ci: bump the actions group with 7 updates by dependabot[bot] · Pull Request #1011 · dekobon/big-code-analysis

dependabot · 2026-07-05T05:16:59Z

Bumps the actions group with 7 updates:

Package	From	To
dorny/paths-filter	`4.0.1`	`4.0.2`
dtolnay/rust-toolchain	`67ef31d5b988238dd797d409d6f9574278e20537`	`fa04a1451ff1842e2626ccb99004d0195b455a88`
github/codeql-action/upload-sarif	`4.36.2`	`4.36.3`
taiki-e/install-action	`2.82.5`	`2.82.8`
github/codeql-action/init	`4.36.2`	`4.36.3`
github/codeql-action/analyze	`4.36.2`	`4.36.3`
docker/setup-qemu-action	`4.1.0`	`4.2.0`

Updates dorny/paths-filter from 4.0.1 to 4.0.2

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.2

What's Changed

fix warning message by @cgundy in dorny/paths-filter#282

chore: fix GitHub spelling in logs by @squat in dorny/paths-filter#278

fix: use rev-parse instead of branch --show-current for older git compat by @saschabratton in dorny/paths-filter#303

fix: work around git dubious ownership errors in container jobs by @saschabratton in dorny/paths-filter#317

docs: update changelog for v4.0.2 by @saschabratton in dorny/paths-filter#318

New Contributors

@cgundy made their first contribution in dorny/paths-filter#282

@squat made their first contribution in dorny/paths-filter#278

Full Changelog: dorny/paths-filter@v4.0.1...v4.0.2

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.2

Work around git dubious ownership errors in container jobs

Use rev-parse instead of branch --show-current for older git compat

Fix warning message

v4.0.1

Support merge queue

v4.0.0

Update action runtime to node24

v3.0.3

Add missing predicate-quantifier

v3.0.2

Add config parameter for predicate quantifier

v3.0.1

Compare base and ref when token is empty

v3.0.0

Update to Node.js 20

Update all dependencies

v2.11.1

Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output

Document need for pull-requests: read permission

Updating to actions/checkout@v3

v2.11.0

Set list-files input parameter as not required

Update Node.js

Fix incorrect handling of Unicode characters in exec()

Use Octokit pagination

Updates real world links

v2.10.2

Fix getLocalRef() returns wrong ref

v2.10.1

Improve robustness of change detection

v2.10.0

Add ref input parameter

Fix change detection in PR when pullRequest.changed_files is incorrect

v2.9.3

Fix change detection when base is a tag

... (truncated)

Commits

7b450ff docs: update changelog for v4.0.2 (#318)
9280377 fix: work around git dubious ownership errors in container jobs (#317)
f3ceefd fix: use rev-parse instead of branch --show-current for older git compat (#303)
61f87a1 chore: fix GitHub spelling in logs (#278)
b82ff81 fix warning message (#282)
See full diff in compare view

Updates dtolnay/rust-toolchain from 67ef31d5b988238dd797d409d6f9574278e20537 to fa04a1451ff1842e2626ccb99004d0195b455a88

Commits

fa04a14 Add 1.96.1 patch release
See full diff in compare view

Updates github/codeql-action/upload-sarif from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

... (truncated)

Commits

54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
e78819e Trigger checks
2c9d3d6 Update changelog for v4.36.3
1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
d5f0145 Log when repository property has a value but is ignored
f27f563 Add test for when the FF is off
0025d0f Use FF
f7fa18f Add FF for config file repo property
628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
9cfb67b Add clarifying comments
Additional commits viewable in compare view

Updates taiki-e/install-action from 2.82.5 to 2.82.8

Release notes

Sourced from taiki-e/install-action's releases.

2.82.8

Update vacuum@latest to 0.29.8.

Update uv@latest to 0.11.26.

Update typos@latest to 1.48.0.

Update trivy@latest to 0.72.0.

Update tombi@latest to 1.1.7.

Update prek@latest to 0.4.6.

Update mise@latest to 2026.7.0.

Update just@latest to 1.55.1.

Update biome@latest to 2.5.2.

2.82.7

Update tombi@latest to 1.1.6.

Update kingfisher@latest to 1.105.0.

Update gungraun-runner@latest to 0.19.3.

Update editorconfig-checker@latest to 3.8.0.

Update dprint@latest to 0.55.1.

Update cargo-tarpaulin@latest to 0.36.0.

2.82.6

Update vacuum@latest to 0.29.7.

Update uv@latest to 0.11.25.

Update syft@latest to 1.46.0.

Update dprint@latest to 0.55.0.

Update cargo-auditable@latest to 0.7.5.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.82.8] - 2026-07-03

Update vacuum@latest to 0.29.8.

Update uv@latest to 0.11.26.

Update typos@latest to 1.48.0.

Update trivy@latest to 0.72.0.

Update tombi@latest to 1.1.7.

Update prek@latest to 0.4.6.

Update mise@latest to 2026.7.0.

Update just@latest to 1.55.1.

Update biome@latest to 2.5.2.

[2.82.7] - 2026-06-30

Update tombi@latest to 1.1.6.

Update kingfisher@latest to 1.105.0.

Update gungraun-runner@latest to 0.19.3.

Update editorconfig-checker@latest to 3.8.0.

Update dprint@latest to 0.55.1.

Update cargo-tarpaulin@latest to 0.36.0.

[2.82.6] - 2026-06-29

Update vacuum@latest to 0.29.7.

... (truncated)

Commits

c93ccc0 Release 2.82.8
5083f18 Update vacuum@latest to 0.29.8
fdd68a8 Update uv@latest to 0.11.26
3b61d4b Update typos@latest to 1.48.0
16114d4 Update trivy@latest to 0.72.0
f09d53f Update tombi@latest to 1.1.7
d2b25b8 Update prek@latest to 0.4.6
2c15d4e Update mise@latest to 2026.7.0
3f8031c Update just@latest to 1.55.1
7057770 Update biome@latest to 2.5.2
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

... (truncated)

Commits

54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
e78819e Trigger checks
2c9d3d6 Update changelog for v4.36.3
1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
d5f0145 Log when repository property has a value but is ignored
f27f563 Add test for when the FF is off
0025d0f Use FF
f7fa18f Add FF for config file repo property
628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
9cfb67b Add clarifying comments
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

... (truncated)

Commits

54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
e78819e Trigger checks
2c9d3d6 Update changelog for v4.36.3
1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
d5f0145 Log when repository property has a value but is ignored
f27f563 Add test for when the FF is off
0025d0f Use FF
f7fa18f Add FF for config file repo property
628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
9cfb67b Add clarifying comments
Additional commits viewable in compare view

Updates docker/setup-qemu-action from 4.1.0 to 4.2.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-qemu-action#311

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-qemu-action#295

Bump @docker/actions-toolkit from 0.91.0 to 0.92.0 in docker/setup-qemu-action#315

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-qemu-action#312

Bump js-yaml from 4.1.1 to 4.2.0 in docker/setup-qemu-action#310

Bump tmp from 0.2.6 to 0.2.7 in docker/setup-qemu-action#304

Bump undici from 6.26.0 to 6.27.0 in docker/setup-qemu-action#308

Bump vite from 7.3.2 to 7.3.6 in docker/setup-qemu-action#307

Full Changelog: docker/setup-qemu-action@v4.1.0...v4.2.0

Commits

96fe6ef Merge pull request #315 from docker/dependabot/npm_and_yarn/docker/actions-to...
31f08d3 [dependabot skip] chore: update generated content
4e7017a build(deps): bump @docker/actions-toolkit from 0.91.0 to 0.92.0
0eca235 Merge pull request #314 from crazy-max/fix-yarn-preapprove-actions-toolkit
ea66a41 chore: allow actions-toolkit to bypass yarn age gate
451542b Merge pull request #308 from docker/dependabot/npm_and_yarn/undici-6.27.0
532ae00 [dependabot skip] chore: update generated content
b6f5af6 build(deps): bump undici from 6.26.0 to 6.27.0
cf96b86 Merge pull request #304 from docker/dependabot/npm_and_yarn/tmp-0.2.7
f0ba643 [dependabot skip] chore: update generated content
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 7 updates: | Package | From | To | | --- | --- | --- | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `67ef31d5b988238dd797d409d6f9574278e20537` | `fa04a1451ff1842e2626ccb99004d0195b455a88` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.5` | `2.82.8` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.1.0` | `4.2.0` | Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@fbd0ab8...7b450ff) Updates `dtolnay/rust-toolchain` from 67ef31d5b988238dd797d409d6f9574278e20537 to fa04a1451ff1842e2626ccb99004d0195b455a88 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](dtolnay/rust-toolchain@67ef31d...fa04a14) Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...54f647b) Updates `taiki-e/install-action` from 2.82.5 to 2.82.8 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@bffeee2...c93ccc0) Updates `github/codeql-action/init` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...54f647b) Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...54f647b) Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@0611638...96fe6ef) --- updated-dependencies: - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dtolnay/rust-toolchain dependency-version: fa04a1451ff1842e2626ccb99004d0195b455a88 dependency-type: direct:production dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.82.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

The cargo-deny gate (and the aggregate `ci` required check that depends on it) went red on advisories unrelated to this branch's GitHub Actions bump: - crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204): invalid pointer dereference in the `fmt::Pointer` impl. Ships transitively via `crossbeam`, a library dependency; lockfile-only bump. - quick-xml 0.39 -> 0.41 (RUSTSEC-2026-0194 quadratic duplicate- attribute check, RUSTSEC-2026-0195 unbounded namespace allocation in `NsReader`). Dev-only test dependency. The quick-xml bump deprecates `Attribute::unescape_value()`; under `-D warnings` that fails the build. The XML-validation test helpers migrate to `normalized_value(XmlVersion::Implicit1_0)`, which is the exact code path the deprecated method delegated to (same version, depth, and predefined-entity resolver), so decoding behavior is unchanged. cargo-deny (advisories/bans/licenses/sources), clippy, rustfmt, rumdl, and the full test suite all pass locally with no snapshot drift.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 5, 2026

dekobon merged commit 2b32a63 into main Jul 7, 2026
50 checks passed

dekobon deleted the dependabot/github_actions/actions-f0c49cdef5 branch July 7, 2026 02:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: bump the actions group with 7 updates#1011

ci: bump the actions group with 7 updates#1011
dekobon merged 2 commits into
mainfrom
dependabot/github_actions/actions-f0c49cdef5

dependabot Bot commented on behalf of github Jul 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 5, 2026

v4.0.2

What's Changed

New Contributors

Changelog

v4.0.2

v4.0.1

v4.0.0

v3.0.3

v3.0.2

v3.0.1

v3.0.0

v2.11.1

v2.11.0

v2.10.2

v2.10.1

v2.10.0

v2.9.3

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

2.82.8

2.82.7

2.82.6

Changelog

[Unreleased]

[2.82.8] - 2026-07-03

[2.82.7] - 2026-06-30

[2.82.6] - 2026-06-29

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

v4.2.0

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant