Skip to content

Bump the actions group across 1 directory with 12 updates - #225

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-9ff2ec8c66
Closed

Bump the actions group across 1 directory with 12 updates#225
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-9ff2ec8c66

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 12 updates in the / directory:

Package From To
actions/setup-java 6.0.0 6.1.0
gradle/actions/setup-gradle 6.3.0 6.4.0
dtolnay/rust-toolchain 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 683b588c487a69d01f6c6ddf40f036ff682cc2c8
github/codeql-action/init 4.37.9 4.39.0
github/codeql-action/analyze 4.37.9 4.39.0
github/codeql-action/upload-sarif 4.37.9 4.39.0
ruby/setup-ruby 1.321.0 1.331.0
taiki-e/install-action 2.87.9 2.87.29
actions/upload-artifact 7.0.1 7.0.2
actions/download-artifact 8.0.1 8.0.2
actions/setup-node 7.0.0 7.1.0
zizmorcore/zizmor-action 0.6.3 0.7.1

Updates actions/setup-java from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-java's releases.

v6.1.0

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

v6.0.1

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

Commits
  • b843ebf Support Maven plugin repositories in generated settings.xml (#1286)
  • 2a69be2 feat: support Maven server credential origins (#1282)
  • d0e6e4d chore(deps): bump the monthly-npm-updates group with 13 updates (#1276)
  • b24925b chore(deps): bump undici from 6.28.0 to 6.29.0 (#1274)
  • 47b3648 Support Temurin JEP 322 patch versions like 26.0.2.1+1 (#1270) (#1279)
  • 74920aa Prefer Zulu 4-segment hotfix builds when resolving version ranges (#1278)
  • a78ec39 Stop GPG agent before removing signature-verification home (#1273)
  • 97c5a5e Support Temurin on Linux RISC-V (#1269)
  • 1aa87b6 Preserve compound Liberica build versions from .sdkmanrc (#1268)
  • de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
  • Additional commits viewable in compare view

Updates gradle/actions/setup-gradle from 6.3.0 to 6.4.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.4.0

Highlights

Gradle version support status in the Job Summary

The actions now report the support status of every Gradle version used in a workflow, as job annotations and in the Job Summary (#1057). Thanks to @​ov7a for the contribution.

version kind job annotation version table below the table
End-of-life — two or more major versions behind the latest release warning ⚠️ expandable section naming the affected release lines, pointing at the Gradle Security Subscription
Out of date — one major behind, or more than two minors behind on the current major notice ℹ️ one-line legend pointing at the Gradle release lifecycle docs
Current none — —

Deliberately not reported: patch releases (being on 9.7.0 when 9.7.1 exists is not flagged) and pre-releases (release candidates, milestones and snapshots never produce annotations). The latest Gradle release is determined from the wrapper checksum data already bundled with the action, so no network access is required.

Note that these annotations are emitted independently of the add-job-summary setting: setting add-job-summary: 'never' suppresses the Job Summary itself, but the warning and notice annotations remain.

Gradle itself is now reported in the dependency graph

The dependency-submission action now applies v1.5.0 of the GitHub Dependency Graph Gradle Plugin (up from v1.4.2) (#1069).

The headline change is that the Gradle Build Tool running the build is now reported as an org.gradle:gradle-core dependency, so that GitHub can surface known vulnerabilities in the version of Gradle used to run your build. These are the coordinates that GitHub advisories for the Gradle Build Tool are published against.

Details worth knowing:

  • The entry is always reported as a direct dependency with development scope.
  • It is not affected by the project, configuration or scope filters, so it appears even in graphs that filter aggressively.
  • Expect dependency graphs to gain this one new entry the first time a build runs after upgrading.

A new Gradle signing key, if you use dependency verification

[!IMPORTANT] If your build has dependency verification enabled, you must add a second trusted key before upgrading, or Dependency Graph generation will fail signature verification.

github-dependency-graph-gradle-plugin 1.5.0 is signed with a new Gradle signing subkey, and the key previously documented in our setup guide has been revoked upstream:

... (truncated)

Commits
  • 3f5f9ad Document the new Gradle signing key for dependency verification (#1071)
  • b031f6d [bot] Update dist directory
  • 5bc4175 Bump dependency-graph-gradle-plugin to 1.5.0 (#1069)
  • f3ff59b Combined automated updates: wrapper checksums, npm dependencies, setup-java (...
  • 7927085 Update .tool-versions: node 24.18.0, gradle 9.7.1, java 17 (#1068)
  • c3897a4 [bot] Update dist directory
  • 6b92be1 Update dependencies (#1065)
  • 0d208da [bot] Update dist directory
  • e49d0a3 Report EOL and maintenance status for Gradle versions (#1057)
  • 575435b Use the root-qualified :wrapper task (#1064)
  • Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 683b588c487a69d01f6c6ddf40f036ff682cc2c8

Commits
  • 683b588 Add 1.99.1 patch release
  • e2a55d2 Merge pull request #187 from dtolnay/pwn
  • 6af9a09 Unify flags[@] and downgrade[@]
  • 83d0610 Safely handle action inputs
  • 7e38f4b Merge pull request #186 from WaterWhisperer/feat/retry-install
  • 7645b07 Retry release-server checksum failures
  • 02cb101 Merge pull request 185 from fufesou/feat/force-non-host
  • b38a663 Pass --force-non-host unconditionally
  • a4f61a0 Document rustup non-host opt-in requirement
  • 06b350f Support force-non-host toolchains
  • Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.9 to 4.39.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

  • Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits
  • 6f2ac81 Merge pull request #4239 from github/update-v4.39.0-d63383a73
  • eb1c428 Trigger workflows
  • 4443333 Update changelog for v4.39.0
  • d63383a Merge pull request #4233 from github/mbg/start-proxy/report-version
  • 8dec0b9 Rename path to result in tests
  • 4eabea6 Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version
  • 57938b8 Merge pull request #4201 from github/mario-campos/automate-changenotes-assemble
  • ee07b50 Merge pull request #4236 from github/mbg/add-missing-changenotes
  • a897ed5 Add change note for #4206
  • c8bd019 Add change note for #4198
  • Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.39.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

  • Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits
  • 6f2ac81 Merge pull request #4239 from github/update-v4.39.0-d63383a73
  • eb1c428 Trigger workflows
  • 4443333 Update changelog for v4.39.0
  • d63383a Merge pull request #4233 from github/mbg/start-proxy/report-version
  • 8dec0b9 Rename path to result in tests
  • 4eabea6 Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version
  • 57938b8 Merge pull request #4201 from github/mario-campos/automate-changenotes-assemble
  • ee07b50 Merge pull request #4236 from github/mbg/add-missing-changenotes
  • a897ed5 Add change note for #4206
  • c8bd019 Add change note for #4198
  • Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.37.9 to 4.39.0

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

  • Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits
  • 6f2ac81 Merge pull request #4239 from github/update-v4.39.0-d63383a73
  • eb1c428 Trigger workflows
  • 4443333 Update changelog for v4.39.0
  • d63383a Merge pull request #4233 from github/mbg/start-proxy/report-version
  • 8dec0b9 Rename path to result in tests
  • 4eabea6 Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version
  • 57938b8 Merge pull request #4201 from github/mario-campos/automate-changenotes-assemble
  • ee07b50 Merge pull request #4236 from github/mbg/add-missing-changenotes
  • a897ed5 Add change note for #4206
  • c8bd019 Add change note for #4198
  • Additional commits viewable in compare view

Updates ruby/setup-ruby from 1.321.0 to 1.331.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.331.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.330.0...v1.331.0

v1.330.0

What's Changed

New Contributors

Full Changelog: ruby/setup-ruby@v1.329.0...v1.330.0

v1.329.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.328.0...v1.329.0

v1.328.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.327.0...v1.328.0

v1.327.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.326.0...v1.327.0

v1.326.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.325.0...v1.326.0

v1.325.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.324.0...v1.325.0

... (truncated)

Commits
  • 824c0e2 Use ruby's Gem::Version instead of npm's semver to parse rubygems version
  • a89e929 Tweak wording in the README, update link and simplify
  • fbbff8d Suggest the latest patch release when a version is unavailable
  • 651ff0d Add ruby-4.1.0-preview1
  • e81a8fa Fix windows msys1 setup
  • 1459426 Update CRuby releases on Windows
  • 762794c Add ruby-3.4.11
  • e8944e8 Add jruby-10.0.7.0,jruby-10.1.2.0
  • a0102e0 Add truffleruby-40.0.0,truffleruby+graalvm-40.0.0
  • 984c0c8 Update CRuby releases on Windows
  • Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.9 to 2.87.29

Release notes

Sourced from taiki-e/install-action's releases.

2.87.29

  • Update zizmor@latest to 1.31.0.

  • Update wasmtime@latest to 49.0.3.

  • Update wasm-tools@latest to 1.262.0.

  • Update uv@latest to 0.13.1.

  • Update trivy@latest to 0.76.0.

  • Update tombi@latest to 1.8.4.

  • Update release-plz@latest to 0.3.172.

  • Update osv-scanner@latest to 2.7.0.

  • Update mise@latest to 2026.10.11.

  • Update mdbook-d2@latest to 0.3.9.

  • Update kingfisher@latest to 2.13.0.

  • Update kache@latest to 1.2.1.

  • Update just@latest to 1.59.0.

  • Update dprint@latest to 0.63.0.

  • Update cargo-crap@latest to 0.8.0.

  • Update bpf-linker@latest to 0.12.0.

2.87.28

  • Update dprint@latest to 0.62.0.

  • Update vacuum@latest to 0.33.0.

  • Update uv@latest to 0.13.0.

  • Update tombi@latest to 1.8.1.

  • Update release-plz@latest to 0.3.171.

  • Update rclone@latest to 1.75.2.

  • Update mise@latest to 2026.10.7.

  • Update cargo-binstall@latest to 1.25.3.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.88.0] - 2026-10-28

[2.87.33] - 2026-10-28

  • Update vacuum@latest to 0.35.4.

  • Update uv@latest to 0.13.6.

  • Update trunk@latest to 0.22.1.

    Description has been truncated

Copilot AI balanced review requested due to automatic review settings October 22, 2026 09:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 22, 2026
Copilot AI approved these changes Oct 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approved

The changes are limited to action-pin updates, with no blocking compatibility issues identified in their existing workflow usage.

No open issues 🎉

What changed in this PR

Updates 12 SHA-pinned GitHub Actions across eight workflows that build, test, scan, and release the Fizzy SDK. Workflow configuration and SDK code remain unchanged.

Changes:

  • Refresh language setup and build-tool actions.
  • Update CodeQL, security tooling, and workflow scanning actions.
  • Bump artifact upload and download actions used for Rust releases.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File Description
.github/​workflows/​test.yml Updates setup, build, and lint actions for SDK testing.
.github/​workflows/​smithy-verify.yml Updates Java setup for Smithy verification.
.github/​workflows/​security.yml Updates runtime setup, Rust tooling, and SARIF uploads.
.github/​workflows/​release-typescript.yml Updates Node.js setup for TypeScript releases.
.github/​workflows/​release-rust.yml Updates Rust tooling and release artifact transfers.
.github/​workflows/​release-ruby.yml Updates Ruby setup for gem releases.
.github/​workflows/​release-kotlin.yml Updates Java setup for Kotlin releases.
.github/​workflows/​codeql.yml Updates CodeQL actions and supporting build tools.

Review effort: Balanced

@dependabot
Bump the actions group across 1 directory with 12 updates
a88977f 
Bumps the actions group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-java](https://github.com/actions/setup-java) | `6.0.0` | `6.1.0` |
| [gradle/actions/setup-gradle](https://github.com/gradle/actions) | `6.3.0` | `6.4.0` |
| [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772` | `683b588c487a69d01f6c6ddf40f036ff682cc2c8` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.321.0` | `1.331.0` |
| [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.9` | `2.87.29` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.3` | `0.7.1` |



Updates `actions/setup-java` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@dd06d9c...b843ebf)

Updates `gradle/actions/setup-gradle` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@9c97196...3f5f9ad)

Updates `dtolnay/rust-toolchain` from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 683b588c487a69d01f6c6ddf40f036ff682cc2c8
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](dtolnay/rust-toolchain@6c977a6...683b588)

Updates `github/codeql-action/init` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `github/codeql-action/upload-sarif` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `ruby/setup-ruby` from 1.321.0 to 1.331.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@95ef2b0...824c0e2)

Updates `taiki-e/install-action` from 2.87.9 to 2.87.29
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@c3ec0de...8cca091)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `zizmorcore/zizmor-action` from 0.6.3 to 0.7.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@70fb788...85b2b9f)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/setup-java
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: dtolnay/rust-toolchain
  dependency-version: 683b588c487a69d01f6c6ddf40f036ff682cc2c8
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: gradle/actions/setup-gradle
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: ruby/setup-ruby
  dependency-version: 1.329.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.87.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-9ff2ec8c66 branch from cdc639e to a88977f Compare October 29, 2026 09:29
@dependabot @github

dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 5, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-9ff2ec8c66 branch November 5, 2026 09:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant