Skip to content

ci: bump the actions group with 10 updates - #112

Merged
rmuir merged 1 commit into
mainfrom
dependabot/github_actions/actions-2a45c73754
Jul 27, 2026
Merged

ci: bump the actions group with 10 updates#112
rmuir merged 1 commit into
mainfrom
dependabot/github_actions/actions-2a45c73754

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 10 updates:

Package From To
actions/checkout 7.0.0 7.0.1
astral-sh/setup-uv 8.1.0 8.3.2
github/codeql-action/upload-sarif 4.36.0 4.37.1
actions/setup-node 6.4.0 7.0.0
tree-sitter/setup-action/cli eeb902ac2f1be576edc296309872cf476a209b7f 1868a545ffb91bdc221d14a168b5b6d8de4a28b3
rvben/rumdl 0.2.2 0.2.37
tree-sitter/workflows/.github/workflows/release.yml cc03699ad21049475b5762cd1c38a35146691e85 10c66d66e558b37df92e2a8ec5321218a6547b04
tree-sitter/workflows/.github/workflows/package-crates.yml cc03699ad21049475b5762cd1c38a35146691e85 10c66d66e558b37df92e2a8ec5321218a6547b04
tree-sitter/workflows/.github/workflows/package-pypi.yml 216133f5cb4469b112c5e83415869e58b25c353a 10c66d66e558b37df92e2a8ec5321218a6547b04
tree-sitter/workflows/.github/workflows/package-npm.yml cc03699ad21049475b5762cd1c38a35146691e85 10c66d66e558b37df92e2a8ec5321218a6547b04

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates astral-sh/setup-uv from 8.1.0 to 8.3.2

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details. In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token. All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

... (truncated)

Commits
  • 11f9893 chore: roll up Dependabot updates (#948)
  • f798556 docs: update version references to v8.3.1 (#946)
  • e80544d chore: update known checksums for 0.11.28 (#947)
  • f98e069 Change update-docs PR labels from 'update-docs' to 'documentation' (#945)
  • cd46263 chore: update known checksums for 0.11.27 (#944)
  • 11245c7 docs: update version references to v8.3.0 (#939)
  • d31148d Strip environment markers from detected uv dependency pins (#938)
  • 17c3989 Fix cache keys for Python version ranges (#937)
  • 3cc3c11 chore(deps): roll up Dependabot updates (#936)
  • 9225f84 chore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0 (#924)
  • Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.36.0 to 4.37.1

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.1

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits
  • 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
  • c8b5f69 Update changelog for v4.37.1
  • 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
  • 3492b7e Change REMOTE_PATH_PREFIX to remote=
  • 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
  • 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
  • 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
  • 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
  • e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
  • 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
  • Additional commits viewable in compare view

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates tree-sitter/setup-action/cli from eeb902ac2f1be576edc296309872cf476a209b7f to 1868a545ffb91bdc221d14a168b5b6d8de4a28b3

Commits

Updates rvben/rumdl from 0.2.2 to 0.2.37

Release notes

Sourced from rvben/rumdl's releases.

v0.2.37

Added

  • reflow: add atomic_spans configuration and refactor inline wrapping (#742) (aeabec1)

Changed

  • BREAKING: the MD013 emphasis-spans option is renamed to atomic-spans (default true), with inverted meaning (emphasis-spans = true is now atomic-spans = false). Configs setting the old key should migrate; it is no longer recognized

Fixed

  • reflow: keep code spans atomic when wrapping would collapse whitespace (d43618b)

Downloads

File Platform Checksum
rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz Linux x86_64 checksum
rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz Linux x86_64 (musl) checksum
rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz Linux ARM64 checksum
rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz Linux ARM64 (musl) checksum
rumdl-v0.2.37-x86_64-apple-darwin.tar.gz macOS x86_64 checksum
rumdl-v0.2.37-aarch64-apple-darwin.tar.gz macOS ARM64 (Apple Silicon) checksum
rumdl-v0.2.37-x86_64-pc-windows-msvc.zip Windows x86_64 checksum

Installation

Using uv (Recommended)

uv tool install rumdl

Using pip

pip install rumdl

Using pipx

pipx install rumdl

Direct Download

Download the appropriate binary for your platform from the table above, extract it, and add it to your PATH.

v0.2.36

Added

... (truncated)

Changelog

Sourced from rvben/rumdl's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

... (truncated)

Commits
  • 50035a4 chore: bump version to v0.2.37
  • ae77f9c ci(code-block-tools): bump djlint pin to 1.40.10
  • d43618b fix(reflow): keep code spans atomic when wrapping would collapse whitespace
  • aeabec1 feat(reflow): add atomic_spans configuration and refactor inline wrapping (#742)
  • 4eb740b ci(code-block-tools): pin external formatter tool versions
  • ed9da9e chore: bump version to v0.2.36
  • 4178cdf fix(wasm): stop double-converting already-character-based columns
  • f1ea27c style: clear cargo clippy --all-features (make lint-all) findings
  • 5b23261 feat(code-block-tools): add shuck:format as a built-in shell formatter
  • 38f36cf fix(tests): resolve String addition compilation errors under Rust 1.96 (#737)
  • Additional commits viewable in compare view

Updates tree-sitter/workflows/.github/workflows/release.yml from cc03699ad21049475b5762cd1c38a35146691e85 to 10c66d66e558b37df92e2a8ec5321218a6547b04

Commits
  • 10c66d6 ci: bump the actions group across 1 directory with 2 updates
  • See full diff in compare view

Updates tree-sitter/workflows/.github/workflows/package-crates.yml from cc03699ad21049475b5762cd1c38a35146691e85 to 10c66d66e558b37df92e2a8ec5321218a6547b04

Commits
  • 10c66d6 ci: bump the actions group across 1 directory with 2 updates
  • See full diff in compare view

Updates tree-sitter/workflows/.github/workflows/package-pypi.yml from 216133f5cb4469b112c5e83415869e58b25c353a to 10c66d66e558b37df92e2a8ec5321218a6547b04

Commits
  • 10c66d6 ci: bump the actions group across 1 directory with 2 updates
  • cc03699 docs: update action versions in readme
  • c0a88aa chore: add license file
  • 60bd84d ci: bump the actions group across 1 directory with 3 updates
  • c998ead ci(package-npm): use windows-2022 runner image
  • See full diff in compare view

Updates tree-sitter/workflows/.github/workflows/package-npm.yml from cc03699ad21049475b5762cd1c38a35146691e85 to 10c66d66e558b37df92e2a8ec5321218a6547b04

Commits
  • 10c66d6 ci: bump the actions group across 1 directory with 2 updates
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci: bump the actions group with 10 updates
0fdd003 
Bumps the actions group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.1.0` | `8.3.2` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.0` | `4.37.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` |
| [tree-sitter/setup-action/cli](https://github.com/tree-sitter/setup-action) | `eeb902ac2f1be576edc296309872cf476a209b7f` | `1868a545ffb91bdc221d14a168b5b6d8de4a28b3` |
| [rvben/rumdl](https://github.com/rvben/rumdl) | `0.2.2` | `0.2.37` |
| [tree-sitter/workflows/.github/workflows/release.yml](https://github.com/tree-sitter/workflows) | `cc03699ad21049475b5762cd1c38a35146691e85` | `10c66d66e558b37df92e2a8ec5321218a6547b04` |
| [tree-sitter/workflows/.github/workflows/package-crates.yml](https://github.com/tree-sitter/workflows) | `cc03699ad21049475b5762cd1c38a35146691e85` | `10c66d66e558b37df92e2a8ec5321218a6547b04` |
| [tree-sitter/workflows/.github/workflows/package-pypi.yml](https://github.com/tree-sitter/workflows) | `216133f5cb4469b112c5e83415869e58b25c353a` | `10c66d66e558b37df92e2a8ec5321218a6547b04` |
| [tree-sitter/workflows/.github/workflows/package-npm.yml](https://github.com/tree-sitter/workflows) | `cc03699ad21049475b5762cd1c38a35146691e85` | `10c66d66e558b37df92e2a8ec5321218a6547b04` |


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `astral-sh/setup-uv` from 8.1.0 to 8.3.2
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...11f9893)

Updates `github/codeql-action/upload-sarif` from 4.36.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@7211b7c...7188fc3)

Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@48b55a0...8207627)

Updates `tree-sitter/setup-action/cli` from eeb902ac2f1be576edc296309872cf476a209b7f to 1868a545ffb91bdc221d14a168b5b6d8de4a28b3
- [Release notes](https://github.com/tree-sitter/setup-action/releases)
- [Commits](tree-sitter/setup-action@eeb902a...1868a54)

Updates `rvben/rumdl` from 0.2.2 to 0.2.37
- [Release notes](https://github.com/rvben/rumdl/releases)
- [Changelog](https://github.com/rvben/rumdl/blob/main/CHANGELOG.md)
- [Commits](rvben/rumdl@4b60991...50035a4)

Updates `tree-sitter/workflows/.github/workflows/release.yml` from cc03699ad21049475b5762cd1c38a35146691e85 to 10c66d66e558b37df92e2a8ec5321218a6547b04
- [Commits](tree-sitter/workflows@cc03699...10c66d6)

Updates `tree-sitter/workflows/.github/workflows/package-crates.yml` from cc03699ad21049475b5762cd1c38a35146691e85 to 10c66d66e558b37df92e2a8ec5321218a6547b04
- [Commits](tree-sitter/workflows@cc03699...10c66d6)

Updates `tree-sitter/workflows/.github/workflows/package-pypi.yml` from 216133f5cb4469b112c5e83415869e58b25c353a to 10c66d66e558b37df92e2a8ec5321218a6547b04
- [Commits](tree-sitter/workflows@216133f...10c66d6)

Updates `tree-sitter/workflows/.github/workflows/package-npm.yml` from cc03699ad21049475b5762cd1c38a35146691e85 to 10c66d66e558b37df92e2a8ec5321218a6547b04
- [Commits](tree-sitter/workflows@cc03699...10c66d6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: tree-sitter/setup-action/cli
  dependency-version: 1868a545ffb91bdc221d14a168b5b6d8de4a28b3
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: rvben/rumdl
  dependency-version: 0.2.37
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: tree-sitter/workflows/.github/workflows/release.yml
  dependency-version: 10c66d66e558b37df92e2a8ec5321218a6547b04
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: tree-sitter/workflows/.github/workflows/package-crates.yml
  dependency-version: 10c66d66e558b37df92e2a8ec5321218a6547b04
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: tree-sitter/workflows/.github/workflows/package-pypi.yml
  dependency-version: 10c66d66e558b37df92e2a8ec5321218a6547b04
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: tree-sitter/workflows/.github/workflows/package-npm.yml
  dependency-version: 10c66d66e558b37df92e2a8ec5321218a6547b04
  dependency-type: direct:production
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates label Jul 27, 2026
@rmuir
rmuir merged commit 7229d3e into main Jul 27, 2026
11 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-2a45c73754 branch July 27, 2026 05:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rmuir