Skip to content

chore(deps): bump the actions group across 1 directory with 9 updates - #683

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-6cdcdcef38
Open

chore(deps): bump the actions group across 1 directory with 9 updates#683
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-6cdcdcef38

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 9 updates in the / directory:

Package From To
runs-on/action 2.4.0 2.6.0
leanprover/lean-action 1.6.0 1.7.0
actions/upload-artifact 7.0.1 7.0.2
actions/download-artifact 8.0.1 8.0.2
bencherdev/bencher 0.6.13 0.6.15
taiki-e/install-action 2.87.22 2.88.1
github/codeql-action/init 4.38.2 4.39.1
github/codeql-action/analyze 4.38.2 4.39.1
cachix/install-nix-action 31.11.1 31.11.3

Updates runs-on/action from 2.4.0 to 2.6.0

Release notes

Sourced from runs-on/action's releases.

v2.6.0

What's Changed

Full Changelog: runs-on/action@v2.5.0...v2.6.0

v2.5.0

What's Changed

New

  • Disk metrics report free and total bytes (disk_free, disk_total), and the post-step summary charts them.
  • Disk metrics identify each mount's EBS volume with a new VolumeId dimension, so a sticky disk or snapshot volume on /var/lib/docker reports its own volume instead of the root volume's. (#68, closes #19)

Changed

  • On RunsOn v3.4.0 and later, the runner agent reports the job cost in the "Complete runner" step, and show_costs only chooses how it is shown (inline, summary or off). On those stacks the action no longer calls the RunsOn cost API or DescribeAvailabilityZones. Older stacks keep the post-step cost report. (#70)
  • Disk metrics now carry device and VolumeId dimensions. CloudWatch matches exact dimension sets, so dashboards or alarms that select disk metrics by their dimensions need the new ones.
Commits
  • 284bff8 Release v2.6.0
  • 73f8424 Build with Go 1.27.3 to block the compromised eMudhra intermediates (#84)
  • 1a99cc5 Add a remote_cache input: Bazel, Go, Gradle, mbx and sccache caches on the Ru...
  • 1586e9c Add a bazel_remote_cache input that gives Bazel a remote cache through Magic ...
  • cb1cb4f Add a gocacheprog input that shares Go's build cache through Magic Cache (#75)
  • 3e0deed Run CI on every branch (#77)
  • 731d906 Rename internal/cache to internal/magiccache (#76)
  • df462a4 Add sticky_save input for restore-only sticky caches (#73)
  • 8dbb600 Skip post-step work after an EC2 Spot interruption (#69)
  • 6dc8a7d Build the action in CI and release the build CI tested (#74)
  • Additional commits viewable in compare view

Updates leanprover/lean-action from 1.6.0 to 1.7.0

Release notes

Sourced from leanprover/lean-action's releases.

v1.7.0

Changed

  • set MATHLIB_CACHE_GET_URL to https://cache.mathlib.org/mathlib4 for lake exe cache get, so Mathlib cache clients that read this variable download from cache.mathlib.org. A value that the workflow sets takes precedence. An empty value unsets the variable, so the cache client uses its own default endpoint

Fixed

  • pass --no-modify-path to elan-init so installing elan no longer edits the runner's persistent environment (HKCU\Environment\PATH on Windows, ~/.profile and friends elsewhere). lean-action already puts $HOME/.elan/bin on $GITHUB_PATH, so this is a no-op on GitHub-hosted runners; on self-hosted runners it stops every job from accumulating PATH entries that outlive it

v1.6.2

Fixed

  • save the GitHub cache after testing and linting so their build artifacts can be reused, preserving caching after test or lint failures and skipping saves on an exact cache hit

v1.6.1

Changed

  • pin the actions/cache steps, and all actions used by this repository's workflows, to full commit SHAs, so that lean-action works in organizations that require SHA-pinned actions
Changelog

Sourced from leanprover/lean-action's changelog.

Changelog

All notable changes to lean-action will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Fixed

  • restore the GitHub cache before automatic configuration and mk_all-check, so those steps can reuse cached dependencies and build artifacts

v1.7.0 - 2026-10-27

Changed

  • set MATHLIB_CACHE_GET_URL to https://cache.mathlib.org/mathlib4 for lake exe cache get, so Mathlib cache clients that read this variable download from cache.mathlib.org. A value that the workflow sets takes precedence. An empty value unsets the variable, so the cache client uses its own default endpoint

Fixed

  • pass --no-modify-path to elan-init so installing elan no longer edits the runner's persistent environment (HKCU\Environment\PATH on Windows, ~/.profile and friends elsewhere). lean-action already puts $HOME/.elan/bin on $GITHUB_PATH, so this is a no-op on GitHub-hosted runners; on self-hosted runners it stops every job from accumulating PATH entries that outlive it

v1.6.2 - 2026-10-12

Fixed

  • save the GitHub cache after testing and linting so their build artifacts can be reused, preserving caching after test or lint failures and skipping saves on an exact cache hit

v1.6.1 - 2026-10-02

Changed

  • pin the actions/cache steps, and all actions used by this repository's workflows, to full commit SHAs, so that lean-action works in organizations that require SHA-pinned actions

v1.6.0 - 2026-08-22

Added

  • new leanchecker-args input to pass arguments to lake env leanchecker, e.g. leanchecker-args: "-v" for verbose output or explicit module prefixes such as leanchecker-args: "MyPkg.Core" to narrow the set of modules checked
  • new axiom-audit input to audit the project's axioms with axiom-audit: fail if any declaration depends on an axiom outside the allowlist (catches sorry, native_decide, and home-rolled axioms). Default: false

... (truncated)

Commits

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • See full diff in compare view

Updates bencherdev/bencher from 0.6.13 to 0.6.15

Release notes

Sourced from bencherdev/bencher's releases.

v0.6.15

  • Add Bencher to the ChatGPT and Codex plugins directory
  • List exact matches first, then the most recently used, in the Console search menus for Branches, Testbeds, Benchmarks, Measures, Parameters, and Metrics (Thank you thomaseizinger)
  • A project key can now create and update plots with POST /v0/projects/{project}/plots and PATCH /v0/projects/{project}/plots/{plot}, and Bencher MCP adds the create_plot and update_plot tools
  • BREAKING CHANGE Remove the perf image endpoint (GET /v0/projects/{project}/perf/img) and the MCP perf_image tool; embed the perf plot from a public project's perf page instead
  • With --github-actions, the jobs of a Project on a pull request now share one comment with a numbered Report row per job, and --ci-id labels the job's Report

v0.6.14

  • Add --start-point-idempotency-key (or BENCHER_START_POINT_IDEMPOTENCY_KEY) to bencher run, bencher report create, and bencher branch update, so parallel jobs that reset a Branch with the same key share one Head; in GitHub Actions, bencher run defaults the key to the workflow run attempt
  • Fix concurrent runs on a Branch failing when they create the same Thresholds, such as parallel runs that clone Thresholds from a start point; the first run creates them and the rest use them
  • Add GET /v0/server/health, which checks that the API server runs and reaches its database
  • BREAKING CHANGE Remove GET /v0/projects. List an organization's projects with GET /v0/organizations/{organization}/projects, which bencher project list now calls with a required organization argument, and the MCP list_projects tool now takes an organization and asks an anonymous caller to sign in
  • Add --image-cache-size to runner up (or BENCHER_IMAGE_CACHE_SIZE), the bytes of Image config and layer blobs a Bare Metal Runner keeps across Jobs in blobs under its --state-dir, so a Job downloads only the blobs the Runner does not already hold, while its manifest still comes from the registry. Between Jobs the least recently used blobs are removed until the rest fit, a Runner given a size exits at startup if it cannot make the store its own, and without one the Runner keeps none
  • A Bare Metal Job whose image cannot be pulled or prepared now fails, even with --allow-failure, instead of completing with no results
  • A Bare Metal build time now covers the image's command alone, timed where the command runs, and no longer includes the image pull, unpack, and boot; only an iteration whose command succeeds reports one
  • Support Hyperfine 2 JSON output in the shell_hyperfine adapter (Thank you mrazauskas)
  • Fix a very large page query parameter returning the wrong page
  • BREAKING CHANGE Cap perf queries at 8 branches, testbeds, benchmarks, and measures each, and at 64 permutations and 64 lines; extra entries are ignored rather than refused
  • Add a plus_limit server config option for the daily metrics limit of organizations with a Bencher Plus plan
  • BREAKING CHANGE Cap a plot at 8 branches, testbeds, benchmarks, and measures each
  • Cap active Thresholds at 64 per Branch, Testbed, and Measure, and skip the Thresholds a report cannot create (over a cap or over the daily creation limit) instead of failing the report
  • BREAKING CHANGE The plus.litestream server config key is removed; use plus.disaster_recovery. A config that still uses plus.litestream is ignored and disaster recovery does not run at all: no restore at startup and no replication
  • BREAKING CHANGE The sftp disaster recovery replica scheme is removed; file and s3 remain
  • BREAKING CHANGE The on demand database backup is removed: POST /v0/server/backup, bencher server backup, and the database.data_store server config section
  • BREAKING CHANGE The container registry storage config moves from plus.registry.data_store (service: aws_s3, an S3 access point ARN) to plus.registry.storage (scheme: file | s3, a bucket plus optional endpoint, region, and path), and any S3-compatible object store now works. Stored keys and the local directory layout are unchanged for a plain prefix, so existing data is picked up as is; a path that began or ended with a slash is now normalized, and one containing a character the store percent-encodes is now encoded, so see the config reference before upgrading. A config that still carries data_store is ignored and the registry falls back to local files
  • BREAKING CHANGE A Bare Metal Runner that executes sandboxed Jobs must now run as root, where before it did not. Confining the Firecracker VMM requires privileges that enabling KVM does not grant: mknod to create the sandbox's /dev/kvm, chown to hand the guest images to the sandbox user, pivot_root, and setns to join an empty network namespace. A world-readable /dev/kvm is enough to use KVM unprivileged but not to build the sandbox around it. Start runner up as root, or as a service that starts it as root. If you cannot run as root, start the Runner with --danger-allow-no-sandbox and assign it only Specs with no Sandbox; be aware that this gives up the microVM itself and not just its confinement, so those Jobs execute directly on the host
  • Confine the Firecracker VMM on Bare Metal Runners with the Firecracker jailer: the VMM behind each sandboxed Job now runs in a chroot as a dedicated unprivileged user, in an empty network namespace, and is placed in its cgroup before it starts, so a VMM escape no longer lands as root on the Runner host holding the Runner key and every prior Job's work. The user defaults to 61016 and is settable with --jail-uid/--jail-gid, neither of which may be 0
  • Add --state-dir to the Runner (default /var/lib/bencher-runner), a persistent directory holding the chroot each sandboxed Job's VMM runs in. Before every sandboxed Job it is swept of anything a previous Runner left behind, since a Runner killed mid-Job cannot clean up after itself. A host runs one Runner at a time, whatever its state directory: a Runner started as root holds /run/bencher/runner.lock for as long as it runs, and a second one started as root exits at once with an error naming that lock; a Runner that is not root cannot open the lock and runs without it. When a Runner started as root comes up, and again before each sandboxed Job, it kills any process still running in a cgroup under /sys/fs/cgroup/bencher, such as the sandbox of a Runner killed mid-Job, whatever that Runner's state directory
  • BREAKING CHANGE Sandboxed Jobs on Bare Metal Runners now need Linux 5.14 or later and a writable cgroup v2 hierarchy on every host, a one-core host included: each sandboxed Job runs in its own cgroup under /sys/fs/cgroup/bencher, with the cpuset, memory, and pids controllers enabled, and the Runner kills a Job's processes, and anything a Runner left there, through that cgroup's cgroup.kill. On an older kernel a Runner exits at startup or, started with --danger-allow-no-sandbox, fails each sandboxed Job
  • Write Runner logs to stderr as JSON, and stop relaying a Job's output into runner up's log
  • BREAKING CHANGE Remove --grace-period from runner up and runner run, so a Runner started with it now fails to parse its arguments. A sandboxed Job's results now leave the guest on a drive the Runner reads only once the VM has powered off, so there is no grace period left to wait out: each sandboxed Job ends about a second sooner, a guest that powers off without its results fails the Job at once rather than at its timeout, and a guest still running at its timeout has a few more seconds to write its results and power off before it is killed
  • BREAKING CHANGE POST /v0/runners/{runner}/specs and bencher runner spec add now return the Runner, with its updated specs, instead of the Spec. Older CLI versions still add the Spec but cannot parse the new response, so update the CLI before using bencher runner spec add
  • Show a Runner's last heartbeat and its latest status (taking Jobs or paused, why it is paused, and its disk health) on the admin Runner endpoints and in bencher system runner view
  • Email server admins when a Runner's disk health changes or shows a new problem, when a Runner stays paused for more than 12 hours, and when it takes Jobs again
  • Pause a Bare Metal Runner between Jobs while an md RAID array on its host resyncs, recovers, checks, repairs, or reshapes: it takes no new Job until the sync is done and never stops a running one. Start runner up with --no-raid-pause to keep taking Jobs
  • Have a Bare Metal Runner take turns with host maintenance: it holds /run/bencher/job.lock through each Job, and pauses while another process holds the lock or a marker named /run/bencher/maintenance or /run/bencher/maintenance.<name> exists, so touch /run/bencher/maintenance drains it. runner run waits for the lock too. /run/bencher is now root's alone
  • Report a Bare Metal Runner's disk health with each ready and paused: its md arrays at every poll, and its NVMe drives' SMART / health logs at most hourly, which needs root
  • Record the project key that creates a Report, which the Report now names in project_key
  • Deleting a Project now requires the Maintainer role, which Organization Leaders and server admins hold
  • Add --threshold-metric and --threshold-parameters to bencher run and bencher report create to declare the metric and the parameters a Threshold checks
  • Add optional metrics, hidden, focus, and layout fields to plots, so a pinned plot keeps the metrics it draws, the lines it hides, the line it focuses, and how it lays out its measures; set them with POST /v0/projects/{project}/plots, and change them, or clear them with null, with PATCH /v0/projects/{project}/plots/{plot}
  • Filter the Reports list by adapter and alerts=active, and count each Report iteration's lines
  • Cap a project at 64 plots: POST /v0/projects/{project}/plots refuses another with a 400 until one is deleted
  • Add --bmf-version to bencher project update, so a server admin can move a Project to BMF version 1
  • BREAKING CHANGE Security fix for URL validation: a project URL must now use http or https, an existing project URL that does not is shown as plain text, and the Console no longer links to a URL with any other scheme
  • Security fix for the Console's embed snippet: it now escapes the project name and title
  • Add Bencher to the Claude connectors directory
  • Every Project, at either BMF version, now opens in the new Console at the Console's own paths: the classic Console's Project, Organization, and account pages are removed and their links redirect, and the public projects list is removed, with /perf redirecting to /explore
Commits
  • 24c333d Release v0.6.15
  • 3a0ee19 Document one pull request comment per Project (#1342)
  • 139c30f Write one pull request comment per Project (#1341)
  • caf43b5 Render one pull request comment with a section per job (#1326)
  • 76b82f9 Remove the perf image (#1403)
  • bbc1fbd Scan each console page state with axe once, and its dialogs in Vitest (#1399)
  • 9f3753f Run the console e2e suite fully parallel (#1397)
  • 1518a80 Test five console behaviors at the API and drop three e2e twins (#1394)
  • 413bcf9 Let project keys create and update plots (#1393)
  • 4970e68 List exact matches first, then the most recently used, in the console search ...
  • Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.22 to 2.88.1

Release notes

Sourced from taiki-e/install-action's releases.

2.88.1

  • Update wasmtime@latest to 50.0.1.

  • Update vacuum@latest to 0.36.0.

  • Update tombi@latest to 1.9.8.

  • Update mise@latest to 2026.10.23.

  • Update kingfisher@latest to 2.15.0.

  • Update espup@latest to 0.19.0.

  • Update deepsource@latest to 0.10.2.

  • Update biome@latest to 2.6.4.

2.88.0

2.87.33

  • Update vacuum@latest to 0.35.4.

  • Update uv@latest to 0.13.6.

  • Update trunk@latest to 0.22.1.

  • Update tombi@latest to 1.9.6.

  • Update release-plz@latest to 0.4.2.

  • Update mise@latest to 2026.10.21.

  • Update cargo-nextest@latest to 0.9.150.

  • Update cargo-about@latest to 0.9.3.

2.87.32

  • Update wild@latest to 0.11.0.

  • Update vacuum@latest to 0.35.2.

  • Update tombi@latest to 1.9.5.

  • Update sccache@latest to 0.19.0.

  • Update release-plz@latest to 0.4.1.

  • Update mise@latest to 2026.10.19.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.1] - 2026-11-04

  • Update zizmor@latest to 1.32.0.

  • Update uv@latest to 0.13.7.

  • Update typos@latest to 1.52.0.

  • Update tombi@latest to 1.9.9.

  • Update syft@latest to 1.56.0.

  • Update mise@latest to 2026.11.0.

  • Update kache@latest to 2.0.0.

  • Update cargo-nextest@latest to 0.9.151.

[2.90.0] - 2026-11-03

  • Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

  • Update vacuum@latest to 0.36.2.

  • Update release-plz@latest to 0.4.3.

  • Update bpf-linker@latest to 0.13.0.

[2.89.1] - 2026-11-02

  • Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

  • Update parse-dockerfile@latest to 0.1.9.

  • Update parse-changelog@latest to 0.6.18.

  • Update cargo-minimal-versions@latest to 0.1.38.

... (truncated)

Commits
  • 68a389c Release 2.88.1
  • e31c3b8 Update wasmtime manifest
  • e30a869 Update wasmtime@latest to 50.0.1
  • bca7759 Update tombi@latest to 1.9.8
  • 53e7fa7 ci: Mark deepsource as glibc_pre_2_34_incompat
  • 8f5b3ba Update wasmtime manifest
  • c6e228d Update wasm-pack manifest
  • 46c9dcf Update wasm-bindgen manifest
  • 4136a69 Update vacuum@latest to 0.36.0
  • bf9426f Update tombi@latest to 1.9.7
  • Additional commits viewable in compare view

Updates github/codeql-action/init from 4.38.2 to 4.39.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.1

  • Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

  • Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

  • Update default CodeQL bundle version to 2.27.4. #4284
  • Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
  • Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

  • Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits
  • 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
  • b5e1ed9 Trigger workflows
  • 20f5ec3 Update changelog for v4.39.1
  • c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
  • 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
  • 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
  • b96e339 Change comment for getConfig call in upload-sarif
  • 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
  • a69c7cb Document that setting the env vars to false takes precedence
  • 74ddcd9 Fix typo in comment
  • Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.38.2 to 4.39.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.1

  • Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

  • Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

  • Update default CodeQL bundle version to 2.27.4. #4284
  • Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
  • Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

  • Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits
  • 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
  • b5e1ed9 Trigger workflows
    • ...

    Description has been truncated

@dependabot
chore(deps): bump the actions group across 1 directory with 9 updates
734e664 
Bumps the actions group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [runs-on/action](https://github.com/runs-on/action) | `2.4.0` | `2.6.0` |
| [leanprover/lean-action](https://github.com/leanprover/lean-action) | `1.6.0` | `1.7.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [bencherdev/bencher](https://github.com/bencherdev/bencher) | `0.6.13` | `0.6.15` |
| [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.22` | `2.88.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` |
| [cachix/install-nix-action](https://github.com/cachix/install-nix-action) | `31.11.1` | `31.11.3` |



Updates `runs-on/action` from 2.4.0 to 2.6.0
- [Release notes](https://github.com/runs-on/action/releases)
- [Commits](runs-on/action@dfae4d9...284bff8)

Updates `leanprover/lean-action` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/leanprover/lean-action/releases)
- [Changelog](https://github.com/leanprover/lean-action/blob/main/CHANGELOG.md)
- [Commits](leanprover/lean-action@50fcf42...fe40864)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

Updates `bencherdev/bencher` from 0.6.13 to 0.6.15
- [Release notes](https://github.com/bencherdev/bencher/releases)
- [Commits](bencherdev/bencher@f808474...24c333d)

Updates `taiki-e/install-action` from 2.87.22 to 2.88.1
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@83ac0ad...68a389c)

Updates `github/codeql-action/init` from 4.38.2 to 4.39.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...9b32540)

Updates `github/codeql-action/analyze` from 4.38.2 to 4.39.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...9b32540)

Updates `cachix/install-nix-action` from 31.11.1 to 31.11.3
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](cachix/install-nix-action@13d8dd5...75c75c3)

---
updated-dependencies:
- dependency-name: runs-on/action
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: leanprover/lean-action
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: bencherdev/bencher
  dependency-version: 0.6.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.88.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: cachix/install-nix-action
  dependency-version: 31.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants