build(deps): bump the actions-production-dependencies group across 1 directory with 5 updates #40

dependabot · 2025-06-02T05:02:25Z

Bumps the actions-production-dependencies group with 5 updates in the / directory:

Package	From	To
docker/build-push-action	`6.15.0`	`6.18.0`
fossas/fossa-action	`1.5.0`	`1.7.0`
gradle/actions	`4.3.0`	`4.4.0`
ossf/scorecard-action	`2.4.1`	`2.4.2`
github/codeql-action	`3.28.12`	`3.28.18`

Updates docker/build-push-action from 6.15.0 to 6.18.0

Release notes

Sourced from docker/build-push-action's releases.

v6.18.0

Bump @docker/actions-toolkit from 0.61.0 to 0.62.1 in docker/build-push-action#1381

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

v6.17.0

Bump @docker/actions-toolkit from 0.59.0 to 0.61.0 by @crazy-max in docker/build-push-action#1364

[!NOTE] Build record is now exported using the buildx history export command instead of the legacy export-build tool.

Full Changelog: docker/build-push-action@v6.16.0...v6.17.0

v6.16.0

Handle no default attestations env var by @crazy-max in docker/build-push-action#1343

Only print secret keys in build summary output by @crazy-max in docker/build-push-action#1353

Bump @docker/actions-toolkit from 0.56.0 to 0.59.0 in docker/build-push-action#1352

Full Changelog: docker/build-push-action@v6.15.0...v6.16.0

Commits

2634353 Merge pull request #1381 from docker/dependabot/npm_and_yarn/docker/actions-t...
c0432d2 chore: update generated content
0bb1f27 set builder driver and endpoint attributes for dbc summary support
5f9dbf9 chore(deps): Bump @docker/actions-toolkit from 0.61.0 to 0.62.1
0788c44 Merge pull request #1375 from crazy-max/remove-gcr
aa179ca e2e: remove GCR
1dc7386 Merge pull request #1364 from crazy-max/history-export-cmd
9c9803f chore: update generated content
db1f6c4 DOCKER_BUILD_EXPORT_LEGACY env var to opt-in for legacy export
721e8c7 Bump @docker/actions-toolkit from 0.59.0 to 0.61.0
Additional commits viewable in compare view

Updates fossas/fossa-action from 1.5.0 to 1.7.0

Release notes

Sourced from fossas/fossa-action's releases.

v1.7.0

What's Changed

Adds an optional working directory option to change where FOSSA analyzes.

v1.6.0

What's Changed

Upgrade node to v20 by @jssblck in fossas/fossa-action#60

Update dependencies, enable auto dependabot by @jssblck in fossas/fossa-action#61

Full Changelog: fossas/fossa-action@v1.5.0...v1.6.0

Commits

3ebcea1 Working directory (#115)
80c50d8 Bump @typescript-eslint/parser from 8.31.1 to 8.32.1 (#112)
267a0da Bump @types/node from 22.15.16 to 22.15.18 (#114)
7e171c7 Bump eslint-plugin-n from 17.17.0 to 17.18.0 (#111)
d143aec Bump globals from 16.0.0 to 16.1.0 (#109)
4b26d27 Bump @types/node from 22.15.14 to 22.15.16 (#108)
2e0e33f Bump @eslint/compat from 1.2.8 to 1.2.9 (#100)
9c50c10 Bump @types/node from 22.15.3 to 22.15.14 (#107)
1e44083 Bump @typescript-eslint/eslint-plugin from 8.31.1 to 8.32.0 (#104)
4c5a7ae Bump eslint from 9.25.1 to 9.26.0 (#101)
Additional commits viewable in compare view

Updates gradle/actions from 4.3.0 to 4.4.0

Release notes

Sourced from gradle/actions's releases.

v4.4.0

This release updates 2 downstream components:

Develocity injection has been updated to v2.0

Some environment variables related to Develocity injection have been renamed. All vars now being with DEVELOCITY_INJECTION_. Check the docs for more details.

Dependency-graph plugin has been updated to v1.4.0

The 'detector' values included in the generated graph can now be configured via environment variables.

What's Changed

Update develocity-injection init script to v1.3 by @bot-githubaction in gradle/actions#592

Update develocity-injection init script to v2.0 by @bot-githubaction in gradle/actions#593

[StepSecurity] ci: Harden GitHub Actions by @step-security-bot in gradle/actions#597

Use v1.4.0 of dependency graph plugin by @bigdaz in gradle/actions#638

New Contributors

@step-security-bot made their first contribution in gradle/actions#597

Full Changelog: gradle/actions@v4.3.1...v4.4.0

v4.3.1

This release fixes a couple of minor issues, as well as keeping dependencies up to date.

Fixed issues

The develocity-allow-untrusted-server parameter should be honoured when fetching short-lived access tokens #583

Build summary may incorrectly report build success #415

What's Changed

Update develocity-injection init script to v1.1.1 by @bot-githubaction in gradle/actions#545

Bump the github-actions group across 2 directories with 3 updates by @dependabot in gradle/actions#547

Bump the npm-dependencies group in /sources with 2 updates by @dependabot in gradle/actions#548

Update develocity-injection init script to v1.2 by @bot-githubaction in gradle/actions#550

Bump the github-actions group across 1 directory with 2 updates by @dependabot in gradle/actions#552

Bump the npm-dependencies group across 1 directory with 5 updates by @dependabot in gradle/actions#558

Update known wrapper checksums by @github-actions in gradle/actions#560

Bump references to Develocity Gradle plugin from 3.19.1 to 3.19.2 by @bot-githubaction in gradle/actions#561

Catch more build failures in job summary by @bigdaz in gradle/actions#571

Scope captured build failures by @erichaagdev in gradle/actions#574

Ignore SSL certificate validation when fetching Develocity short-lived access token if develocity-allow-untrusted-server is enabled by @remcomokveld in gradle/actions#575

Dependency updates by @bigdaz in gradle/actions#579

Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre in /.github/workflow-samples/kotlin-dsl in the gradle group across 1 directory by @dependabot in gradle/actions#580

Bump the github-actions group across 2 directories with 2 updates by @dependabot in gradle/actions#582

New Contributors

@erichaagdev made their first contribution in gradle/actions#574

@remcomokveld made their first contribution in gradle/actions#575

Full Changelog: gradle/actions@v4.3.0...v4.3.1

Commits

8379f6a Use v1.4.0 of dependency graph plugin (#638)
9f79b5f [bot] Update dist directory
e093fac Bump the npm-dependencies group in /sources with 5 updates (#636)
768a17f Bump the npm-dependencies group in /sources with 2 updates (#635)
3654113 [bot] Update dist directory
2ad385c Replace use of typed-rest-client with @actions/http-client (#634)
95dcf96 [bot] Update dist directory
2e3238a Bump actions/download-artifact from 4.2.1 to 4.3.0 in /.github/actions/init-i...
39dddb8 Remove direct use of octokit/request-error (#632)
755ed7d [bot] Update dist directory
Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.4.1 to 2.4.2

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.2

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: ossf/scorecard-action@v2.4.1...v2.4.2

Commits

05b42c6 🌱 bump docker to ghcr v2.4.2 (#1548)
b225da6 Bump github.com/ossf/scorecard/v5 from v5.2.0 to v5.2.1 (#1550)
9399f6f 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
e1daa8c 🌱 Bump the github-actions group across 1 directory with 5 updates (#...
9fe6511 🌱 Bump golang.org/x/net from 0.39.0 to 0.40.0 (#1542)
25b9cd9 🌱 Bump github.com/ossf/scorecard/v5 from v5.1.1 to v5.2.0 (#1547)
18cc9b8 🌱 Bump golang.org/x/net from 0.38.0 to 0.39.0 (#1536)
db78142 🌱 Bump the github-actions group with 2 updates (#1538)
de386ed 🌱 Bump golang from 1.24.1 to 1.24.2 in the docker-images group (#1534)
5b7cedb 🌱 Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 (#1537)
Additional commits viewable in compare view

Updates github/codeql-action from 3.28.12 to 3.28.18

Release notes

Sourced from github/codeql-action's releases.

v3.28.18

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.18 - 16 May 2025

Update default CodeQL bundle version to 2.21.3. #2893

Skip validating SARIF produced by CodeQL for improved performance. #2894

The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

See the full CHANGELOG.md for more information.

v3.28.17

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.17 - 02 May 2025

Update default CodeQL bundle version to 2.21.2. #2872

See the full CHANGELOG.md for more information.

v3.28.16

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.16 - 23 Apr 2025

Update default CodeQL bundle version to 2.21.1. #2863

See the full CHANGELOG.md for more information.

v3.28.15

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.15 - 07 Apr 2025

Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842

See the full CHANGELOG.md for more information.

v3.28.14

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.

3.28.18 - 16 May 2025

Update default CodeQL bundle version to 2.21.3. #2893

Skip validating SARIF produced by CodeQL for improved performance. #2894

The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

3.28.17 - 02 May 2025

Update default CodeQL bundle version to 2.21.2. #2872

3.28.16 - 23 Apr 2025

Update default CodeQL bundle version to 2.21.1. #2863

3.28.15 - 07 Apr 2025

Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842

3.28.14 - 07 Apr 2025

Update default CodeQL bundle version to 2.21.0. #2838

3.28.13 - 24 Mar 2025

No user facing changes.

3.28.12 - 19 Mar 2025

Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.

Update default CodeQL bundle version to 2.20.7. #2810

3.28.11 - 07 Mar 2025

Update default CodeQL bundle version to 2.20.6. #2793

3.28.10 - 21 Feb 2025

Update default CodeQL bundle version to 2.20.5. #2772

Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

... (truncated)

Commits

ff0a06e Merge pull request #2896 from github/update-v3.28.18-b86edfc27
a41e084 Update changelog for v3.28.18
b86edfc Merge pull request #2893 from github/update-bundle/codeql-bundle-v2.21.3
e93b900 Merge branch 'main' into update-bundle/codeql-bundle-v2.21.3
510dfa3 Merge pull request #2894 from github/henrymercer/skip-validating-codeql-sarif
492d783 Merge branch 'main' into henrymercer/skip-validating-codeql-sarif
83bdf3b Merge pull request #2859 from github/update-supported-enterprise-server-versions
cffc916 Merge pull request #2891 from austinpray-mixpanel/patch-1
4420887 Add deprecation warning for CodeQL 2.16.5 and earlier
4e178c5 Update supported versions table in README
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…directory with 5 updates Bumps the actions-production-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.15.0` | `6.18.0` | | [fossas/fossa-action](https://github.com/fossas/fossa-action) | `1.5.0` | `1.7.0` | | [gradle/actions](https://github.com/gradle/actions) | `4.3.0` | `4.4.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.28.12` | `3.28.18` | Updates `docker/build-push-action` from 6.15.0 to 6.18.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v6.15.0...v6.18.0) Updates `fossas/fossa-action` from 1.5.0 to 1.7.0 - [Release notes](https://github.com/fossas/fossa-action/releases) - [Commits](fossas/fossa-action@93a52ec...3ebcea1) Updates `gradle/actions` from 4.3.0 to 4.4.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@v4.3.0...v4.4.0) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.2 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...05b42c6) Updates `github/codeql-action` from 3.28.12 to 3.28.18 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5f8171a...ff0a06e) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 6.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-production-dependencies - dependency-name: fossas/fossa-action dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-production-dependencies - dependency-name: gradle/actions dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-production-dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-production-dependencies - dependency-name: github/codeql-action dependency-version: 3.28.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-production-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2025-08-12T05:05:29Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 2, 2025

dependabot bot force-pushed the dependabot/github_actions/actions-production-dependencies-6a2507bed4 branch from fb1a728 to 6f49a72 Compare August 8, 2025 04:35

dependabot bot closed this Aug 12, 2025

dependabot bot deleted the dependabot/github_actions/actions-production-dependencies-6a2507bed4 branch August 12, 2025 05:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the actions-production-dependencies group across 1 directory with 5 updates #40

build(deps): bump the actions-production-dependencies group across 1 directory with 5 updates #40

Uh oh!

dependabot bot commented on behalf of github Jun 2, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Aug 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

build(deps): bump the actions-production-dependencies group across 1 directory with 5 updates #40

build(deps): bump the actions-production-dependencies group across 1 directory with 5 updates #40

Uh oh!

Conversation

dependabot bot commented on behalf of github Jun 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.18.0

v6.17.0

v6.16.0

v1.7.0

What's Changed

v1.6.0

What's Changed

v4.4.0

What's Changed

New Contributors

v4.3.1

Fixed issues

What's Changed

New Contributors

v2.4.2

What's Changed

v3.28.18

CodeQL Action Changelog

3.28.18 - 16 May 2025

v3.28.17

CodeQL Action Changelog

3.28.17 - 02 May 2025

v3.28.16

CodeQL Action Changelog

3.28.16 - 23 Apr 2025

v3.28.15

CodeQL Action Changelog

3.28.15 - 07 Apr 2025

v3.28.14

CodeQL Action Changelog

CodeQL Action Changelog

[UNRELEASED]

3.28.18 - 16 May 2025

3.28.17 - 02 May 2025

3.28.16 - 23 Apr 2025

3.28.15 - 07 Apr 2025

3.28.14 - 07 Apr 2025

3.28.13 - 24 Mar 2025

3.28.12 - 19 Mar 2025

3.28.11 - 07 Mar 2025

3.28.10 - 21 Feb 2025

Uh oh!

dependabot bot commented on behalf of github Aug 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jun 2, 2025 •

edited

Loading