Bumps the github-actions group with 3 updates:step-security/harden-runner,tj-actions/changed-files andgithub/codeql-action.
Updatesstep-security/harden-runner from 2.13.0 to 2.13.1
Release notes
Sourced fromstep-security/harden-runner's releases.
v2.13.1
What's Changed
Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.
Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.
Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.
Full Changelog:step-security/harden-runner@v2.13.0...v2.13.1
Commits
f4a75cf Merge pull request#588 from step-security/rc-2695503d0 ci: remove code-review workflow4b250a0 ci: add job to confirm dist is as expected5b0ab6a update dependenciesd11f2c1 fix bug where status code was not being preservedb3fc98e improve error handling for policy store sceanrio92fc5d4 update error messageb61b0a4 policy store improvementse3d3f2b use GitHub release instead of packages646ac01 update agent- Additional commits viewable incompare view
Updatestj-actions/changed-files from 8c14441336bb3d84fd6b7fa83b6d7201c740baf5 to 1ac60965030588f3b867cdd4a3900f37ec99970c
Changelog
Sourced fromtj-actions/changed-files's changelog.
Changelog
47.0.0 - (2025-09-13)
🚀 Features
➖ Remove
- Commit and push step from build job (#2538) (be393a9) - (Tonye Jack)
🔄 Update
- Updated README.md (#2592)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> (3dbc1e1) - (github-actions[bot])
- Updated README.md (#2591)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> (b1ccff8) - (github-actions[bot])
- Updated README.md (#2574)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> (050a3d3) - (github-actions[bot])
📚 Documentation
- Update link to glob patterns (#2590) (a892f50) - (Tonye Jack)
- Add Jellyfrog as a contributor for code, and doc (#2573) (f000a9b) - (allcontributors[bot])
🧪 Testing
⚙️ Miscellaneous Tasks
- deps-dev: Bump jest from 30.0.5 to 30.1.3 (#2655) (9a67555) - (dependabot[bot])
- deps: Bump tj-actions/git-cliff from 2.1.0 to 2.2.0 (#2660) (b67e30d) - (dependabot[bot])
- deps: Bump github/codeql-action from 3.30.2 to 3.30.3 (#2661) (62aef42) - (dependabot[bot])
- deps: Bump github/codeql-action from 3.29.11 to 3.30.2 (#2659) (e874f3c) - (dependabot[bot])
- deps: Bump actions/setup-node from 4.4.0 to 5.0.0 (#2656) (8c14441) - (dependabot[bot])
- deps-dev: Bump
@types/node from 24.3.0 to 24.3.1 (#2657) (e995ac4) - (dependabot[bot]) - deps-dev: Bump
@types/node from 24.2.1 to 24.3.0 (#2649) (3b04099) - (dependabot[bot]) - deps: Bump github/codeql-action from 3.29.9 to 3.29.11 (#2651) (e7b6c97) - (dependabot[bot])
- deps: Bump tj-actions/git-cliff from 2.0.2 to 2.1.0 (#2648) (765d62b) - (dependabot[bot])
- deps: Bump github/codeql-action from 3.29.8 to 3.29.9 (#2647) (2036da1) - (dependabot[bot])
- deps: Bump github/codeql-action from 3.29.7 to 3.29.8 (#2644) (239aef8) - (dependabot[bot])
- deps-dev: Bump
@types/node from 24.2.0 to 24.2.1 (#2645) (a7d5f5f) - (dependabot[bot]) - deps: Bump actions/checkout from 4.2.2 to 5.0.0 (#2646) (5107f3a) - (dependabot[bot])
- deps-dev: Bump
@types/node from 24.1.0 to 24.2.0 (#2640) (f963b3f) - (dependabot[bot]) - deps: Bump actions/download-artifact from 4.3.0 to 5.0.0 (#2641) (f956744) - (dependabot[bot])
... (truncated)
Commits
Updatesgithub/codeql-action from 3.30.1 to 3.30.3
Release notes
Sourced fromgithub/codeql-action's releases.
v3.30.3
CodeQL Action Changelog
See thereleases page for the relevant changes to the CodeQL CLI and language packs.
3.30.3 - 10 Sep 2025
No user facing changes.
See the fullCHANGELOG.md for more information.
v3.30.2
CodeQL Action Changelog
See thereleases page for the relevant changes to the CodeQL CLI and language packs.
3.30.2 - 09 Sep 2025
- Fixed a bug which could cause language autodetection to fail.#3084
- Experimental: The
quality-queries input that was added in3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a newanalysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time.#3064
See the fullCHANGELOG.md for more information.
Changelog
Sourced fromgithub/codeql-action's changelog.
CodeQL Action Changelog
See thereleases page for the relevant changes to the CodeQL CLI and language packs.
[UNRELEASED]
- We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the
codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of thecodeql-action/init step.#3099 and#3100 - We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time.#3107
3.30.3 - 10 Sep 2025
No user facing changes.
3.30.2 - 09 Sep 2025
- Fixed a bug which could cause language autodetection to fail.#3084
- Experimental: The
quality-queries input that was added in3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a newanalysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time.#3064
3.30.1 - 05 Sep 2025
- Update default CodeQL bundle version to 2.23.0.#3077
3.30.0 - 01 Sep 2025
- Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds.#3054
3.29.11 - 21 Aug 2025
- Update default CodeQL bundle version to 2.22.4.#3044
3.29.10 - 18 Aug 2025
No user facing changes.
3.29.9 - 12 Aug 2025
No user facing changes.
3.29.8 - 08 Aug 2025
- Fix an issue where the Action would autodetect unsupported languages such as HTML.#3015
3.29.7 - 07 Aug 2025
This release rolls back 3.29.6 to address issues with language autodetection. It is identical to 3.29.5.
3.29.6 - 07 Aug 2025
- The
cleanup-level input to theanalyze Action is now deprecated. The CodeQL Action has written a limited amount of intermediate results to the database since version 2.2.5, and now automatically manages cleanup.#2999 - Update default CodeQL bundle version to 2.22.3.#3000
... (truncated)
Commits
192325c Merge pull request#3104 from github/update-v3.30.3-b660efdcfe68956d Update changelog for v3.30.3b660efd Merge pull request#3103 from github/mbg/fix/category-checke49458b FixrunInterpretResultsFor using the wrongAnalysisConfig forcategory fixf374a62 Merge pull request#3098 from github/kaspersv/increase-overlay-base-size-limit5efa438 Merge pull request#3101 from github/mbg/public-repo-notice-in-pr-template8a84a62 Overlay: Increase size limit for cached overlay base databaseeb50a88 Merge pull request#3097 from github/redsun82/only-dump-sarif4c53461 Tweak sarif dump logdae3742 Dump soon to be uploaded SARIF on request- Additional commits viewable incompare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting@dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Bumps the github-actions group with 3 updates:step-security/harden-runner,tj-actions/changed-files andgithub/codeql-action.
Updates
step-security/harden-runnerfrom 2.13.0 to 2.13.1Release notes
Sourced fromstep-security/harden-runner's releases.
Commits
f4a75cfMerge pull request#588 from step-security/rc-2695503d0ci: remove code-review workflow4b250a0ci: add job to confirm dist is as expected5b0ab6aupdate dependenciesd11f2c1fix bug where status code was not being preservedb3fc98eimprove error handling for policy store sceanrio92fc5d4update error messageb61b0a4policy store improvementse3d3f2buse GitHub release instead of packages646ac01update agentUpdates
tj-actions/changed-filesfrom 8c14441336bb3d84fd6b7fa83b6d7201c740baf5 to 1ac60965030588f3b867cdd4a3900f37ec99970cChangelog
Sourced fromtj-actions/changed-files's changelog.
... (truncated)
Commits
1ac6096Upgraded to v47 (#2663)24d32ffupgrade: to node24 (#2662)9a67555chore(deps-dev): bump jest from 30.0.5 to 30.1.3 (#2655)b67e30dchore(deps): bump tj-actions/git-cliff from 2.1.0 to 2.2.0 (#2660)62aef42chore(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#2661)e874f3cchore(deps): bump github/codeql-action from 3.29.11 to 3.30.2 (#2659)Updates
github/codeql-actionfrom 3.30.1 to 3.30.3Release notes
Sourced fromgithub/codeql-action's releases.
Changelog
Sourced fromgithub/codeql-action's changelog.
... (truncated)
Commits
192325cMerge pull request#3104 from github/update-v3.30.3-b660efdcfe68956dUpdate changelog for v3.30.3b660efdMerge pull request#3103 from github/mbg/fix/category-checke49458bFixrunInterpretResultsForusing the wrongAnalysisConfigforcategoryfixf374a62Merge pull request#3098 from github/kaspersv/increase-overlay-base-size-limit5efa438Merge pull request#3101 from github/mbg/public-repo-notice-in-pr-template8a84a62Overlay: Increase size limit for cached overlay base databaseeb50a88Merge pull request#3097 from github/redsun82/only-dump-sarif4c53461Tweak sarif dump logdae3742Dump soon to be uploaded SARIF on requestDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions