Bump the github-actions group with 6 updates by dependabot[bot] · Pull Request #1337 · Open-CMSIS-Pack/vscode-cmsis-debugger

dependabot · 2026-11-01T02:14:24Z

Bumps the github-actions group with 6 updates:

Package	From	To
step-security/harden-runner	`2.21.1`	`2.22.3`
actions/setup-node	`7.0.0`	`7.1.0`
actions/upload-artifact	`7.0.1`	`7.0.2`
qltysh/qlty-action/coverage	`2.4.0`	`2.5.0`
actions/download-artifact	`8.0.1`	`8.0.2`
ossf/scorecard-action	`2.4.4`	`2.5.0`

Updates step-security/harden-runner from 2.21.1 to 2.22.3

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.3

What's Changed

Added support for Avrea-hosted runners (enterprise tier)

Fixed unexpected blocking of allowed connections caused by GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners

Added a feature flag to disable implicit AWS endpoint allowances on self-hosted Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.2...v2.22.3

v2.22.2

What's Changed

Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS

Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)

Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

v2.22.1

What's Changed

Fixed security rules not initializing on GHES self-hosted runners

Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

What's Changed

Linux ARM64 support for community tier

GHES support for self-hosted VMs (enterprise tier)

MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

Commits

46b06ce Merge pull request #711 from step-security/rc-46
f82eb4b Merge pull request #710 from h0x0er/jatin/tp-avrea
665b85a update agent-self-hosted, agent-bravo to v1.9.5 and agent to v0.18.0
80fffe1 detect avrea runners
dc2769a Merge pull request #707 from step-security/rc-45
ab0b273 Merge pull request #706 from h0x0er/rc-45
03ccff8 Remove agent-preinstalled skip for third-party runners
815e48d Skip agent install and post-step cleanup when agent is already installed
ccd8616 Merge pull request #704 from h0x0er/jatin/ghes-endp
037ccfd implicitly add ghes endpoint in allowList
Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in actions/setup-node#1421

Support absolute paths in node-version-file by @v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in actions/setup-node#1578

docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in actions/setup-node#1593

Fixed cache recommendation syntax by @SubJunk in actions/setup-node#1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in actions/setup-node#1583

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-node#1584

Pin @types/node to v24 by @v-priyagupta108 in actions/setup-node#1585

Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in actions/setup-node#1599

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-node#1598

Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in actions/setup-node#1590

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-node#1610

Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in actions/setup-node#1602

Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in actions/setup-node#1629

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-node#1616

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-node#1615

Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in actions/setup-node#1631

Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in actions/setup-node#1636

Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in actions/setup-node#1638

Update dependencies and add license files by @v-HarithaVattikuti in actions/setup-node#1642

Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-node#1635

New Contributors

@v-jitenderpalsingh made their first contribution in actions/setup-node#1580

@philip-gai made their first contribution in actions/setup-node#1584

@gperdomor made their first contribution in actions/setup-node#1421

@SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits

949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
7207c4f chore: update dependencies and add license files (#1642)
54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
0c54c7b Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
a829419 Bump @types/semver from 7.7.1 to 7.8.0 (#1616)
680d1e4 Support absolute paths in node-version-file (#1633)
db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
c2acded chore: prepare v7.0.2 release
4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
8cbe1be Bump @actions/artifact to 6.3.1
See full diff in compare view

Updates qltysh/qlty-action/coverage from 2.4.0 to 2.5.0

Release notes

Sourced from qltysh/qlty-action/coverage's releases.

v2.5.0

Improved

The Qlty CLI must now pass its attestation check before it runs. If no attestation matches the downloaded CLI, or the check rejects it, the step fails, including in the coverage action with skip-errors: true. Pinning cli-version to a release older than 0.555.0, which have no attestation, now fails; remove cli-version or set a current release (#212)

When the attestation check cannot finish because GitHub or Sigstore is unavailable, the coverage action follows skip-errors: with skip-errors: true it logs the error and passes the step without running the CLI. The install and fmt actions fail (#216)

The attestation check needs GitHub CLI (gh) 2.67.0 or later. Without a usable gh, as on many self-hosted runners and container: jobs, the actions log a warning that the run is unverified and continue (#212)

The attestation lookup always goes to github.com, even when GH_HOST points at GitHub Enterprise; in that case set github-token to a github.com token (#212)

Changelog

Sourced from qltysh/qlty-action/coverage's changelog.

Changelog

v2.5.0 (2026-10-23)

Improved

The Qlty CLI must now pass its attestation check before it runs. If no attestation matches the downloaded CLI, or the check rejects it, the step fails, including in the coverage action with skip-errors: true. Pinning cli-version to a release older than 0.555.0, which have no attestation, now fails; remove cli-version or set a current release (#212)

When the attestation check cannot finish because GitHub or Sigstore is unavailable, the coverage action follows skip-errors: with skip-errors: true it logs the error and passes the step without running the CLI. The install and fmt actions fail (#216)

The attestation check needs GitHub CLI (gh) 2.67.0 or later. Without a usable gh, as on many self-hosted runners and container: jobs, the actions log a warning that the run is unverified and continue (#212)

The attestation lookup always goes to github.com, even when GH_HOST points at GitHub Enterprise; in that case set github-token to a github.com token (#212)

v2.4.0 (2026-09-24)

Fixed

Security updates to bundled dependencies (#207, #208, #209)

v2.3.0 (2026-07-09)

New

Add a selected input to the coverage action for marking an upload as covering a selected subset of the test suite, which contributes to diff coverage only and is excluded from total coverage (#200)

v2.2.3 (2026-07-07)

Internal release process improvements (no user-facing changes) (#196)

v2.2.2 (2026-07-07)

Fixed

Security updates to bundled dependencies (#190, #191)

v2.2.1 (2026-06-02)

Bump action runtime to node24

v2.2.0 (2025-08-11)

Testing release process (no changes)

v2.1.0 (2025-08-08)

New

support "dry-run" option for command complete

Improved

Use log level "error" instead of "warning" when a catastrophic error occurs but "skip-errors" is true

... (truncated)

Commits

ebcd284 Release v2.5.0 (#217)
e82937b Let skip-errors cover an attestation check that cannot finish (#216)
2ba2e43 Treat a missing attestation as a verification failure (#212)
85038b0 Track .qlty/.gitignore from qlty's current template (#214)
88daebc Bump Node to 24.22.1 to distrust compromised eMudhra intermediates (#213)
2d73d36 Publish releases from maintainer-pushed tags and drop the #cust-public webhoo...
See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

Update the readme by @danwkennedy in actions/download-artifact#473

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Update @actions/artifact to 6.3.1 by @tunc-d in actions/download-artifact#492

Prepare download-artifact v8.0.2 by @tunc-d in actions/download-artifact#493

New Contributors

@tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
e455989 Prepare download-artifact v8.0.2
a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
29bb7ce Update @actions/artifact to 6.3.1
484a0b5 Update the readme (#473)
See full diff in compare view

Updates ossf/scorecard-action from 2.4.4 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @justaugustus in ossf/scorecard-action#1716

The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @justaugustus in ossf/scorecard-action#1716

The Scorecard version in results now always matches the Scorecard release the action is built with. by @justaugustus in ossf/scorecard-action#1718

The action no longer prints the GitHub token variable while validating its options. by @arpitjain099 in ossf/scorecard-action#1709

results_format accepts intoto, which wraps the JSON results in an in-toto attestation statement. by @puerco in ossf/scorecard-action#1702

Other

Add a daily canary against Scorecard main by @justaugustus in ossf/scorecard-action#1711

Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @justaugustus in ossf/scorecard-action#1714

Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by @justaugustus in ossf/scorecard-action#1716

Bump Scorecard to v5.6.0 by @justaugustus in ossf/scorecard-action#1719

New Contributors

@arpitjain099 made their first contribution in ossf/scorecard-action#1709

@puerco made their first contribution in ossf/scorecard-action#1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits

fa7117d Bump action tag for v2.5.0 release (#1720)
cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
bedb16e ✨ Add intoto results format (#1702)
de70347 Remove the leftover debug print of the auth token (#1709)
950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
4e9f2a2 📖 RELEASE.md: Document drafting release notes
f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.21.1` | `2.22.3` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [qltysh/qlty-action/coverage](https://github.com/qltysh/qlty-action) | `2.4.0` | `2.5.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | Updates `step-security/harden-runner` from 2.21.1 to 2.22.3 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@e14015d...46b06ce) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) Updates `qltysh/qlty-action/coverage` from 2.4.0 to 2.5.0 - [Release notes](https://github.com/qltysh/qlty-action/releases) - [Changelog](https://github.com/qltysh/qlty-action/blob/main/CHANGELOG.md) - [Commits](qltysh/qlty-action@c9b0998...ebcd284) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@2d11466...fa7117d) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: qltysh/qlty-action/coverage dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

jreineckearm · 2026-11-02T12:21:06Z

Please do not merge. In the middle of a release.

jreineckearm · 2026-11-02T15:02:29Z

Release is out, good to merge

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 1, 2026

soumeh01 approved these changes Nov 2, 2026

View reviewed changes

jreineckearm added do not merge Do not merge yet. Something else needs to happen first and removed do not merge Do not merge yet. Something else needs to happen first labels Nov 2, 2026

jreineckearm merged commit 1ba3d58 into main Nov 2, 2026
17 checks passed

jreineckearm deleted the dependabot/github_actions/github-actions-4488a2f114 branch November 2, 2026 15:02

Navigation Menu

Repository navigation

Bump the github-actions group with 6 updates - #1337

Bump the github-actions group with 6 updates#1337
jreineckearm merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-4488a2f114

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

jreineckearm commented Nov 2, 2026

Uh oh!

jreineckearm commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Nov 1, 2026

v2.22.3

What's Changed

v2.22.2

What's Changed

v2.22.1

What's Changed

v2.22.0

What's Changed

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

v7.0.2

What's Changed

New Contributors

v2.5.0

Improved

Changelog

v2.5.0 (2026-10-23)

Improved

v2.4.0 (2026-09-24)

Fixed

v2.3.0 (2026-07-09)

New

v2.2.3 (2026-07-07)

v2.2.2 (2026-07-07)

Fixed

v2.2.1 (2026-06-02)

v2.2.0 (2025-08-11)

v2.1.0 (2025-08-08)

New

Improved

v8.0.2

What's Changed

New Contributors

v2.5.0

What's Changed

Other

New Contributors

Uh oh!

jreineckearm commented Nov 2, 2026

Uh oh!

jreineckearm commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants