Sourced from actions/dependency-review-action's releases.

v4.3.1

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See actions/dependency-review-action#753.

Full Changelog: https://github.com/actions/dependency-review-action/compare/V4.3.0...v4.3.1

v4.3.0

New Features

• The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

• Fix action variable name for scorecard by @​lukehinds in actions/dependency-review-action#735
• Fix extra https:// in summary by @​jhutchings1 in actions/dependency-review-action#748
• Bump typescript from 5.3.3 to 5.4.5 by @​dependabot in actions/dependency-review-action#744
• Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @​dependabot in actions/dependency-review-action#737
• Show denied packages with red X by @​juxtin in actions/dependency-review-action#750
• deny-packages configuration option can deny specified version or all packages by @​febuiles and @​bteng22 in actions/dependency-review-action#733

New Contributors

• @​bteng22 made their first contribution in actions/dependency-review-action#733
• @​lukehinds made their first contribution in actions/dependency-review-action#735

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.5...V4.3.0

• e58c696 Merge pull request #758 from actions/juxtin/prepare-4.3.1
• 9b7c72d Change version to 4.3.1
• 7dcfabf Merge pull request #753 from actions/juxtin/debug-purl
• 5f0808f Validate that deny-packages purls are complete
• fcc66c2 Refine purl parsing and tests
• 1dd418b Basic tests for PURL validation in config
• 6406179 Replace packageurl-js with our own implementation
• 2034bab Bypass purls (mostly) for deny checks
• 7e773b1 Log offending purl
• a346092 Parse purls cautiously in getDeniedChanges
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/checkout's releases.

v4.1.4

What's Changed

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in actions/checkout#1692
• Add dependabot config by @​cory-miller in actions/checkout#1688
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in actions/checkout#1643
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in actions/checkout#1693

Full Changelog: https://github.com/actions/checkout/compare/v4.1.3...v4.1.4

v4.1.3

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in actions/checkout#1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in actions/checkout#1656
• Add SSH user parameter by @​cory-miller in actions/checkout#1685

Full Changelog: https://github.com/actions/checkout/compare/v4.1.2...v4.1.3

Sourced from actions/checkout's changelog.

Changelog

v4.1.4

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in actions/checkout#1692
• Add dependabot config by @​cory-miller in actions/checkout#1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in actions/checkout#1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in actions/checkout#1643

v4.1.3

• Check git version before attempting to disable sparse-checkout by @​jww3 in actions/checkout#1656
• Add SSH user parameter by @​cory-miller in actions/checkout#1685
• Update actions/checkout version in update-main-version.yml by @​jww3 in actions/checkout#1650

v4.1.2

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in actions/checkout#1598

v4.1.1

• Correct link to GitHub Docs by @​peterbe in actions/checkout#1511
• Link to release page from what's new section by @​cory-miller in actions/checkout#1514

v4.1.0

• Add support for partial checkout filters

v4.0.0

• Support fetching without the --progress option
• Update to node20

v3.6.0

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

v3.5.3

• Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in
• Fix typos found by codespell
• Add support for sparse checkouts

v3.5.2

• Fix api endpoint for GHES

v3.5.1

• Fix slow checkout on Windows

v3.5.0

• Add new public key for known_hosts

v3.4.0

• Upgrade codeql actions to v2
• Upgrade dependencies
• Upgrade @​actions/io

... (truncated)

• 0ad4b8f Prep Release v4.1.4 (#1704)
• 43045ae Disable extensions.worktreeConfig when disabling sparse-checkout (#1692)
• 37b0821 Bump the minor-actions-dependencies group with 2 updates (#1693)
• 9839dc1 Add dependabot config (#1688)
• 9b4c13b Bump word-wrap from 1.2.3 to 1.2.5 (#1643)
• 1d96c77 Add SSH user parameter (#1685)
• cd7d8d6 Check git version before attempting to disable sparse-checkout (#1656)
• 8410ad0 Update actions/checkout version in update-main-version.yml (#1650)
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.25.2 - 22 Apr 2024

No user facing changes.

3.25.1 - 17 Apr 2024

• We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuild build mode. #2235
• Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. #2245

3.25.0 - 15 Apr 2024

• The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224

  As a result, the following inputs and environment variables are now ignored:

  • The setup-python-dependencies input to the init Action
  • The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable

  We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.

• Automatically overwrite an existing database if found on the filesystem. #2229

• Bump the minimum CodeQL bundle version to 2.12.6. #2232

• A more relevant log message and a diagnostic are now emitted when the file program is not installed on a Linux runner, but is required for Go tracing to succeed. #2234

3.24.10 - 05 Apr 2024

• Update default CodeQL bundle version to 2.17.0. #2219
• Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. #2220
  • If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
  • Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace github/codeql-action/*@v3 by github/codeql-action/*@v3.24.10 and github/codeql-action/*@v2 by github/codeql-action/*@v2.24.10 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

3.24.9 - 22 Mar 2024

• Update default CodeQL bundle version to 2.16.5. #2203

3.24.8 - 18 Mar 2024

• Improve the ease of debugging extraction issues by increasing the verbosity of the extractor logs when running in debug mode. #2195

3.24.7 - 12 Mar 2024

... (truncated)

• 8f596b4 Merge pull request #2254 from github/update-v3.25.2-4909c1ffb
• de8916e Update changelog for v3.25.2
• 4909c1f Bump the npm group with 3 updates (#2253)
• f45390c Merge pull request #2252 from github/henrymercer/failed-external-repo-config-...
• 1be8c48 Add configuration error for failing to clone external Git repo
• 82edfe2 Merge pull request #2246 from github/koesie10/remove-incorrect-log
• 8786e1f Merge pull request #2249 from github/mergeback/v3.25.1-to-main-c7f91257
• 3c7ac61 Update checked-in dependencies
• b5bd9be Update changelog and version after v3.25.1
• c7f9125 Merge pull request #2248 from github/update-v3.25.1-c4fb45143
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/checkout's releases.

v4.1.3

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in actions/checkout#1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in actions/checkout#1656
• Add SSH user parameter by @​cory-miller in actions/checkout#1685

Full Changelog: https://github.com/actions/checkout/compare/v4.1.2...v4.1.3

• 1d96c77 Add SSH user parameter (#1685)
• cd7d8d6 Check git version before attempting to disable sparse-checkout (#1656)
• 8410ad0 Update actions/checkout version in update-main-version.yml (#1650)
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/upload-artifact's releases.

v4.3.2

What's Changed

• Update release-new-action-version.yml by @​konradpabjan in actions/upload-artifact#516
• Minor fix to the migration readme by @​andrewakim in actions/upload-artifact#523
• Update readme with v3/v2/v1 deprecation notice by @​robherley in actions/upload-artifact#561
• updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @​eggyhead in actions/upload-artifact#562

New Contributors

• @​andrewakim made their first contribution in actions/upload-artifact#523

Full Changelog: https://github.com/actions/upload-artifact/compare/v4.3.1...v4.3.2

• 1746f4a Revert "updating to release 4.3.2"
• 31685d0 updating to release 4.3.2
• 18bf333 Merge pull request #562 from actions/eggyhead/update-artifact-v215
• dac413b update package lock version
• bb3b4a3 updating package version
• 3e3da83 updating artifact and core dependencies
• e35774f Merge pull request #561 from actions/robherley/deprecation-notice
• e63ea67 Update readme with v3/v2/v1 deprecation notice
• ef09cda Merge pull request #523 from andrewakim/andrewakim/migration-readme-fix
• 00e36f9 Minor fix to the migration readme
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.25.1 - 17 Apr 2024

• We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuild build mode. #2235
• Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. #2245

3.25.0 - 15 Apr 2024

• The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224

  As a result, the following inputs and environment variables are now ignored:

  • The setup-python-dependencies input to the init Action
  • The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable

  We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.

• Automatically overwrite an existing database if found on the filesystem. #2229

• Bump the minimum CodeQL bundle version to 2.12.6. #2232

• A more relevant log message and a diagnostic are now emitted when the file program is not installed on a Linux runner, but is required for Go tracing to succeed. #2234

3.24.10 - 05 Apr 2024

• Update default CodeQL bundle version to 2.17.0. #2219
• Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. #2220
  • If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
  • Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace github/codeql-action/*@v3 by github/codeql-action/*@v3.24.10 and github/codeql-action/*@v2 by github/codeql-action/*@v2.24.10 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

3.24.9 - 22 Mar 2024

• Update default CodeQL bundle version to 2.16.5. #2203

3.24.8 - 18 Mar 2024

• Improve the ease of debugging extraction issues by increasing the verbosity of the extractor logs when running in debug mode. #2195

3.24.7 - 12 Mar 2024

• Update default CodeQL bundle version to 2.16.4. #2185

3.24.6 - 29 Feb 2024

... (truncated)

• c7f9125 Merge pull request #2248 from github/update-v3.25.1-c4fb45143
• 1c7e8b2 Update changelog for v3.25.1
• c4fb451 Merge pull request #2245 from github/henrymercer/ignore-already-specified-flags
• 556b3bc Add changelog note
• ef66aea Merge branch 'main' into henrymercer/ignore-already-specified-flags
• 9b87e0a Merge pull request #2241 from github/nickfyson/speculative-script-fix
• 18111b6 Merge pull request #2235 from github/henrymercer/autobuild-with-direct-tracing
• ade98b9 Ensure --overwrite flag is only passed once
• 8566d50 Add regression test for double --overwrite
• 453a956 Merge pull request #2243 from github/dependabot/npm_and_yarn/npm-9b31496ffc
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

• The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224

  As a result, the following inputs and environment variables are now ignored:

  • The setup-python-dependencies input to the init Action
  • The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable

  We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.

• Automatically overwrite an existing database if found on the filesystem. #2229

• Bump the minimum CodeQL bundle version to 2.12.6. #2232

• A more relevant log message and a diagnostic are now emitted when the file program is not installed on a Linux runner, but is required for Go tracing to succeed. #2234

3.24.10 - 05 Apr 2024

• Update default CodeQL bundle version to 2.17.0. #2219
• Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. #2220
  • If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
  • Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace github/codeql-action/*@v3 by github/codeql-action/*@v3.24.10 and github/codeql-action/*@v2 by github/codeql-action/*@v2.24.10 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

3.24.9 - 22 Mar 2024

• Update default CodeQL bundle version to 2.16.5. #2203

3.24.8 - 18 Mar 2024

• Improve the ease of debugging extraction issues by increasing the verbosity of the extractor logs when running in debug mode. #2195

3.24.7 - 12 Mar 2024

• Update default CodeQL bundle version to 2.16.4. #2185

3.24.6 - 29 Feb 2024

No user facing changes.

3.24.5 - 23 Feb 2024

• Update default CodeQL bundle version to 2.16.3. #2156

3.24.4 - 21 Feb 2024

• Fix an issue where an existing, but empty, /sys/fs/cgroup/cpuset.cpus file always resulted in a single-threaded run. #2151

... (truncated)

• df5a14d Merge pull request #2238 from github/update-v3.25.0-2b2cee522
• 3f70eaa Update changelog for v3.25.0
• 2b2cee5 Merge pull request #2234 from github/mbg/clearer-file-command-failure
• 4fcf7a2 Add changelog entry
• d30d1ca Merge pull request #2237 from github/henrymercer/more-configuration-errors
• 5558536 Add configuration error for unsupported build mode
• fa75c14 Capture rate limit and ref not existing config errors
• 5a599c6 Merge pull request #2236 from github/henrymercer/feature-flags-with-tool-feat...
• 829376a Allow feature flags to specify tool feature requirements
• efc4746 Downgrade log levels for some messages to debug
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/dependency-review-action's releases.

4.2.5

What's Changed

• Fixed a bug where some configuration options in external files were not being properly picked up -- actions/dependency-review-action#722
• Bump eslint from 8.56.0 to 8.57.0

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.4...v4.2.5

v4.2.4

What's Changed

Fixed a bug in the output of OpenSSF cards for GitHub Actions.

New Contributors

• @​sporkmonger made their first contribution in actions/dependency-review-action#721

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.3...v4.2.4

4.2.3

What's Changed

• Set comment as output by @​jsoref in actions/dependency-review-action#698
• Add support for calculating OpenSSF Scorecards by @​jhutchings1 in actions/dependency-review-action#709
• Add outputs for the changes data by @​laughedelic in actions/dependency-review-action#707

New Contributors

• @​jhutchings1 made their first contribution in actions/dependency-review-action#709
• @​laughedelic made their first contribution in actions/dependency-review-action#707

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.1.3...v4.2.3

4.1.3

Fixes a bug in 4.1.2 that would introduce comments in every pull request, regardless of the user's configuration (see actions/dependency-review-action#697).

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.1.2...v4.1.3

4.1.2

What's Changed

• Expose dependency comment content by @​jsoref in actions/dependency-review-action#696

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.1.1...v4.1.2

4.1.1

What's Changed

• Bump undici to fix GHSA-wqq4-5wpv-mx2g
• Bump @​types/node from 20.11.17 to 20.11.19 by @​dependabot in actions/dependency-review-action#693

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.1.0...v4.1.1

4.1.0

... (truncated)

• 5bbc3ba bumping version
• c59184a Merge pull request #722 from actions/remove-warn-default
• 54c0657 Merge pull request #728 from actions/dependabot/npm_and_yarn/eslint-8.57.0
• 21941b5 Bump eslint from 8.56.0 to 8.57.0
• 733dd5d bumping to 4.2.4
• 9093495 Merge pull request #725 from actions/issue-718
• 35b83b4 Fix prettier issues
• e057056 Add packaged code update
• d684d03 Add trailing slash to tests
• 2b0aaf1 Fix extra slash issue
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/upload-artifact's releases.

v4.3.1

• Bump @​actions/artifacts to latest version to include updated GHES host check

v4.3.0

What's Changed

• Reorganize upload code in prep for merge logic & add more tests by @​robherley in actions/upload-artifact#504
• Add sub-action to merge artifacts by @​robherley in actions/upload-artifact#505

Full Changelog: https://github.com/actions/upload-artifact/compare/v4...v4.3.0

v4.2.0

What's Changed

• Ability to overwrite an Artifact by @​robherley in actions/upload-artifact#501

Full Changelog: https://github.com/actions/upload-artifact/compare/v4...v4.2.0

v4.1.0

What's Changed

• Add migrations docs by @​robherley in actions/upload-artifact#482
• Update README.md by @​samuelwine in actions/upload-artifact#492
• Support artifact-url output by @​konradpabjan in actions/upload-artifact#496
• Update readme to reflect new 500 artifact per job limit by @​robherley in actions/upload-artifact#497

New Contributors

• @​samuelwine made their first contribution in actions/upload-artifact#492

Full Changelog: https://github.com/actions/upload-artifact/compare/v4...v4.1.0

v4.0.0

What's Changed

The release of upload-artifact@v4 and download-artifact@v4 are major changes to the backend architecture of Artifacts. They have numerous performance and behavioral improvements.

ℹ️ However, this is a major update that includes breaking changes. Artifacts created with versions v3 and below are not compatible with the v4 actions. Uploads and downloads must use the same major actions versions. There are also key differences from previous versions that may require updates to your workflows.

For more information, please see:

1. The changelog post.
2. The README.
3. The migration documentation.
4. As well as the underlying npm package, @​actions/artifact documentation.

New Contributors

• @​vmjoseph made their first contribution in actions/upload-artifact#464

Full Changelog: https://github.com/actions/upload-artifact/compare/v3...v4.0.0

v3.1.3

What's Changed

... (truncated)

• 5d5d22a Merge pull request #515 from actions/eggyhead/update-artifact-v2.1.1
• f1e993d update artifact license
• 4881bfd updating dist:
• a30777e @​eggyhead
• 3a80482 Merge pull request #511 from actions/robherley/migration-docs-typo
• 9d63e3f Merge branch 'main' into robherley/migration-docs-typo
• dfa1ab2 fix typo with v3 artifact downloads in migration guide
• d00351b Merge pull request #509 from markmssd/patch-1
• 707f5a7 Update limitation of 10 artifacts upload to 500
• 26f96df Merge pull request #505 from actions/robherley/merge-artifacts
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/checkout's releases.

v4.1.2

We are investigating the following issue with this release and have rolled-back the v4 tag to point to v4.1.1

• sparse-checkout is not available on git versions prior to 2.27.0 (see actions/checkout#1651)

What's Changed

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in actions/checkout#1598
• Bump tough-cookie from 4.0.0 to 4.1.3 by @​dependabot in actions/checkout#1406
• Bump @​babel/traverse from 7.20.5 to 7.24.0 by @​dependabot in actions/checkout#1642

New Contributors

• @​jww3 made their first contribution in actions/checkout#1616

Full Changelog: https://github.com/actions/checkout/compare/v4.1.1...v4.1.2

v4.1.1

What's Changed

• Update CODEOWNERS to Launch team by @​joshmgross in actions/checkout#1510
• Correct link to GitHub Docs by @​peterbe in actions/checkout#1511
• Link to release page from what's new section by @​cory-miller in actions/checkout#1514

New Contributors

• @​joshmgross made their first contribution in actions/checkout#1510
• @​peterbe made their first contribution in actions/checkout#1511

Full Changelog: https://github.com/actions/checkout/compare/v4.1.0...v4.1.1

v4.1.0

What's Changed

• Update README.md for V4 by @​sivapalan in actions/checkout#1452
• Add support for partial checkout filters by @​finleygn in actions/checkout#1396
• Prepare 4.1.0 release by @​cory-miller in actions/checkout#1496

New Contributors

• @​sivapalan made their first contribution in actions/checkout#1452
• @​finleygn made their first contribution in actions/checkout#1396

Full Changelog: https://github.com/actions/checkout/compare/v4.0.0...v4.1.0

v4.0.0

What's Changed

• Update default runtime to node20 by @​takost in actions/checkout#1436
• Support fetching without the --progress option by @​simonbaird in actions/checkout#1067
• Release 4.0.0 by @​takost in actions/checkout#1447

New Contributors

• @​takost made their first contribution in actions/checkout#1436
• @​simonbaird made their first contribution in actions/checkout#1067

Full Changelog: https://github.com/actions/checkout/compare/v3...v4.0.0

Sourced from actions/checkout's changelog.

Changelog

v4.1.2

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in actions/checkout#1598

v4.1.1

• Correct link to GitHub Docs by @​peterbe in actions/checkout#1511
• Link to release page from what's new section by @​cory-miller in actions/checkout#1514

v4.1.0

• Add support for partial checkout filters

v4.0.0

• Support fetching without the --progress option
• Update to node20

v3.6.0

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

v3.5.3

• Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in
• Fix typos found by codespell
• Add support for sparse checkouts

v3.5.2

• Fix api endpoint for GHES

v3.5.1

• Fix slow checkout on Windows

v3.5.0

• Add new public key for known_hosts

v3.4.0

• Upgrade codeql actions to v2
• Upgrade dependencies
• Upgrade @​actions/io

v3.3.0

• Implement branch list using callbacks from exec function
• Add in explicit reference to private checkout options
• [Fix comment typos (that got added in #770)](actions/checkout#1057)

v3.2.0

• Add GitHub Action to perform release
• Fix status badge
• Replace datadog/squid with ubuntu/squid Docker image
• Wrap pipeline commands for submoduleForeach in quotes
• Update @​actions/io to 1.1.2

... (truncated)

• 9bb5618 Prep for release of v4.1.2 (#1649)
• 8eb1f6a Bump @​babel/traverse from 7.20.5 to 7.24.0 (#1642)
• 556e4c3 Bump tough-cookie from 4.0.0 to 4.1.3 (#1406)
• b32f140 Warn on attempts to publish test-ubuntu-git from non-main branch. (#1623)
• 2650dbd Give test-ubuntu-git its own README (#1620)
• aadec89 Explicitly disable sparse checkout unless asked for (#1598)
• df0bcdd Refine workflow for generating test-ubuntu-git (#1617)
• 473055b Create test-ubuntu-git Docker Container for Proxy Tests (#1616)
• b4ffde6 Link to release page from what's new section (#1514)
• 8530928 Correct link to GitHub Docs (#1511)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.24.10 - 05 Apr 2024

• Update default CodeQL bundle version to 2.17.0. #2219
• Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. #2220
  • If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
  • Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace github/codeql-action/*@v3 by github/codeql-action/*@v3.24.10 and github/codeql-action/*@v2 by github/codeql-action/*@v2.24.10 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

3.24.9 - 22 Mar 2024

• Update default CodeQL bundle version to 2.16.5. #2203

3.24.8 - 18 Mar 2024

• Improve the ease of debugging extraction issues by increasing the verbosity of the extractor logs when running in debug mode. #2195

3.24.7 - 12 Mar 2024

• Update default CodeQL bundle version to 2.16.4. #2185

3.24.6 - 29 Feb 2024

No user facing changes.

3.24.5 - 23 Feb 2024

• Update default CodeQL bundle version to 2.16.3. #2156

3.24.4 - 21 Feb 2024

• Fix an issue where an existing, but empty, /sys/fs/cgroup/cpuset.cpus file always resulted in a single-threaded run. #2151

3.24.3 - 15 Feb 2024

• Fix an issue where the CodeQL Action would fail to load a configuration specified by the config input to the init Action. #2147

3.24.2 - 15 Feb 2024

• Enable improved multi-threaded performance on larger runners for GitHub Enterprise Server users. This feature is already available to GitHub.com users. #2141

3.24.1 - 13 Feb 2024

... (truncated)

• 4355270 Merge pull request #2226 from github/update-v3.24.10-7df281f2f
• 3f041c5 Update changelog for v3.24.10
• 7df281f Gracefully continue if createStatusReportBase throws (#2225)
• f421cda Run integration test PR checks nightly (#2222)
• 5f535de Merge pull request #2221 from github/nickfyson/upload-logging
• 278465c Merge pull request #2219 from github/update-bundle/codeql-bundle-v2.17.0
• 65e69c8 Merge branch 'main' into update-bundle/codeql-bundle-v2.17.0
• c037115 clarify logging in response to pr review comments
• d3c32a8 fix test to respect updated logging behaviour
• 2654062 Merge branch 'main' into nickfyson/upload-logging
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/checkout's releases.

v4.1.5

What's Changed

• Update NPM dependencies by @​cory-miller in actions/checkout#1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in actions/checkout#1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in actions/checkout#1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in actions/checkout#1695
• README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @​cory-miller in actions/checkout#1707

Full Changelog: https://github.com/actions/checkout/compare/v4.1.4...v4.1.5

v4.1.4

What's Changed

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in actions/checkout#1692
• Add dependabot config by @​cory-miller in actions/checkout#1688
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in actions/checkout#1643
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in actions/checkout#1693

Full Changelog: https://github.com/actions/checkout/compare/v4.1.3...v4.1.4

v4.1.3

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in actions/checkout#1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in actions/checkout#1656
• Add SSH user parameter by @​cory-miller in actions/checkout#1685

Full Changelog: https://github.com/actions/checkout/compare/v4.1.2...v4.1.3

Sourced from actions/checkout's changelog.

Changelog

v4.1.4

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in actions/checkout#1692
• Add dependabot config by @​cory-miller in actions/checkout#1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in actions/checkout#1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in actions/checkout#1643

v4.1.3

• Check git version before attempting to disable sparse-checkout by @​jww3 in actions/checkout#1656
• Add SSH user parameter by @​cory-miller in actions/checkout#1685
• Update actions/checkout version in update-main-version.yml by @​jww3 in actions/checkout#1650

v4.1.2

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in actions/checkout#1598

v4.1.1

• Correct link to GitHub Docs by @​peterbe in actions/checkout#1511
• Link to release page from what's new section by @​cory-miller in actions/checkout#1514

v4.1.0

• Add support for partial checkout filters

v4.0.0

• Support fetching without the --progress option
• Update to node20

v3.6.0

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

v3.5.3

• Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in
• Fix typos found by codespell
• Add support for sparse checkouts

v3.5.2

• Fix api endpoint for GHES

v3.5.1

• Fix slow checkout on Windows

v3.5.0

• Add new public key for known_hosts

v3.4.0

• Upgrade codeql actions to v2
• Upgrade dependencies
• Upgrade @​actions/io

... (truncated)

• 44c2b7a README: Suggest user.email to be `41898282+github-actions[bot]@​users.norepl...
• 8459bc0 Bump actions/upload-artifact from 2 to 4 (#1695)
• 3f603f6 Bump actions/setup-node from 1 to 4 (#1696)
• fd084cd Bump github/codeql-action from 2 to 3 (#1694)
• 9c1e94e Update NPM dependencies (#1703)
• 0ad4b8f Prep Release v4.1.4 (#1704)
• 43045ae Disable extensions.worktreeConfig when disabling sparse-checkout (#1692)
• 37b0821 Bump the minor-actions-dependencies group with 2 updates (#1693)
• 9839dc1 Add dependabot config (#1688)
• 9b4c13b Bump word-wrap from 1.2.3 to 1.2.5 (#1643)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/dependency-review-action's releases.

v4.3.2

What's Changed

• Fix package-url parsing for allow-dependencies-licenses by @​juxtin in actions/dependency-review-action#761

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.3.1...v4.3.2

v4.3.1

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See actions/dependency-review-action#753.

Full Changelog: https://github.com/actions/dependency-review-action/compare/V4.3.0...v4.3.1

v4.3.0

New Features

• The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

• Fix action variable name for scorecard by @​lukehinds in actions/dependency-review-action#735
• Fix extra https:// in summary by @​jhutchings1 in actions/dependency-review-action#748
• Bump typescript from 5.3.3 to 5.4.5 by @​dependabot in actions/dependency-review-action#744
• Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @​dependabot in actions/dependency-review-action#737
• Show denied packages with red X by @​juxtin in actions/dependency-review-action#750
• deny-packages configuration option can deny specified version or all packages by @​febuiles and @​bteng22 in actions/dependency-review-action#733

New Contributors

• @​bteng22 made their first contribution in actions/dependency-review-action#733
• @​lukehinds made their first contribution in actions/dependency-review-action#735

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.5...V4.3.0

• 0c155c5 Merge pull request #762 from actions/juxtin/prepare-4.3.2
• f3dac32 Merge pull request #761 from actions/juxtin/fix-allow-dependencies-licenses
• d0d5cc3 Update version number to 4.3.2
• 49fbbe0 Fix package-url parsing for allow-dependencies-licenses
• e58c696 Merge pull request #758 from actions/juxtin/prepare-4.3.1
• 9b7c72d Change version to 4.3.1
• 7dcfabf Merge pull request #753 from actions/juxtin/debug-purl
• 5f0808f Validate that deny-packages purls are complete
• fcc66c2 Refine purl parsing and tests
• 1dd418b Basic tests for PURL validation in config
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from step-security/harden-runner's releases.

v2.7.1

What's Changed

Release v2.7.1 by @​varunsh-coder, @​h0x0er, @​ashishkurmi in step-security/harden-runner#397 This release:

• Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
• Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
• Addresses minor bugs

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.7.0...v2.7.1

• a4aa98b Release v2.7.1 (#397)
• 6c3b1c9 Merge pull request #379 from step-security/dependabot/github_actions/step-sec...
• 3498091 Bump step-security/harden-runner from 2.6.1 to 2.7.0
• 63a88e2 Merge pull request #378 from step-security/update-readme3
• 07e5965 Update README
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.25.3 - 25 Apr 2024

• Update default CodeQL bundle version to 2.17.1. #2247
• Workflows running on macos-latest using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as macos-12. ARM machines with SIP disabled, including the newest macos-latest image, are unsupported for CLI versions before 2.15.1. #2261

3.25.2 - 22 Apr 2024

No user facing changes.

3.25.1 - 17 Apr 2024

• We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuild build mode. #2235
• Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. #2245

3.25.0 - 15 Apr 2024

• The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224

  As a result, the following inputs and environment variables are now ignored:

  • The setup-python-dependencies input to the init Action
  • The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable

  We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.

• Automatically overwrite an existing database if found on the filesystem. #2229

• Bump the minimum CodeQL bundle version to 2.12.6. #2232

• A more relevant log message and a diagnostic are now emitted when the file program is not installed on a Linux runner, but is required for Go tracing to succeed. #2234

3.24.10 - 05 Apr 2024

• Update default CodeQL bundle version to 2.17.0. #2219
• Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. #2220
  • If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
  • Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace github/codeql-action/*@v3 by github/codeql-action/*@v3.24.10 and github/codeql-action/*@v2 by github/codeql-action/*@v2.24.10 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

3.24.9 - 22 Mar 2024

• Update default CodeQL bundle version to 2.16.5. #2203

3.24.8 - 18 Mar 2024

... (truncated)

• d39d31e Merge pull request #2262 from github/update-v3.25.3-ac2f82a1f
• a727825 Move changenote to most recent section
• 1efa859 Update changelog for v3.25.3
• ac2f82a Log warning if SIP is disabled and CLI version is < 2.15.1 (#2261)
• 0ad7791 Merge pull request #2247 from github/update-bundle/codeql-bundle-v2.17.1
• 79d9ee7 Merge branch 'main' into update-bundle/codeql-bundle-v2.17.1
• dbf2b17 Merge pull request #2255 from github/mergeback/v3.25.2-to-main-8f596b4a
• ff6a3c4 Update checked-in dependencies
• 619dc0c Update changelog and version after v3.25.2
• 8f596b4 Merge pull request #2254 from github/update-v3.25.2-4909c1ffb
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Sourced from actions/upload-artifact's releases.

v4.3.3

What's Changed

• updating @actions/artifact dependency to v2.1.6 by @​eggyhead in actions/upload-artifact#565

Full Changelog: https://github.com/actions/upload-artifact/compare/v4.3.2...v4.3.3

v4.3.2

What's Changed

• Update release-new-action-version.yml by @​konradpabjan in actions/upload-artifact#516
• Minor fix to the migration readme by @​andrewakim in actions/upload-artifact#523
• Update readme with v3/v2/v1 deprecation notice by @​robherley in actions/upload-artifact#561
• updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @​eggyhead in actions/upload-artifact#562

New Contributors

• @​andrewakim made their first contribution in actions/upload-artifact#523

Full Changelog: https://github.com/actions/upload-artifact/compare/v4.3.1...v4.3.2

• 6546280 updating package version
• c004fb4 Merge branch 'main' into eggyhead/use-artifact-v2.1.6
• 90aba49 updating toolkit artifact dependency to 2.1.6
• b06cde3 Merge pull request #563 from actions/eggyhead/release-4.3.2
• 1746f4a Revert "updating to release 4.3.2"
• 31685d0 updating to release 4.3.2
• 18bf333 Merge pull request #562 from actions/eggyhead/update-artifact-v215
• dac413b update package lock version
• bb3b4a3 updating package version
• 3e3da83 updating artifact and core dependencies
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)