 2.5.0 - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@d7267f6...21025c7) Updates `step-security/action-gh-release` from 2.4.1 to 2.4.2 - [Release notes](https://github.com/step-security/action-gh-release/releases) - [Commits](step-security/action-gh-release@674f8f8...5f6a6ab) Updates `docker/setup-buildx-action` from 3.11.1 to 3.12.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@e468171...8d2750c) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: Swatinem/rust-cache dependency-version: 2.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.65.13 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 5.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.31.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dependabot/fetch-metadata dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: step-security/action-gh-release dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 3.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-01-06T07:18:35Z

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

evansims · 2026-01-07T00:25:21Z

@dependabot recreate

dependabot · 2026-01-07T00:25:24Z

The dependabot.yml entry that created this PR has been deleted so this PR can't be recreated. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

dependabot · 2026-01-07T00:25:38Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot added the area/ci CI/CD label Jan 6, 2026

github-actions bot added the area/config Configuration label Jan 6, 2026

evansims closed this Jan 7, 2026

dependabot bot deleted the dependabot/github_actions/actions-877aee1750 branch January 7, 2026 00:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci(deps): bump the actions group across 1 directory with 9 updates#54

ci(deps): bump the actions group across 1 directory with 9 updates#54
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/actions-877aee1750

dependabot bot commented on behalf of github Jan 6, 2026 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Jan 6, 2026

Uh oh!

evansims commented Jan 7, 2026

Uh oh!

dependabot bot commented on behalf of github Jan 7, 2026

Uh oh!

dependabot bot commented on behalf of github Jan 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.14.0

What's Changed

v2.8.2

What's Changed

New Contributors

v2.8.1

What's Changed

New Contributors

v2.8.0

What's Changed

New Contributors

Changelog

2.8.2

2.8.1

2.8.0

2.7.8

2.7.7

2.7.6

2.7.5

2.7.3

2.7.2

2.7.1

2.7.0

2.65.13

2.65.12

2.65.11

2.65.10

2.65.9

2.65.8

2.65.7

2.65.6

Changelog

[Unreleased]

[2.65.13] - 2026-01-05

[2.65.12] - 2026-01-02

[2.65.11] - 2026-01-01

[2.65.10] - 2025-12-31

[2.65.9] - 2025-12-30

[2.65.8] - 2025-12-30

v6.0.0

v6 - What's new

Node.js 24

What's Changed

v5.5.2

What's Changed

New Contributors

v5.5.2

What's Changed

v5.5.1

What's Changed

v5.5.0

What's Changed

v5.4.3

What's Changed

v5.4.2

v4.31.9

CodeQL Action Changelog

4.31.9 - 16 Dec 2025

v4.31.8

CodeQL Action Changelog

4.31.8 - 11 Dec 2025

CodeQL Action Changelog

[UNRELEASED]

4.31.9 - 16 Dec 2025

4.31.8 - 11 Dec 2025

4.31.7 - 05 Dec 2025

4.31.6 - 01 Dec 2025

4.31.5 - 24 Nov 2025

4.31.4 - 18 Nov 2025

4.31.3 - 13 Nov 2025

4.31.2 - 30 Oct 2025

4.31.1 - 30 Oct 2025

4.31.0 - 24 Oct 2025

v2.5.0

What's Changed

v2.4.0

What's Changed

dependabot bot commented on behalf of github Jan 6, 2026 •

edited

Loading