chore(deps): bump the actions group across 1 directory with 7 updates by dependabot[bot] · Pull Request #457 · elfensky/helldivers.bot

dependabot · 2026-07-20T07:07:52Z

Bumps the actions group with 7 updates in the / directory:

Package	From	To
actions/setup-node	`6.4.0`	`7.0.0`
github/codeql-action	`4.36.2`	`4.37.1`
docker/setup-buildx-action	`4.1.0`	`4.2.0`
lowlighter/metrics	`3.34`	`4`
docker/login-action	`4.2.0`	`4.4.0`
docker/build-push-action	`7.2.0`	`7.3.0`
dorny/paths-filter	`4.0.1`	`4.0.2`

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in actions/setup-node#1577

Migrate to ESM and upgrade dependencies by @gowridurgad in actions/setup-node#1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in actions/setup-node#1558

Only use mirrorToken in getManifest if it's provided by @deiga in actions/setup-node#1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in actions/setup-node#1536

docs: Update restore-only cache documentation by @priya-kinthali in actions/setup-node#1550

docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in actions/setup-node#1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-node#1569

New Contributors

@chiranjib-swain made their first contribution in actions/setup-node#1536

@deiga made their first contribution in actions/setup-node#1548

@jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

8207627 Migrate to ESM and upgrade dependencies (#1574)
04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
30eb73b Resolve high-severity audit issues
4e1a87a Update dist
360237f Strict equality
4f8aac5 Bump @actions/cache to 5.1.0, log cache write denied
f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
Additional commits viewable in compare view

Updates github/codeql-action from 4.36.2 to 4.37.1

Release notes

Sourced from github/codeql-action's releases.

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action's changelog.

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

Commits

7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
c8b5f69 Update changelog for v4.37.1
9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
3492b7e Change REMOTE_PATH_PREFIX to remote=
3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 4.1.0 to 4.2.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-buildx-action#572

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-buildx-action#551

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/setup-buildx-action#557 docker/setup-buildx-action#580

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-buildx-action#573

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-buildx-action#576

Bump js-yaml from 4.1.1 to 5.2.0 in docker/setup-buildx-action#562

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-buildx-action#577

Bump tmp from 0.2.5 to 0.2.7 in docker/setup-buildx-action#556

Bump undici from 6.25.0 to 6.27.0 in docker/setup-buildx-action#570

Bump vite from 7.3.2 to 7.3.6 in docker/setup-buildx-action#569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

Commits

bb05f3f Merge pull request #580 from docker/dependabot/npm_and_yarn/docker/actions-to...
321c814 [dependabot skip] chore: update generated content
b9a36ef build(deps): bump @docker/actions-toolkit from 0.91.0 to 0.92.0
ebeab24 Merge pull request #570 from docker/dependabot/npm_and_yarn/undici-6.27.0
5c7b8ae [dependabot skip] chore: update generated content
037e618 build(deps): bump undici from 6.25.0 to 6.27.0
66080e5 Merge pull request #577 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
409aef0 Merge pull request #562 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
49c6e42 build(deps): bump sigstore from 4.1.0 to 4.1.1
2211273 [dependabot skip] chore: update generated content
Additional commits viewable in compare view

Updates lowlighter/metrics from 3.34 to 4

Commits

05b761c draft: v4 version
1e8d436 ci: auto-regenerate files
6218d94 chore: code formatting
4362c2a chore(deps): upgrade marked (cannot do it to 8.0.0 because of deprecated opti...
183ade9 fix(app/web): accomodate express rate limit breaking change
842cd27 chore(deps): upgrade
2656ecc fix(plugins/core): empty scope listing
47746ad fix(ci): potential security vulnerabilities
c69b0e9 chore: create version 3.35-beta
See full diff in compare view

Updates docker/login-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/login-action's releases.

v4.4.0

Skip empty registry-auth secret mask by @crazy-max in docker/login-action#1035

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Preserve names in esbuild bundle by @crazy-max in docker/login-action#1022

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 docker/login-action#999 docker/login-action#1030

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/login-action#1023

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/login-action#1029

Bump http-proxy-agent and https-proxy-agent to 9.1.0 in docker/login-action#1017

Bump js-yaml from 4.1.1 to 5.2.0 in docker/login-action#1028

Bump sigstore from 4.1.0 to 4.1.1 in docker/login-action#1031

Bump tmp from 0.2.5 to 0.2.7 in docker/login-action#1002

Bump undici from 6.24.1 to 6.27.0 in docker/login-action#1020

Bump vite from 7.3.3 to 7.3.6 in docker/login-action#1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

Commits

af1e73f Merge pull request #1034 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
da722bd [dependabot skip] chore: update generated content
2916ad6 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
ca0a662 Merge pull request #1035 from crazy-max/fix-registry-auth-empty-mask
c455755 chore: update generated content
4835190 skip empty registry-auth secret mask
992421c Merge pull request #1033 from docker/dependabot/github_actions/docker/bake-ac...
b249b43 Merge pull request #1032 from docker/dependabot/github_actions/docker/bake-ac...
1b67977 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
9d49d6a build(deps): bump docker/bake-action/subaction/matrix
Additional commits viewable in compare view

Updates docker/build-push-action from 7.2.0 to 7.3.0

Release notes

Sourced from docker/build-push-action's releases.

v7.3.0

Preserve names in esbuild bundle by @crazy-max in docker/build-push-action#1567

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/build-push-action#1545 docker/build-push-action#1572

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/build-push-action#1568

Bump js-yaml from 4.1.1 to 4.3.0 in docker/build-push-action#1566

Bump tmp from 0.2.5 to 0.2.7 in docker/build-push-action#1547

Bump undici from 6.24.1 to 6.27.0 in docker/build-push-action#1564

Bump vite from 7.3.2 to 7.3.6 in docker/build-push-action#1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

Commits

53b7df9 Merge pull request #1572 from docker/dependabot/npm_and_yarn/docker/actions-t...
154298c [dependabot skip] chore: update generated content
cb1238b chore(deps): Bump @docker/actions-toolkit from 0.91.0 to 0.92.0
24f845d Merge pull request #1566 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
9c69730 [dependabot skip] chore: update generated content
bc3a3a5 Merge pull request #1574 from docker/dependabot/github_actions/aws-actions/co...
a82c504 chore(deps): Bump js-yaml from 4.1.1 to 4.3.0
0285a75 Merge pull request #1573 from docker/dependabot/github_actions/actions/cache-...
c6ad2a3 Merge pull request #1575 from docker/dependabot/github_actions/actions/checko...
d37484f Merge pull request #1564 from docker/dependabot/npm_and_yarn/undici-6.27.0
Additional commits viewable in compare view

Updates dorny/paths-filter from 4.0.1 to 4.0.2

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.2

What's Changed

fix warning message by @cgundy in dorny/paths-filter#282

chore: fix GitHub spelling in logs by @squat in dorny/paths-filter#278

fix: use rev-parse instead of branch --show-current for older git compat by @saschabratton in dorny/paths-filter#303

fix: work around git dubious ownership errors in container jobs by @saschabratton in dorny/paths-filter#317

docs: update changelog for v4.0.2 by @saschabratton in dorny/paths-filter#318

New Contributors

@cgundy made their first contribution in dorny/paths-filter#282

@squat made their first contribution in dorny/paths-filter#278

Full Changelog: dorny/paths-filter@v4.0.1...v4.0.2

Changelog

Sourced from dorny/paths-filter's changelog.

v4.0.2

Work around git dubious ownership errors in container jobs

Use rev-parse instead of branch --show-current for older git compat

Fix warning message

Commits

7b450ff docs: update changelog for v4.0.2 (#318)
9280377 fix: work around git dubious ownership errors in container jobs (#317)
f3ceefd fix: use rev-parse instead of branch --show-current for older git compat (#303)
61f87a1 chore: fix GitHub spelling in logs (#278)
b82ff81 fix warning message (#282)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.36.2` | `4.37.1` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.2.0` | | [lowlighter/metrics](https://github.com/lowlighter/metrics) | `3.34` | `4` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.4.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.2.0` | `7.3.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6.4.0...v7.0.0) Updates `github/codeql-action` from 4.36.2 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.36.2...v4.37.1) Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v4.1.0...v4.2.0) Updates `lowlighter/metrics` from 3.34 to 4 - [Release notes](https://github.com/lowlighter/metrics/releases) - [Commits](lowlighter/metrics@v3.34...v4) Updates `docker/login-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4.2.0...v4.4.0) Updates `docker/build-push-action` from 7.2.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v7.2.0...v7.3.0) Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@v4.0.1...v4.0.2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: lowlighter/metrics dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Dependency updates github-actions GitHub Actions updates labels Jul 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the actions group across 1 directory with 7 updates#457

chore(deps): bump the actions group across 1 directory with 7 updates#457
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/github_actions/develop/actions-7ec28df7f3

dependabot Bot commented on behalf of github Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

v6.5.0

What's Changed

v4.37.1

v4.37.0

v4.36.3

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

v4.2.0

v4.4.0

v4.3.0

v7.3.0

v4.0.2

What's Changed

New Contributors

v4.0.2

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants