deps(actions): bump the actions group across 1 directory with 13 updates by dependabot[bot] · Pull Request #339 · basecamp/basecamp-sdk

dependabot · 2026-06-15T11:13:35Z

Bumps the actions group with 13 updates in the / directory:

Package	From	To
actions/checkout	`6.0.2`	`6.0.3`
actions/ai-inference	`2.0.7`	`2.1.1`
github/codeql-action	`4.35.2`	`4.36.2`
dependabot/fetch-metadata	`3.0.0`	`3.1.0`
actions/labeler	`6.0.1`	`6.1.0`
astral-sh/setup-uv	`8.1.0`	`8.2.0`
ruby/setup-ruby	`1.302.0`	`1.310.0`
rubygems/configure-rubygems-credentials	`1.0.0`	`2.0.0`
actions/setup-node	`6.3.0`	`6.4.0`
aquasecurity/trivy-action	`0.35.0`	`0.36.0`
actions/dependency-review-action	`4.9.0`	`5.0.0`
zizmorcore/zizmor-action	`0.5.3`	`0.5.6`
golangci/golangci-lint-action	`9.2.0`	`9.2.1`

Updates actions/checkout from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

... (truncated)

Commits

df4cb1c Update changelog for v6.0.3 (#2446)
1cce339 Fix checkout init for SHA-256 repositories (#2439)
900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
0c366fd Update changelog (#2357)
See full diff in compare view

Updates actions/ai-inference from 2.0.7 to 2.1.1

Release notes

Sourced from actions/ai-inference's releases.

v2.1.1

What's Changed

fix: delay process.exit on Windows to dodge libuv UV_HANDLE_CLOSING crash by @mickey-mikey in actions/ai-inference#228

New Contributors

@mickey-mikey made their first contribution in actions/ai-inference#228

Full Changelog: actions/ai-inference@v2...v2.1.1

v2.1.0

What's Changed

Add provider: copilot to route inference through GitHub Copilot CLI by @sgoedecke in actions/ai-inference#221

Full Changelog: actions/ai-inference@v2.0.8...v2.1.0

v2.0.8

What's Changed

chore(deps-dev): bump fast-xml-parser from 5.2.3 to 5.4.2 by @dependabot[bot] in actions/ai-inference#182

Fix CI error: Check Transpiled JavaScript / Check dist by @johan-j in actions/ai-inference#190

Security fix mcp token exposure 9299248942858101367 by @Pet3cy in actions/ai-inference#186

chore(deps): bump hono from 4.11.3 to 4.12.7 by @dependabot[bot] in actions/ai-inference#189

chore(deps): bump openai from 5.11.0 to 6.7.0 by @dependabot[bot] in actions/ai-inference#140

chore(deps): bump @actions/core from 1.11.1 to 2.0.2 by @dependabot[bot] in actions/ai-inference#161

chore(deps-dev): bump ajv from 6.12.6 to 6.14.0 by @dependabot[bot] in actions/ai-inference#181

chore(deps-dev): bump rollup from 4.43.0 to 4.59.0 by @dependabot[bot] in actions/ai-inference#179

chore(deps): bump qs from 6.14.1 to 6.14.2 by @dependabot[bot] in actions/ai-inference#174

chore(deps): bump @modelcontextprotocol/sdk from 1.25.2 to 1.26.0 by @dependabot[bot] in actions/ai-inference#169

chore(deps-dev): bump the npm-development group across 1 directory with 11 updates by @dependabot[bot] in actions/ai-inference#191

chore(deps): bump the actions-minor group across 1 directory with 3 updates by @dependabot[bot] in actions/ai-inference#154

New Contributors

@johan-j made their first contribution in actions/ai-inference#190

@Pet3cy made their first contribution in actions/ai-inference#186

Full Changelog: actions/ai-inference@v2...v2.0.8

Commits

a780588 Merge pull request #228 from mickey-mikey/fix/libuv-windows-exit
99b6962 chore: npm audit fix — clear 17 transitive-dep CVEs
200ca3a ci: disable redundant Biome validators and add dependabot cooldown
0e2c697 chore: refresh .licenses cache
0bb3dae fix: delay process.exit on Windows to dodge libuv UV_HANDLE_CLOSING crash
17ff458 Merge pull request #221 from actions/sgoedecke/add-copilot-provider
3f876c0 Don't include Copilot CLI stderr in error messages; mask token
8a3ac87 Bump README example to actions/setup-node@v6 to match repo workflows
02820f7 Pass -s to Copilot CLI and document deny-by-default permissions
479b2ef Add 'copilot' provider that shells out to GitHub Copilot CLI
Additional commits viewable in compare view

Updates github/codeql-action from 4.35.2 to 4.36.2

Release notes

Sourced from github/codeql-action's releases.

v4.36.2

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

v4.36.0

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

v4.35.5

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

v4.35.4

Update default CodeQL bundle version to 2.25.4. #3881

v4.35.3

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits

8aad20d Merge pull request #3949 from github/update-v4.36.2-dcb947ce1
f521b08 Add additional changelog notes
8aeff0f Update changelog for v4.36.2
dcb947c Merge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6
c251bce Add changelog note
62953c1 Update default bundle to codeql-bundle-v2.25.6
423b570 Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...
c35d1b1 Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...
cb1a588 Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoff
ba47406 Merge pull request #3943 from github/henrymercer/cache-cli-version-info
Additional commits viewable in compare view

Updates dependabot/fetch-metadata from 3.0.0 to 3.1.0

Release notes

Sourced from dependabot/fetch-metadata's releases.

v3.1.0

What's Changed

Add permissions to all workflows by @truggeri in dependabot/fetch-metadata#687

build(deps-dev): bump globals from 16.0.0 to 17.4.0 by @dependabot[bot] in dependabot/fetch-metadata#690

build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 by @dependabot[bot] in dependabot/fetch-metadata#693

build(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13 by @dependabot[bot] in dependabot/fetch-metadata#694

build(deps-dev): bump hono from 4.12.7 to 4.12.12 by @dependabot[bot] in dependabot/fetch-metadata#695

Dynamically update the tracking tag in action by @truggeri in dependabot/fetch-metadata#696

fix: handle duplicate dependency names in parseMetadataLinks by @devantler in dependabot/fetch-metadata#700

fix: remove $ anchor from updateFragment regex to handle pip directory suffixes by @devantler in dependabot/fetch-metadata#698

Updates to README for permissions clarification by @truggeri in dependabot/fetch-metadata#697

fix: resolve update-type null for Python, Composer, and Terraform PRs by @vitorsdcs in dependabot/fetch-metadata#704

build(deps-dev): bump globals from 17.4.0 to 17.5.0 by @dependabot[bot] in dependabot/fetch-metadata#703

build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by @dependabot[bot] in dependabot/fetch-metadata#701

build(deps): bump @actions/github from 9.0.0 to 9.1.0 in the dependencies group across 1 directory by @dependabot[bot] in dependabot/fetch-metadata#702

build(deps-dev): bump hono from 4.12.12 to 4.12.14 by @dependabot[bot] in dependabot/fetch-metadata#705

v3.1.0 by @fetch-metadata-action-automation[bot] in dependabot/fetch-metadata#692

New Contributors

@devantler made their first contribution in dependabot/fetch-metadata#700

@vitorsdcs made their first contribution in dependabot/fetch-metadata#704

Full Changelog: dependabot/fetch-metadata@v3...v3.1.0

Commits

25dd0e3 v3.1.0 (#692)
e073f50 Merge pull request #705 from dependabot/dependabot/npm_and_yarn/hono-4.12.14
0670e16 build(deps-dev): bump hono from 4.12.12 to 4.12.14
7a7fe10 Merge pull request #702 from dependabot/dependabot/npm_and_yarn/dependencies-...
5168191 Updating dist build
23882e1 build(deps): bump @actions/github in the dependencies group
1072469 Merge pull request #701 from dependabot/dependabot/github_actions/actions/cre...
43f8a00 build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1
b4d904a Merge pull request #703 from dependabot/dependabot/npm_and_yarn/globals-17.5.0
c8046bb build(deps-dev): bump globals from 17.4.0 to 17.5.0
Additional commits viewable in compare view

Updates actions/labeler from 6.0.1 to 6.1.0

Release notes

Sourced from actions/labeler's releases.

v6.1.0

Enhancements

Add changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by @bluca in actions/labeler#923

Bug Fixes

Improve Labeler Action documentation and permission error handling by @chiranjib-swain in actions/labeler#897

Preserve manually added labels during workflow runs and refine label synchronization logic by @chiranjib-swain in actions/labeler#917

Dependency Updates

Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by @dependabot in actions/labeler#877

Upgrade minimatch from 10.0.1 to 10.2.3 by @dependabot in actions/labeler#926

Upgrade dependencies (@actions/core, @actions/github, js-yaml, minimatch, @typescript-eslint) by @Copilot in actions/labeler#934

New Contributors

@chiranjib-swain made their first contribution in actions/labeler#897

@bluca made their first contribution in actions/labeler#923

@Copilot made their first contribution in actions/labeler#934

Full Changelog: actions/labeler@v6...v6.1.0

Commits

f27b608 chore: upgrade dependencies (@actions/core, @actions/github, js-yaml, minimat...
c5dadc2 Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...
e52e4fb Bump minimatch from 10.0.1 to 10.2.3 (#926)
77a4082 Fix: Preserve manually added labels during workflow run and refine label sync...
25abb3c Improve Labeler Action Documentation and Error Handling for Permissions (#897)
395c8cf Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...
See full diff in compare view

Updates astral-sh/setup-uv from 8.1.0 to 8.2.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details. In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token. All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

fix: report unexpected cache save failures @eifinger (#896)

fix: report unexpected setup failures @eifinger (#895)

fix: add timeout to fetch to prevent silent hangs @eifinger-bot (#883)

Limit GitHub tokens to github.com download URLs @zsol (#878)

increase libuv-workaround timeout to 100ms @eifinger (#880)

🚀 Enhancements

Add quiet input to suppress info-level log output @eifinger (#898)

feat: add download-from-astral-mirror input @eifinger (#897)

🧰 Maintenance

docs: update dependabot rollup biome guidance @eifinger (#902)

chore: update known checksums for 0.11.18 @github-actions[bot] (#899)

chore: update known checksums for 0.11.17 @github-actions[bot] (#892)

chore: update known checksums for 0.11.16 @github-actions[bot] (#889)

chore: update known checksums for 0.11.15 @github-actions[bot] (#885)

chore: update known checksums for 0.11.14 @github-actions[bot] (#879)

chore: update known checksums for 0.11.13 @github-actions[bot] (#877)

... (truncated)

Commits

fac544c chore(deps): roll up dependabot updates (#903)
7390f77 docs: update dependabot rollup biome guidance (#902)
363c64a chore(deps): roll up dependabot updates (#901)
c4fcbaf chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#900)
8e642c5 chore: update known checksums for 0.11.18 (#899)
a92cb43 Add quiet input to suppress info-level log output (#898)
e07f2ac chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 (#842)
bc4034e chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 (#893)
df42d4f chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 (#891)
b9c8c4c feat: add download-from-astral-mirror input (#897)
Additional commits viewable in compare view

Updates ruby/setup-ruby from 1.302.0 to 1.310.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.310.0

What's Changed

Add ruby-4.0.5 by @ruby-builder-bot in ruby/setup-ruby#918

Full Changelog: ruby/setup-ruby@v1.309.0...v1.310.0

v1.309.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#917

Full Changelog: ruby/setup-ruby@v1.308.0...v1.309.0

v1.308.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#912

Full Changelog: ruby/setup-ruby@v1.307.0...v1.308.0

v1.307.0

What's Changed

Update README: fix outdated URLs and Ruby version examples by @fkmy in ruby/setup-ruby#910

Add ruby-4.0.4 by @ruby-builder-bot in ruby/setup-ruby#911

Full Changelog: ruby/setup-ruby@v1.306.0...v1.307.0

v1.306.0

What's Changed

Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1 by @ruby-builder-bot in ruby/setup-ruby#909

Full Changelog: ruby/setup-ruby@v1.305.0...v1.306.0

v1.305.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#908

Full Changelog: ruby/setup-ruby@v1.304.0...v1.305.0

v1.304.0

What's Changed

Add jruby-10.1.0.0 by @ruby-builder-bot in ruby/setup-ruby#906

Full Changelog: ruby/setup-ruby@v1.303.0...v1.304.0

... (truncated)

Commits

afeafc3 Add ruby-4.0.5
28c65f7 Update CRuby releases on Windows
97ecb7b Update CRuby releases on Windows
6aaa311 Add ruby-4.0.4
f02c009 Fix docs.github.com URLs to avoid 301 redirects
98bfeb1 Remove EOL Ruby versions from matrix example in README
59a7680 Update Ruby version examples in README to include 4.0
6459287 Replace outdated help.github.com URLs with docs.github.com
c4e5b13 Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1
0cb964f Update CRuby releases on Windows
Additional commits viewable in compare view

Updates rubygems/configure-rubygems-credentials from 1.0.0 to 2.0.0

Release notes

Sourced from rubygems/configure-rubygems-credentials's releases.

v2.0.0

What's Changed

Remove oidc test env by @segiddins in rubygems/configure-rubygems-credentials#219

npm audit fix by @segiddins in rubygems/configure-rubygems-credentials#229

npm audit fix by @segiddins in rubygems/configure-rubygems-credentials#248

update yaml & zod by @segiddins in rubygems/configure-rubygems-credentials#249

Remove (inaccurate) CODEOWNERS file by @landongrindheim in rubygems/configure-rubygems-credentials#299

Teach Dependabot to run weekly by @landongrindheim in rubygems/configure-rubygems-credentials#300

Set up github actions linting by @segiddins in rubygems/configure-rubygems-credentials#303

🛠️ Build Dependabot updates by @landongrindheim in rubygems/configure-rubygems-credentials#298

Ensure we're not in a detached state when committing by @landongrindheim in rubygems/configure-rubygems-credentials#304

Set the remote url (in memory) if a push is needed by @landongrindheim in rubygems/configure-rubygems-credentials#305

Use pin hash and latest versions by @hsbt in rubygems/configure-rubygems-credentials#348

Fixed assertion message from rubygems.org by @hsbt in rubygems/configure-rubygems-credentials#353

Bump @actions/core from 1.11.1 to 2.0.3 by @hsbt in rubygems/configure-rubygems-credentials#380

Improve documentation for role-to-assume by @hsbt in rubygems/configure-rubygems-credentials#381

New Contributors

@landongrindheim made their first contribution in rubygems/configure-rubygems-credentials#299

@hsbt made their first contribution in rubygems/configure-rubygems-credentials#348

Full Changelog: rubygems/configure-rubygems-credentials@v1.0.0...v2.0.0

Commits

762a4b7 Exclude dependabot updates from release note
720fbb1 Merge pull request #401 from rubygems/dependabot/npm_and_yarn/types/node-25.6.0
7609dc5 Merge pull request #400 from rubygems/dependabot/npm_and_yarn/typescript-esli...
97eb064 Bump @types/node from 22.9.1 to 25.6.0
3561a05 Bump @typescript-eslint/parser from 8.58.2 to 8.59.1
cb08873 Merge pull request #394 from rubygems/dependabot/github_actions/zizmorcore/zi...
aa6ce95 Merge pull request #395 from rubygems/dependabot/github_actions/github/codeql...
83bda94 Merge pull request #396 from rubygems/dependabot/npm_and_yarn/eslint-plugin-j...
a44a37c Merge pull request #397 from rubygems/dependabot/github_actions/actions/setup...
c99d6f3 Bump actions/setup-node from 6.3.0 to 6.4.0
Additional commits viewable in compare view

Updates actions/setup-node from 6.3.0 to 6.4.0

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in actions/setup-node#1525

Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in actions/setup-node#1533

New Contributors

@Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

Commits

Bumps the actions group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` | | [actions/ai-inference](https://github.com/actions/ai-inference) | `2.0.7` | `2.1.1` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.2` | `4.36.2` | | [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `3.0.0` | `3.1.0` | | [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.1.0` | `8.2.0` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.302.0` | `1.310.0` | | [rubygems/configure-rubygems-credentials](https://github.com/rubygems/configure-rubygems-credentials) | `1.0.0` | `2.0.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `6.4.0` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.35.0` | `0.36.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.3` | `0.5.6` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.2.1` | Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) Updates `actions/ai-inference` from 2.0.7 to 2.1.1 - [Release notes](https://github.com/actions/ai-inference/releases) - [Commits](actions/ai-inference@e09e659...a780588) Updates `github/codeql-action` from 4.35.2 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...8aad20d) Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3) Updates `actions/labeler` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@634933e...f27b608) Updates `astral-sh/setup-uv` from 8.1.0 to 8.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) Updates `ruby/setup-ruby` from 1.302.0 to 1.310.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@7372622...afeafc3) Updates `rubygems/configure-rubygems-credentials` from 1.0.0 to 2.0.0 - [Release notes](https://github.com/rubygems/configure-rubygems-credentials/releases) - [Commits](rubygems/configure-rubygems-credentials@bc6dd21...762a4b7) Updates `actions/setup-node` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@53b8394...48b55a0) Updates `aquasecurity/trivy-action` from 0.35.0 to 0.36.0 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@57a97c7...ed142fd) Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@2031cfc...a1d282b) Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@b1d7e1f...5f14fd0) Updates `golangci/golangci-lint-action` from 9.2.0 to 9.2.1 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@1e7e51e...82606bf) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/ai-inference dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: dependabot/fetch-metadata dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/labeler dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: ruby/setup-ruby dependency-version: 1.310.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: rubygems/configure-rubygems-credentials dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: aquasecurity/trivy-action dependency-version: 0.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/dependency-review-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: golangci/golangci-lint-action dependency-version: 9.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

github-actions · 2026-06-15T11:13:54Z

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

.github/workflows/ai-labeler.yml
.github/workflows/codeql.yml
.github/workflows/dependabot-auto-merge.yml
.github/workflows/labeler.yml
.github/workflows/release-github.yml
.github/workflows/release-go.yml
.github/workflows/release-kotlin.yml
.github/workflows/release-python.yml
.github/workflows/release-ruby.yml
.github/workflows/release-swift.yml
.github/workflows/release-typescript.yml
.github/workflows/scorecard.yml
.github/workflows/security.yml
.github/workflows/smithy-verify.yml
.github/workflows/test.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

dependabot Bot added dependencies Pull requests that update a dependency file github-actions Pull requests that update GitHub Actions labels Jun 15, 2026

Copilot AI review requested due to automatic review settings June 15, 2026 11:13

Copilot AI reviewed Jun 15, 2026

github-actions Bot removed the dependencies Pull requests that update a dependency file label Jun 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps(actions): bump the actions group across 1 directory with 13 updates#339

deps(actions): bump the actions group across 1 directory with 13 updates#339
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-0521c12761

dependabot Bot commented on behalf of github Jun 15, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jun 15, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.3

What's Changed

New Contributors

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v2.1.1

What's Changed

New Contributors

v2.1.0

What's Changed

v2.0.8

What's Changed

New Contributors

v4.36.2

v4.36.1

v4.36.0

v4.35.5

v4.35.4

v4.35.3

CodeQL Action Changelog

[UNRELEASED]

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

v3.1.0

What's Changed

New Contributors

v6.1.0

Enhancements

Bug Fixes

Dependency Updates

New Contributors

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

New inputs

quiet

download-from-astral-mirror

Bugfixes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

v1.310.0

What's Changed

v1.309.0

What's Changed

v1.308.0

What's Changed

v1.307.0

What's Changed

v1.306.0

What's Changed

v1.305.0

What's Changed

v1.304.0

What's Changed

v2.0.0

What's Changed

New Contributors

v6.4.0

What's Changed

Dependency updates:

New Contributors

dependabot Bot commented on behalf of github Jun 15, 2026 •

edited by cubic-dev-ai Bot

Loading

v8.2.0 🌈 New inputs `quiet` and `download-from-astral-mirror`