Sourced fromstep-security/harden-runner's releases.

v2.13.1

What's Changed

• Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

• Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

• Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog:step-security/harden-runner@v2.13.0...v2.13.1

• f4a75cf Merge pull request#588 from step-security/rc-26
• 95503d0 ci: remove code-review workflow
• 4b250a0 ci: add job to confirm dist is as expected
• 5b0ab6a update dependencies
• d11f2c1 fix bug where status code was not being preserved
• b3fc98e improve error handling for policy store sceanrio
• 92fc5d4 update error message
• b61b0a4 policy store improvements
• e3d3f2b use GitHub release instead of packages
• 646ac01 update agent
• Additional commits viewable incompare view

Sourced fromtj-actions/changed-files's changelog.

Changelog

47.0.0 - (2025-09-13)

🚀 Features

• Add any_added to outputs (#2567) (c260d49) - (Jellyfrog)

➖ Remove

• Commit and push step from build job (#2538) (be393a9) - (Tonye Jack)

🔄 Update

• Updated README.md (#2592)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (3dbc1e1) - (github-actions[bot])

• Updated README.md (#2591)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (b1ccff8) - (github-actions[bot])

• Updated README.md (#2574)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (050a3d3) - (github-actions[bot])

📚 Documentation

• Update link to glob patterns (#2590) (a892f50) - (Tonye Jack)
• Add Jellyfrog as a contributor for code, and doc (#2573) (f000a9b) - (allcontributors[bot])

🧪 Testing

• Manual triggered workflows (#2637) (c2ca249) - (Tonye Jack)

⚙️ Miscellaneous Tasks

• deps-dev: Bump jest from 30.0.5 to 30.1.3 (#2655) (9a67555) - (dependabot[bot])
• deps: Bump tj-actions/git-cliff from 2.1.0 to 2.2.0 (#2660) (b67e30d) - (dependabot[bot])
• deps: Bump github/codeql-action from 3.30.2 to 3.30.3 (#2661) (62aef42) - (dependabot[bot])
• deps: Bump github/codeql-action from 3.29.11 to 3.30.2 (#2659) (e874f3c) - (dependabot[bot])
• deps: Bump actions/setup-node from 4.4.0 to 5.0.0 (#2656) (8c14441) - (dependabot[bot])
• deps-dev: Bump@​types/node from 24.3.0 to 24.3.1 (#2657) (e995ac4) - (dependabot[bot])
• deps-dev: Bump@​types/node from 24.2.1 to 24.3.0 (#2649) (3b04099) - (dependabot[bot])
• deps: Bump github/codeql-action from 3.29.9 to 3.29.11 (#2651) (e7b6c97) - (dependabot[bot])
• deps: Bump tj-actions/git-cliff from 2.0.2 to 2.1.0 (#2648) (765d62b) - (dependabot[bot])
• deps: Bump github/codeql-action from 3.29.8 to 3.29.9 (#2647) (2036da1) - (dependabot[bot])
• deps: Bump github/codeql-action from 3.29.7 to 3.29.8 (#2644) (239aef8) - (dependabot[bot])
• deps-dev: Bump@​types/node from 24.2.0 to 24.2.1 (#2645) (a7d5f5f) - (dependabot[bot])
• deps: Bump actions/checkout from 4.2.2 to 5.0.0 (#2646) (5107f3a) - (dependabot[bot])
• deps-dev: Bump@​types/node from 24.1.0 to 24.2.0 (#2640) (f963b3f) - (dependabot[bot])
• deps: Bump actions/download-artifact from 4.3.0 to 5.0.0 (#2641) (f956744) - (dependabot[bot])

... (truncated)

• 1ac6096 Upgraded to v47 (#2663)
• 24d32ff upgrade: to node24 (#2662)
• 9a67555 chore(deps-dev): bump jest from 30.0.5 to 30.1.3 (#2655)
• b67e30d chore(deps): bump tj-actions/git-cliff from 2.1.0 to 2.2.0 (#2660)
• 62aef42 chore(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#2661)
• e874f3c chore(deps): bump github/codeql-action from 3.29.11 to 3.30.2 (#2659)
• See full diff incompare view

Sourced fromgithub/codeql-action's releases.

v3.30.3

CodeQL Action Changelog

See thereleases page for the relevant changes to the CodeQL CLI and language packs.

3.30.3 - 10 Sep 2025

No user facing changes.

See the fullCHANGELOG.md for more information.

v3.30.2

CodeQL Action Changelog

See thereleases page for the relevant changes to the CodeQL CLI and language packs.

3.30.2 - 09 Sep 2025

• Fixed a bug which could cause language autodetection to fail.#3084
• Experimental: Thequality-queries input that was added in3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a newanalysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time.#3064

See the fullCHANGELOG.md for more information.

Sourced fromgithub/codeql-action's changelog.

CodeQL Action Changelog

See thereleases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from thecodeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of thecodeql-action/init step.#3099 and#3100
• We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time.#3107

3.30.3 - 10 Sep 2025

No user facing changes.

3.30.2 - 09 Sep 2025

• Fixed a bug which could cause language autodetection to fail.#3084
• Experimental: Thequality-queries input that was added in3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a newanalysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time.#3064

3.30.1 - 05 Sep 2025

• Update default CodeQL bundle version to 2.23.0.#3077

3.30.0 - 01 Sep 2025

• Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds.#3054

3.29.11 - 21 Aug 2025

• Update default CodeQL bundle version to 2.22.4.#3044

3.29.10 - 18 Aug 2025

No user facing changes.

3.29.9 - 12 Aug 2025

No user facing changes.

3.29.8 - 08 Aug 2025

• Fix an issue where the Action would autodetect unsupported languages such as HTML.#3015

3.29.7 - 07 Aug 2025

This release rolls back 3.29.6 to address issues with language autodetection. It is identical to 3.29.5.

3.29.6 - 07 Aug 2025

• Thecleanup-level input to theanalyze Action is now deprecated. The CodeQL Action has written a limited amount of intermediate results to the database since version 2.2.5, and now automatically manages cleanup.#2999
• Update default CodeQL bundle version to 2.22.3.#3000

... (truncated)

• 192325c Merge pull request#3104 from github/update-v3.30.3-b660efdcf
• e68956d Update changelog for v3.30.3
• b660efd Merge pull request#3103 from github/mbg/fix/category-check
• e49458b FixrunInterpretResultsFor using the wrongAnalysisConfig forcategory fix
• f374a62 Merge pull request#3098 from github/kaspersv/increase-overlay-base-size-limit
• 5efa438 Merge pull request#3101 from github/mbg/public-repo-notice-in-pr-template
• 8a84a62 Overlay: Increase size limit for cached overlay base database
• eb50a88 Merge pull request#3097 from github/redsun82/only-dump-sarif
• 4c53461 Tweak sarif dump log
• dae3742 Dump soon to be uploaded SARIF on request
• Additional commits viewable incompare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions