Skip to content

build(deps): bump the github-actions group with 2 updates#129

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-2f0a8eb569
Closed

build(deps): bump the github-actions group with 2 updates#129
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-2f0a8eb569

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 20, 2026 •
edited
Loading

Bumps the github-actions group with 2 updates: github/codeql-action and pnpm/action-setup.

Updates github/codeql-action from 4.35.4 to 4.35.5

Release notes

Sourced from github/codeql-action's releases.

v4.35.5

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880
Commits
  • 9e0d7b8 Merge pull request #3905 from github/update-v4.35.5-d4b485515
  • 6d7d599 Add changelog entry for #3899
  • 51f7e38 Update changelog for v4.35.5
  • d4b4855 Merge pull request #3899 from github/mbg/esbuild/split
  • 127de81 Merge remote-tracking branch 'origin/main' into mbg/esbuild/split
  • 7fde13f Use src + basename in header to avoid issues on Windows
  • dfa61e7 Improve pattern matching and error handling
  • 52aafec Import and call runWrapper normally in analyze tests
  • 0d08c01 Auto-generate shared bundle
  • 14085a6 Auto-generate entry points
  • Additional commits viewable in compare view

Updates pnpm/action-setup from 4.1.0 to 6.0.8

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.8

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v6.0.7...v6.0.8

v6.0.7

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v6.0.6...v6.0.7

v6.0.6

What's Changed

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

v6.0.5

What's Changed

Full Changelog: pnpm/action-setup@v6.0.4...v6.0.5

v6.0.4

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v6.0.3...v6.0.4

v6.0.3

Updated pnpm to v11.0.0-rc.5

Full Changelog: pnpm/action-setup@v6.0.2...v6.0.3

... (truncated)

Commits
  • 0e279bb fix: update pnpm to 11.1.1 (#248)
  • 3e83581 fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)
  • 551b42e docs(README): fix cache_dependency_path type (#257)
  • 739bfe4 fix: self-update bootstrap to packageManager-pinned version (#233) (#256)
  • f61705d chore: add CODEOWNERS
  • 7a5507b fix: restore inputs from state in post (#255)
  • 1155470 fix: honor devEngines.packageManager.onFail=error (#252) (#254)
  • 91ab88e fix: bin_dest output points to self-updated pnpm, not bootstrap (#249)
  • e578e19 fix: update pnpm to 11.0.4
  • 8912a91 fix: append (not prepend) action node dir to PATH for npm bootstrap (#241)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the github-actions group with 2 updates
72ab140 
Bumps the github-actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [pnpm/action-setup](https://github.com/pnpm/action-setup).


Updates `github/codeql-action` from 4.35.4 to 4.35.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](github/codeql-action@v4.35.4...v4.35.5)

Updates `pnpm/action-setup` from 4.1.0 to 6.0.8
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@a7487c7...0e279bb)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 20, 2026
@dependabot dependabot Bot requested a review from theagenticguy as a code owner May 20, 2026 13:15
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 20, 2026
@theagenticguy theagenticguy mentioned this pull request May 28, 2026
Merged
6 tasks
@theagenticguy
Copy link
Copy Markdown
Owner

theagenticguy commented May 28, 2026

Superseded by #137 — consolidated into one merge with the rest of this week's bumps. Lockfile regenerated, full local gate (lint + typecheck + test + banned-strings) is green.

@theagenticguy theagenticguy deleted the dependabot/github_actions/github-actions-2f0a8eb569 branch May 28, 2026 16:43
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 28, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

theagenticguy added a commit that referenced this pull request May 28, 2026
@theagenticguy
build(deps): consolidate weekly Dependabot bumps (2026-05-28) (#137)
9e6ccb7 
## Summary

Consolidates the 11 open Dependabot PRs into a single merge to cut CI
churn. Lockfile regenerated and full local gate (`pnpm run check` — lint
+ typecheck + test + banned-strings) is green.

### npm bumps

| Package | From | To |
| --- | --- | --- |
| `@aws-sdk/client-bedrock-runtime` | 3.1045.0 | 3.1054.0 |
| `@aws-sdk/client-sagemaker-runtime` | 3.1045.0 | 3.1054.0 |
| `@duckdb/node-api` | 1.5.2-r.1 | 1.5.2-r.2 |
| `@types/node` (typescript-tooling group) | 25.7.0 | 25.9.1 |
| `astro` | 6.3.3 | 6.3.8 |
| `lefthook` | 2.1.6 | 2.1.8 |
| `lru-cache` | 11.3.6 | 11.5.0 |
| `tsx` | 4.21.0 | 4.22.3 |
| `web-tree-sitter` (tree-sitter group) | 0.26.8 | 0.26.9 |

### github-actions bumps (SHA-pinned)

| Action | From | To |
| --- | --- | --- |
| `github/codeql-action` | v4.35.4 (`68bde55…`) | v4.35.5 (`9e0d7b8…`) |
| `github/codeql-action` (release.yml, codeql-bundle) | `9887d98…` |
`f4d0a7a…` |
| `pnpm/action-setup` | v4.1.0 (`a7487c7…`) | v6.0.8 (`0e279bb…`) |

### Held back

- **license-checker-rseidelsohn 4.4.2 → 5.0.0** — v5 requires Node >= 24
but the repo's `engines.node` is `>=22.0.0` and CI's `node-version`
matrix runs both 22 and 24. Pick this up when the repo drops Node 22
support. PR #135 stays open as a tracking marker if the user prefers;
otherwise it should be closed with a comment.

## Closes

#123, #124, #125, #126, #127, #128, #129, #133, #134, #136

(also supersedes #135 modulo the Node 22 caveat above)

## Test plan

- [x] `pnpm install --no-frozen-lockfile` (lockfile regen clean)
- [x] `pnpm run lint` — biome clean across 670 files
- [x] `pnpm run typecheck` — clean across all 19 workspace projects
- [x] `pnpm run test` — 1959 tests, 0 failures across 16 packages
- [x] `pnpm run banned-strings` — PASS
- [ ] CI green on Node 22 + Node 24 matrix
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@theagenticguy theagenticguy Awaiting requested review from theagenticguy theagenticguy is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@theagenticguy