chore(deps): bump the github-actions group across 1 directory with 7 updates by dependabot[bot] · Pull Request #26 · uselagoon/dbaas-controller

dependabot · 2025-07-01T11:43:05Z

Bumps the github-actions group with 7 updates in the / directory:

Package	From	To
actions/attest-build-provenance	`2.3.0`	`2.4.0`
actions/setup-go	`5.4.0`	`5.5.0`
vladopajic/go-test-coverage	`2.14.1`	`2.15.0`
actions/dependency-review-action	`4.6.0`	`4.7.1`
ossf/scorecard-action	`2.4.1`	`2.4.2`
github/codeql-action	`3.28.16`	`3.29.2`
helm/kind-action	`1.9.0`	`1.12.0`

Updates actions/attest-build-provenance from 2.3.0 to 2.4.0

Release notes

Sourced from actions/attest-build-provenance's releases.

v2.4.0

What's Changed

Bump undici from 5.28.5 to 5.29.0 by @dependabot in actions/attest-build-provenance#633

Bump actions/attest from 2.3.0 to 2.4.0 by @bdehamer in actions/attest-build-provenance#654

Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run

Full Changelog: actions/attest-build-provenance@v2.3.0...v2.4.0

Commits

e8998f9 bump actions/attest from 2.3.0 to 2.4.0 (#654)
11c67f2 Bump the npm-development group across 1 directory with 6 updates (#649)
39cb715 Bump the npm-development group across 1 directory with 7 updates (#641)
7d91c40 Bump undici from 5.28.5 to 5.29.0 (#633)
d848170 Bump super-linter/super-linter in the actions-minor group (#640)
0ca36ea Bump the npm-development group with 7 updates (#582)
d82e7cd offboard from eslint in superlinter (#618)
See full diff in compare view

Updates actions/setup-go from 5.4.0 to 5.5.0

Release notes

Sourced from actions/setup-go's releases.

v5.5.0

What's Changed

Bug fixes:

Update self-hosted environment validation by @priyagupta108 in actions/setup-go#556

Add manifest validation and improve error handling by @priyagupta108 in actions/setup-go#586

Update template link by @jsoref in actions/setup-go#527

Dependency updates:

Upgrade @action/cache from 4.0.2 to 4.0.3 by @aparnajyothi-y in actions/setup-go#574

Upgrade @actions/glob from 0.4.0 to 0.5.0 by @dependabot in actions/setup-go#573

Upgrade ts-jest from 29.1.2 to 29.3.2 by @dependabot in actions/setup-go#582

Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @dependabot in actions/setup-go#537

New Contributors

@jsoref made their first contribution in actions/setup-go#527

Full Changelog: actions/setup-go@v5...v5.5.0

Commits

d35c59a chore: update discussions url (#527)
29694d7 Add manifest validation and improve error handling (#586)
78535dd Bump eslint-plugin-jest from 27.9.0 to 28.11.0 (#537)
bb65d88 Bump ts-jest from 29.1.2 to 29.3.2 (#582)
7f17e83 Bump @actions/glob from 0.4.0 to 0.5.0 (#573)
dca8468 Update self-hosted environment validation and bump undici version (#556)
691cc35 upgrade actions/cache to 4.0.3 (#574)
See full diff in compare view

Updates vladopajic/go-test-coverage from 2.14.1 to 2.15.0

Release notes

Sourced from vladopajic/go-test-coverage's releases.

v2.15.0

What's Changed

New GitHub action was added that runs tool as go source (instead of running it as binary from docker image). Usage of this GitHub action is exactly the same, except that uses property should specify path to this action.
  - name: check test coverage
    # note: uses adds 'action/source' part, compared to default action
    uses: vladopajic/go-test-coverage/action/source@v2
    with:
      config: ./.testcoverage.yml
Full Changelog: vladopajic/go-test-coverage@v2.14.3...v2.15.0

v2.14.3

What's Changed

fix(coverage): improved go.mod file search by @vladopajic in vladopajic/go-test-coverage#192

Full Changelog: vladopajic/go-test-coverage@v2.14.2...v2.14.3

v2.14.2

What's Changed

chore(deps): bump golang from 1.24.2 to 1.24.3 by @dependabot in vladopajic/go-test-coverage#189

chore: add more logs by @vladopajic in vladopajic/go-test-coverage#191

Full Changelog: vladopajic/go-test-coverage@v2...v2.14.2

Commits

ebf1fb6 chore(version): bump to v2.15.0
5e91aac feat: add action that runs using source (#188)
5b3616e chore(deps): bump dawidd6/action-download-artifact from 9 to 10 (#195)
b532023 chore: minor improvements (#194)
7003e90 chore(version): bump to v2.14.3 (#193)
e459ad4 fix(coverage): improved go.mod file search (#192)
2e10c49 Merge branch 'main' of github.com:vladopajic/go-test-coverage
e155870 chore(version): bump to v2.14.2
dd31f96 chore: add more logs (#191)
563705a chore(deps): bump golang from 1.24.2 to 1.24.3 (#189)
Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.6.0 to 4.7.1

Release notes

Sourced from actions/dependency-review-action's releases.

v4.7.1

Packages added to allow-dependencies-licenses will be allowed even if the package in question has no license information #889

License expressions (e.g. Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g. Ruby)

v4.7.0

Handle complex license expressions (e.g. MIT AND GPL-2.0) in allow lists (fixes #809 and probably others)

Replace OTHER in package licenses with LicenseRef-clearlydefined-OTHER so that parsing passes

Commits

da24556 Merge pull request #933 from actions/dangoor/471-release
9af0caf Bump version number for 4.7.1
d8f2df2 Merge pull request #932 from actions/907-disallow-expression
6e9307a Discard allow list entries that are not SPDX IDs
8805179 Merge pull request #930 from actions/889-allow-no-license
014300b Update build
34486f3 Check namespaces when excluding license checks
9b155d6 Update build
f199659 Allowing dependencies works with no licenses
38ecb5b Merge pull request #929 from actions/dangoor/4.7-release
Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.4.1 to 2.4.2

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.2

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: ossf/scorecard-action@v2.4.1...v2.4.2

Commits

05b42c6 🌱 bump docker to ghcr v2.4.2 (#1548)
b225da6 Bump github.com/ossf/scorecard/v5 from v5.2.0 to v5.2.1 (#1550)
9399f6f 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
e1daa8c 🌱 Bump the github-actions group across 1 directory with 5 updates (#...
9fe6511 🌱 Bump golang.org/x/net from 0.39.0 to 0.40.0 (#1542)
25b9cd9 🌱 Bump github.com/ossf/scorecard/v5 from v5.1.1 to v5.2.0 (#1547)
18cc9b8 🌱 Bump golang.org/x/net from 0.38.0 to 0.39.0 (#1536)
db78142 🌱 Bump the github-actions group with 2 updates (#1538)
de386ed 🌱 Bump golang from 1.24.1 to 1.24.2 in the docker-images group (#1534)
5b7cedb 🌱 Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 (#1537)
Additional commits viewable in compare view

Updates github/codeql-action from 3.28.16 to 3.29.2

Release notes

Sourced from github/codeql-action's releases.

v3.29.2

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.2 - 30 Jun 2025

Experimental: When the quality-queries input for the init action is provided with an argument, separate .quality.sarif files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2935

See the full CHANGELOG.md for more information.

v3.29.1

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.1 - 27 Jun 2025

Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #2938

Update default CodeQL bundle version to 2.22.1. #2950

See the full CHANGELOG.md for more information.

v3.29.0

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.0 - 11 Jun 2025

Update default CodeQL bundle version to 2.22.0. #2925

Bump minimum CodeQL bundle version to 2.16.6. #2912

See the full CHANGELOG.md for more information.

v3.28.19

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.19 - 03 Jun 2025

The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.

Update default CodeQL bundle version to 2.21.4. #2910

See the full CHANGELOG.md for more information.

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.29.2 - 30 Jun 2025

Experimental: When the quality-queries input for the init action is provided with an argument, separate .quality.sarif files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2935

3.29.1 - 27 Jun 2025

Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #2938

Update default CodeQL bundle version to 2.22.1. #2950

3.29.0 - 11 Jun 2025

Update default CodeQL bundle version to 2.22.0. #2925

Bump minimum CodeQL bundle version to 2.16.6. #2912

3.28.19 - 03 Jun 2025

The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.

Update default CodeQL bundle version to 2.21.4. #2910

3.28.18 - 16 May 2025

Update default CodeQL bundle version to 2.21.3. #2893

Skip validating SARIF produced by CodeQL for improved performance. #2894

The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

3.28.17 - 02 May 2025

Update default CodeQL bundle version to 2.21.2. #2872

3.28.16 - 23 Apr 2025

Update default CodeQL bundle version to 2.21.1. #2863

3.28.15 - 07 Apr 2025

Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842

3.28.14 - 07 Apr 2025

... (truncated)

Commits

181d5ee Merge pull request #2957 from github/update-v3.29.2-4c57370d0
c77386a Fix changelog PR number
8d43d4e Update changelog for v3.29.2
4c57370 Merge pull request #2935 from github/mbg/interpret-cq-results
2830b75 Add changelog entry
aa72dda Merge branch 'main' into mbg/interpret-cq-results
65d1e45 Rename SARIF_UPLOAD_ENDPOINT members
362ebf8 Check both SARIF files in quality-queries.yml test
10a3e4b Fix formatting
8593ea6 Merge pull request #2954 from github/mergeback/v3.29.1-to-main-39edc492
Additional commits viewable in compare view

Updates helm/kind-action from 1.9.0 to 1.12.0

Release notes

Sourced from helm/kind-action's releases.

v1.12.0

What's Changed

update kind to use release v0.26.0 by @cpanato in helm/kind-action#129

feat: options to configure local registry by @tthvo in helm/kind-action#113

Bump actions/checkout from 4.1.4 to 4.2.2 in the actions group by @dependabot in helm/kind-action#130

New Contributors

@tthvo made their first contribution in helm/kind-action#113

Full Changelog: helm/kind-action@v1.11.0...v1.12.0

v1.11.0

What's Changed

add wait test by @cpanato in helm/kind-action#111

revert wget to use curl again by @cpanato in helm/kind-action#110

feat: add custom kubeconfig option as action input by @jbattiato in helm/kind-action#119

fix: Use new mirror for downloading kubectl by @jriedel-ionos in helm/kind-action#127

update kind to default to release v0.24.0 by @cpanato in helm/kind-action#122

New Contributors

@jbattiato made their first contribution in helm/kind-action#119

@jriedel-ionos made their first contribution in helm/kind-action#127

Full Changelog: helm/kind-action@v1.10.0...v1.11.0

v1.10.0

Requirements

We changed to use wget instead of curl

What's Changed

Update kind to release v0.21.0 by @cpanato in helm/kind-action#104

Bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in helm/kind-action#106

Bump actions/checkout from 4.1.2 to 4.1.3 by @dependabot in helm/kind-action#108

bump kind to 0.22.0 / kubectl and general housekeeping by @cpanato in helm/kind-action#107

Bump actions/checkout from 4.1.2 to 4.1.3 in the actions group by @dependabot in helm/kind-action#109

Full Changelog: helm/kind-action@v1.9.0...v1.10.0

Commits

a1b0e39 Bump actions/checkout from 4.1.4 to 4.2.2 in the actions group (#130)
9315f6b feat: options to configure local registry (#113)
aed9fb9 update kind to use release v0.26.0 (#129)
ae94020 update kind to default to release v0.24.0 (#122)
9fdad06 fix: Use new mirror for downloading kubectl (#127)
c93960c Bump actions/checkout from 4.2.1 to 4.2.2 in the actions group (#125)
fce224d Bump actions/checkout from 4.2.0 to 4.2.1 in the actions group (#123)
0958ddc Bump actions/checkout from 4.1.7 to 4.2.0 in the actions group (#121)
5d66646 feat: add custom kubeconfig option as action input (#119)
6f17223 Bump actions/checkout from 4.1.7 to 4.2.0 in the actions group (#120)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…updates Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.3.0` | `2.4.0` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.4.0` | `5.5.0` | | [vladopajic/go-test-coverage](https://github.com/vladopajic/go-test-coverage) | `2.14.1` | `2.15.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.6.0` | `4.7.1` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.28.16` | `3.29.2` | | [helm/kind-action](https://github.com/helm/kind-action) | `1.9.0` | `1.12.0` | Updates `actions/attest-build-provenance` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@db473fd...e8998f9) Updates `actions/setup-go` from 5.4.0 to 5.5.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@0aaccfd...d35c59a) Updates `vladopajic/go-test-coverage` from 2.14.1 to 2.15.0 - [Release notes](https://github.com/vladopajic/go-test-coverage/releases) - [Commits](vladopajic/go-test-coverage@937b863...ebf1fb6) Updates `actions/dependency-review-action` from 4.6.0 to 4.7.1 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@ce3cf95...da24556) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.2 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...05b42c6) Updates `github/codeql-action` from 3.28.16 to 3.29.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@28deaed...181d5ee) Updates `helm/kind-action` from 1.9.0 to 1.12.0 - [Release notes](https://github.com/helm/kind-action/releases) - [Commits](helm/kind-action@v1.9.0...v1.12.0) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-go dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: vladopajic/go-test-coverage dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/dependency-review-action dependency-version: 4.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 3.29.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: helm/kind-action dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2025-10-01T09:37:43Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 1, 2025

dependabot bot closed this Oct 1, 2025

dependabot bot deleted the dependabot/github_actions/github-actions-45d70bed6e branch October 1, 2025 09:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the github-actions group across 1 directory with 7 updates#26

chore(deps): bump the github-actions group across 1 directory with 7 updates#26
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-45d70bed6e

dependabot bot commented on behalf of github Jul 1, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Oct 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.4.0

What's Changed

v5.5.0

What's Changed

Bug fixes:

Dependency updates:

New Contributors

v2.15.0

What's Changed

v2.14.3

What's Changed

v2.14.2

What's Changed

v4.7.1

v4.7.0

v2.4.2

What's Changed

v3.29.2

CodeQL Action Changelog

3.29.2 - 30 Jun 2025

v3.29.1

CodeQL Action Changelog

3.29.1 - 27 Jun 2025

v3.29.0

CodeQL Action Changelog

3.29.0 - 11 Jun 2025

v3.28.19

CodeQL Action Changelog

3.28.19 - 03 Jun 2025

CodeQL Action Changelog

[UNRELEASED]

3.29.2 - 30 Jun 2025

3.29.1 - 27 Jun 2025

3.29.0 - 11 Jun 2025

3.28.19 - 03 Jun 2025

3.28.18 - 16 May 2025

3.28.17 - 02 May 2025

3.28.16 - 23 Apr 2025

3.28.15 - 07 Apr 2025

3.28.14 - 07 Apr 2025

v1.12.0

What's Changed

New Contributors

v1.11.0

What's Changed

New Contributors

v1.10.0

Requirements

What's Changed

Uh oh!

dependabot bot commented on behalf of github Oct 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jul 1, 2025 •

edited

Loading