Bump the github-actions-all group across 1 directory with 5 updates by dependabot[bot] · Pull Request #512 · techhubms/techhub

dependabot · 2026-08-12T09:58:35Z

Bumps the github-actions-all group with 5 updates in the / directory:

Package	From	To
github/codeql-action/upload-sarif	`4.37.4`	`4.37.6`
github/codeql-action/init	`4.37.4`	`4.37.6`
github/codeql-action/analyze	`4.37.4`	`4.37.6`
azure/login	`3.0.0`	`3.0.1`
step-security/harden-runner	`2.20.0`	`2.20.1`

Updates github/codeql-action/upload-sarif from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.6
Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070
v4.37.5
Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
[UNRELEASED]
No user facing changes.
4.37.6 - 04 Aug 2026
Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070
4.37.5 - 03 Aug 2026
Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061
4.37.4 - 29 Jul 2026
This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
Update default CodeQL bundle version to 2.26.2. #4051
4.37.3 - 22 Jul 2026
No user facing changes.
4.37.2 - 21 Jul 2026
The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
4.37.1 - 16 Jul 2026
Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019
4.37.0 - 08 Jul 2026
Update default CodeQL bundle version to 2.26.0. #3995
In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973
4.36.3 - 01 Jul 2026
No user facing changes.
4.36.2 - 04 Jun 2026
Cache CodeQL CLI version information across Actions steps. #3943
Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
ec9c757 Add change note for PR 4070
45c8742 Update changelog for v4.37.6
6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
065cdc0 Change DEFAULT_CONFIG_FILE_NAME
f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
3020a2f Rebuild
93c3a5a Update changelog and version after v4.37.5
d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.6
Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070
v4.37.5
Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
[UNRELEASED]
No user facing changes.
4.37.6 - 04 Aug 2026
Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070
4.37.5 - 03 Aug 2026
Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061
4.37.4 - 29 Jul 2026
This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
Update default CodeQL bundle version to 2.26.2. #4051
4.37.3 - 22 Jul 2026
No user facing changes.
4.37.2 - 21 Jul 2026
The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
4.37.1 - 16 Jul 2026
Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019
4.37.0 - 08 Jul 2026
Update default CodeQL bundle version to 2.26.0. #3995
In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973
4.36.3 - 01 Jul 2026
No user facing changes.
4.36.2 - 04 Jun 2026
Cache CodeQL CLI version information across Actions steps. #3943
Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
ec9c757 Add change note for PR 4070
45c8742 Update changelog for v4.37.6
6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
065cdc0 Change DEFAULT_CONFIG_FILE_NAME
f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
3020a2f Rebuild
93c3a5a Update changelog and version after v4.37.5
d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.6
Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070
v4.37.5
Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
[UNRELEASED]
No user facing changes.
4.37.6 - 04 Aug 2026
Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070
4.37.5 - 03 Aug 2026
Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061
4.37.4 - 29 Jul 2026
This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
Update default CodeQL bundle version to 2.26.2. #4051
4.37.3 - 22 Jul 2026
No user facing changes.
4.37.2 - 21 Jul 2026
The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
4.37.1 - 16 Jul 2026
Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019
4.37.0 - 08 Jul 2026
Update default CodeQL bundle version to 2.26.0. #3995
In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973
4.36.3 - 01 Jul 2026
No user facing changes.
4.36.2 - 04 Jun 2026
Cache CodeQL CLI version information across Actions steps. #3943
Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
ec9c757 Add change note for PR 4070
45c8742 Update changelog for v4.37.6
6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
065cdc0 Change DEFAULT_CONFIG_FILE_NAME
f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
3020a2f Rebuild
93c3a5a Update changelog and version after v4.37.5
d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
Additional commits viewable in compare view

Updates azure/login from 3.0.0 to 3.0.1

Release notes

Sourced from azure/login's releases.

Azure Login Action v3.0.1
What's Changed
Escape single quotes in PowerShell login script inputs by @MaddyMicrosoft in Azure/login#599
Full Changelog: https://github.com/Azure/login/commits/v3.0.1

Commits

f5d393a Merge remote-tracking branch 'origin/master' into releases/v3.0.1
e8cd11f Replacing hardcoded version v2 with v3 (#603)
73730b8 prepare release v3.0.1
f4dcb80 Escape single quotes in PowerShell login script inputs (#599)
e82415a Add IDE files to .gitignore (#597)
a842007 Update CODEOWNERS (#598)
9dfca58 use the latest auzre/powershell@v3 (#581)
See full diff in compare view

Updates step-security/harden-runner from 2.20.0 to 2.20.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.20.1
What's Changed
AWS CodeBuild-hosted runner support
Implicitly allow single-labeled (internal) domains in block-mode
Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

Commits

b09bb98 Merge pull request #680 from step-security/aws-code-build
35cd77b docs: document the Global Block List in the features list
bb6dbef chore: rebuild dist with clean dependency install
98f73c5 chore: update eBPF agent to v1.8.14
54193c1 Reapply "feat(runners): detect AWS CodeBuild-hosted runners as third-party pr...
d22dd48 Revert "fix(self-hosted): flush agent events at job end when deploy-on-self-h...
0ff0941 fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm...
a3c333d Revert "feat(runners): detect AWS CodeBuild-hosted runners as third-party pro...
bf94c00 feat(runners): detect AWS CodeBuild-hosted runners as third-party provider
514522c fix(self-hosted): resolve runner user when USER env var is unset
See full diff in compare view

github-actions · 2026-08-12T10:16:37Z

⏰ PR Preview Environment — Nightly Teardown

The preview environment was automatically torn down as part of the nightly cleanup (23:00 Brussels time).

To resume testing: manually re-trigger the CI Pipeline workflow ("Run workflow" → enter this PR's number) to rebuild images and redeploy the preview environment. Pushing a new commit does not redeploy the preview automatically — it only re-runs the quality-gate checks.

Bumps the github-actions-all group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.4` | `4.37.6` | | [azure/login](https://github.com/azure/login) | `3.0.0` | `3.0.1` | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.20.0` | `2.20.1` | Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f205ea1...5595cca) Updates `github/codeql-action/init` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f205ea1...5595cca) Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f205ea1...5595cca) Updates `azure/login` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@532459e...f5d393a) Updates `step-security/harden-runner` from 2.20.0 to 2.20.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@bf7454d...b09bb98) --- updated-dependencies: - dependency-name: azure/login dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-all - dependency-name: github/codeql-action/analyze dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-all - dependency-name: github/codeql-action/init dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-all - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-all - dependency-name: step-security/harden-runner dependency-version: 2.20.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-all ... Signed-off-by: dependabot[bot] <support@github.com>

…-79abe90513

dependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026

dependabotBot requested review from rajbos and rvanmaanen as code owners August 12, 2026 09:58

dependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026

dependabotBotdeployed to staging August 12, 2026 10:04 View deployment

dependabotBot changed the title ~~Bump the github-actions-all group with 5 updates~~Bump the github-actions-all group across 1 directory with 5 updatesAug 12, 2026

dependabotBotforce-pushed the dependabot/github_actions/github-actions-all-79abe90513 branch from bfb7b55 to b139984Compare August 12, 2026 11:25

Merge branch 'main' into dependabot/github_actions/github-actions-all…
fd5a01b
…-79abe90513

Navigation Menu

Uh oh!

Bump the github-actions-all group across 1 directory with 5 updates - #512

Bump the github-actions-all group across 1 directory with 5 updates#512
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/github-actions-all-79abe90513

dependabotBot commented on behalf of githubAug 12, 2026•
edited
Loading

Uh oh!

github-actionsBot commented Aug 12, 2026•
edited
Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabotBot commented on behalf of githubAug 12, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.37.6

v4.37.5

CodeQL Action Changelog

[UNRELEASED]

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

v4.37.6

v4.37.5

CodeQL Action Changelog

[UNRELEASED]

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

v4.37.6

v4.37.5

CodeQL Action Changelog

[UNRELEASED]

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

Azure Login Action v3.0.1

What's Changed

v2.20.1

What's Changed

Uh oh!

github-actionsBot commented Aug 12, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏰ PR Preview Environment — Nightly Teardown

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabotBot commented on behalf of githubAug 12, 2026•
edited
Loading

github-actionsBot commented Aug 12, 2026•
edited
Loading