Skip to content

Bump the actions group in /.github/workflows with 5 updates#85

Merged
Zeitsperre merged 1 commit intomainfrom
dependabot/github_actions/dot-github/workflows/actions-1f66059e03
Mar 5, 2026
Merged

Bump the actions group in /.github/workflows with 5 updates#85
Zeitsperre merged 1 commit intomainfrom
dependabot/github_actions/dot-github/workflows/actions-1f66059e03

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 5, 2026

Bumps the actions group in /.github/workflows with 5 updates:

Package From To
step-security/harden-runner 2.8.1 2.15.0
actions/checkout 4.1.7 6.0.2
actions/github-script 7.0.1 8.0.0
actions/setup-python 5.1.0 6.2.0
lukka/get-cmake 3.29.6 4.2.3

Updates step-security/harden-runner from 2.8.1 to 2.15.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.15.0

What's Changed

Windows and macOS runner support

We are excited to announce that Harden Runner now supports Windows and macOS runners, extending runtime security beyond Linux for the first time.

Insights for Windows and macOS runners will be displayed in the same consistent format you are already familiar with from Linux runners, giving you a unified view of runtime activity across all platforms.

Full Changelog: step-security/harden-runner@v2.14.2...v2.15.0

v2.14.2

What's Changed

Security fix: Fixed a medium severity vulnerability where outbound network connections using sendto, sendmsg, and sendmmsg socket system calls could bypass audit logging when using egress-policy: audit. This issue only affects the Community Tier in audit mode; block mode and Enterprise Tier were not affected. See GHSA-cpmj-h4f6-r6pq for details.

Full Changelog: step-security/harden-runner@v2.14.1...v2.14.2

v2.14.1

What's Changed

  1. In some self-hosted environments, the agent could briefly fall back to public DNS resolvers during startup if the system DNS was not yet available. This behavior was unintended for GitHub-hosted runners and has now been fixed to prevent any use of public DNS resolvers.

  2. Fixed npm audit vulnerabilities

Full Changelog: step-security/harden-runner@v2.14.0...v2.14.1

v2.14.0

What's Changed

  • Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.
  • Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

What's Changed

  • Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

What's Changed

  • Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
  • Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

v2.13.1

... (truncated)

Commits
  • a90bcbc Update readme (#637)
  • f0a59d8 Release v2.15.0 (#639)
  • 5ef0c07 Merge pull request #635 from step-security/rc-34
  • eb43c7b update agent
  • e3f713f Merge pull request #631 from step-security/rc-31
  • 423acdd chore: fix npm audit vulnerabilities
  • 0ddb86c update agent
  • 20cf305 Merge pull request #622 from step-security/feature/custom-property-skip
  • c51e8ee feat: skip agent install and post step on subsequent runs for GitHub-hosted r...
  • e152b90 feat: skip harden-runner based on repository custom property
  • Additional commits viewable in compare view

Updates actions/checkout from 4.1.7 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits

Updates actions/github-script from 7.0.1 to 8.0.0

Release notes

Sourced from actions/github-script's releases.

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

New Contributors

Full Changelog: actions/github-script@v7...v7.1.0

Commits
  • ed59741 Merge pull request #653 from actions/sneha-krip/readme-for-v8
  • 2dc352e Bold minimum Actions Runner version in README
  • 01e118c Update README for Node 24 runtime requirements
  • 8b222ac Apply suggestion from @​salmanmkc
  • adc0eea README for updating actions/github-script from v7 to v8
  • 20fe497 Merge pull request #637 from actions/node24
  • e7b7f22 update licenses
  • 2c81ba0 Update Node.js version support to 24.x
  • f28e40c Merge pull request #610 from actions/nebuk89-patch-1
  • 1ae9958 Update README.md
  • Additional commits viewable in compare view

Updates actions/setup-python from 5.1.0 to 6.2.0

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

Full Changelog: actions/setup-python@v6...v6.2.0

v6.1.0

What's Changed

Enhancements:

Dependency and Documentation updates:

New Contributors

Full Changelog: actions/setup-python@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

... (truncated)

Commits
  • a309ff8 Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)
  • bfe8cc5 Upgrade @​actions dependencies to Node 24 compatible versions (#1259)
  • 4f41a90 Bump urllib3 from 2.5.0 to 2.6.0 in /tests/data (#1253)
  • 83679a8 Bump @​types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ...
  • bfc4944 Bump prettier from 3.5.3 to 3.6.2 (#1234)
  • 97aeb3e Bump requests from 2.32.2 to 2.32.4 in /tests/data (#1130)
  • 443da59 Bump actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pi...
  • cfd55ca graalpy: add graalpy early-access and windows builds (#880)
  • bba65e5 Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md (#1094)
  • 18566f8 Improve wording and "fix example" (remove 3.13) on testing against pre-releas...
  • Additional commits viewable in compare view

Updates lukka/get-cmake from 3.29.6 to 4.2.3

Release notes

Sourced from lukka/get-cmake's releases.

CMake v4.2.3

The get-cmake action downloads and caches CMake and Ninja on your workflows. Versions can be specified using semantic versioning ranges using cmakeVersion and ninjaVersion inputs.

Changes:

  • latest is now using CMake version v4.2.3, use this one-liner e.g.: uses: lukka/get-cmake@latest

Enjoy!

CMake v4.2.2

The get-cmake action downloads and caches CMake and Ninja on your workflows. Versions can be specified using semantic versioning ranges using cmakeVersion and ninjaVersion inputs.

Changes:

  • latest is now using CMake version v4.2.2, use this one-liner e.g.: uses: lukka/get-cmake@latest

Enjoy!

CMake v4.2.1

The get-cmake action downloads and caches CMake and Ninja on your workflows. Versions can be specified using semantic versioning ranges using cmakeVersion and ninjaVersion inputs.

Changes:

  • latest is now using CMake version v4.2.1, use this one-liner e.g.: uses: lukka/get-cmake@latest

Enjoy!

CMake v4.2.0

The get-cmake action downloads and caches CMake and Ninja on your workflows. Versions can be specified using semantic versioning ranges using cmakeVersion and ninjaVersion inputs.

Changes:

  • latest is now using CMake version v4.2.0, use this one-liner e.g.: uses: lukka/get-cmake@latest

Enjoy!

CMake v4.2.0-rc1

The get-cmake action downloads and caches CMake and Ninja on your workflows. Versions can be specified using semantic versioning ranges using cmakeVersion and ninjaVersion inputs.

Changes:

  • latestrc is now using CMake version v4.2.0-rc1, use:
  uses: lukka/get-cmake@latest
  with:
      cmakeVersion: latestrc

Enjoy!

CMake v4.1.2

... (truncated)

Changelog

Sourced from lukka/get-cmake's changelog.

Release Process for get-cmake

This document describes the release process for the get-cmake action after a new CMake or Ninja version has been merged to the main branch.

Overview

The get-cmake action uses two key reference points for users:

  1. latest branch - Points to the most recent stable release
  2. Version tags (e.g., vX.Y.Z) - Allow users to pin to specific versions

When a new CMake version is detected and merged to main via automated PR, a release is performed automatically (or can be done manually) to make it available to users.

Release Steps

Option 1: Automatic Release (Recommended)

The auto-release.yml workflow automatically handles releases when automated CMake version PRs are merged:

  1. When a PR with title matching [Automated] Adding cmake-vX.Y.Z is merged to main
  2. The workflow automatically:
    • Reads the version from .latest_cmake_version
    • Updates the latest branch to match main
    • Creates and pushes the version tag (if it doesn't exist)

No manual action needed - the release happens automatically!

Option 2: Manual Release (Override/Fallback)

If you need to manually trigger a release or override the automatic process:

  1. Go to the Actions tab in GitHub
  2. Select "Sync latest branch and create release tag" workflow
  3. Click "Run workflow"
  4. Enter the tag name (e.g., v4.2.3)
  5. Click "Run workflow" button

The workflow will:

  • Validate the tag name format
  • Update the latest branch to match main
  • Create and push the specified version tag

Option 3: Manual Command-Line Process (Advanced)

If you prefer to do this manually via command line:

# 1. Ensure you're on the main branch and up to date
git checkout main
git pull origin main
</tr></table>

... (truncated)

Commits
  • f176ccd Add automated release workflows for latest branch sync and version tagging (#...
  • e754285 New CMake version(s): cmake-v4.2.3 (#232)
  • 822400b Bump jws from 3.2.2 to 3.2.3 (#222)
  • 1bfad7b Bump lodash from 4.17.21 to 4.17.23 (#231)
  • dc05ee1 New CMake version(s): cmake-v4.2.2 (#229)
  • 9e07ecd New CMake version(s): cmake-v4.2.1 (#225)
  • acd62d2 set step outputs for cmake and ninja paths (#224)
  • 11c80fd Fix catalog for ninja. Automatic PRs where merged out of order accidentally. ...
  • bb2faa7 New CMake version(s): cmake-v4.2.0cmake-rc-v4.2.0-rc4 (#219)
  • c0308ec Bump actions/checkout from 4 to 5 (#203)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the actions group in /.github/workflows with 5 updates
4f6ad08 
Bumps the actions group in /.github/workflows with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.8.1` | `2.15.0` |
| [actions/checkout](https://github.com/actions/checkout) | `4.1.7` | `6.0.2` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `8.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.1.0` | `6.2.0` |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `3.29.6` | `4.2.3` |


Updates `step-security/harden-runner` from 2.8.1 to 2.15.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@v2.8.1...a90bcbc)

Updates `actions/checkout` from 4.1.7 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.1.7...de0fac2)

Updates `actions/github-script` from 7.0.1 to 8.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@60a0d83...ed59741)

Updates `actions/setup-python` from 5.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@82c7e63...a309ff8)

Updates `lukka/get-cmake` from 3.29.6 to 4.2.3
- [Release notes](https://github.com/lukka/get-cmake/releases)
- [Changelog](https://github.com/lukka/get-cmake/blob/main/RELEASE_PROCESS.md)
- [Commits](lukka/get-cmake@2bcb1a4...f176ccd)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: lukka/get-cmake
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 5, 2026
@github-actions
Copy link

github-actions bot commented Mar 5, 2026

Welcome, new contributor!

It appears that this is your first Pull Request. To give credit where it's due, we ask that you add your information to the AUTHORS.md and .zenodo.json:

  • The relevant author information has been added to AUTHORS.md and .zenodo.json

We also require that you sign our Contributor License Agreement before we can merge your code.
Please add the following line to your Pull Request description:

  • I have read and agree to the terms of the Contributor License Agreement.

Please make sure you've read our contributing guide. We look forward to reviewing your Pull Request shortly ✨

@Zeitsperre Zeitsperre merged commit d840592 into main Mar 5, 2026
16 checks passed
@Zeitsperre Zeitsperre deleted the dependabot/github_actions/dot-github/workflows/actions-1f66059e03 branch March 5, 2026 18:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Zeitsperre Zeitsperre Zeitsperre approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Zeitsperre