Skip to content

chore(deps): update github-actions: bump the github-actions-version-updates group with 6 updates#2583

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-version-updates-29e553ce24
Open

chore(deps): update github-actions: bump the github-actions-version-updates group with 6 updates#2583
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-version-updates-29e553ce24

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 5, 2026

Bumps the github-actions-version-updates group with 6 updates:

Package From To
astral-sh/setup-uv 7.3.0 7.3.1
github/codeql-action c0fc915677567258ee3c194d03ffe7ae3dc8d741 b6dfacb528092ed900ca0cfec2957487685c3bfd
actions/setup-node 6.2.0 6.3.0
actions/dependency-review-action 4.8.3 4.9.0
actions/upload-artifact 6.0.0 7.0.0
awslabs/mcp 2026.02.20260224185711 2026.03.20260304183356

Updates astral-sh/setup-uv from 7.3.0 to 7.3.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.3.1 🌈 fall back to VERSION_CODENAME when VERSION_ID is not available

Changes

This release adds support for running in containers like debian:testing or debian:unstable

🐛 Bug fixes

🧰 Maintenance

⬆️ Dependency updates

Commits
  • 5a095e7 Bump github/codeql-action from 4.31.9 to 4.32.2 (#766)
  • b12532f fix: fall back to VERSION_CODENAME when VERSION_ID is not available (#774)
  • 0098a75 chore: update known checksums for 0.10.6 (#771)
  • 2e7ed0e chore: update known checksums for 0.10.5 (#770)
  • 04224aa chore: update known checksums for 0.10.4 (#768)
  • 2bc602f chore: update known checksums for 0.10.3 (#767)
  • dd9d748 chore: update known checksums for 0.10.2 (#765)
  • 14eede1 chore: update known checksums for 0.10.1 (#764)
  • c452423 Bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 (#763)
  • See full diff in compare view

Updates github/codeql-action from c0fc915677567258ee3c194d03ffe7ae3dc8d741 to b6dfacb528092ed900ca0cfec2957487685c3bfd

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.32.5 - 02 Mar 2026

  • Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507
  • Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487
  • The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #3515
  • Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #3516
  • Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #3498
  • Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #3512
  • The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #3503, #3504

4.32.4 - 20 Feb 2026

  • Update default CodeQL bundle version to 2.24.2. #3493
  • Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473
  • When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #3486
  • Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #3485
  • Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. #3484

4.32.3 - 13 Feb 2026

  • Added experimental support for testing connections to private package registries. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. #3466

4.32.2 - 05 Feb 2026

  • Update default CodeQL bundle version to 2.24.1. #3460

4.32.1 - 02 Feb 2026

  • A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422
  • Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

4.32.0 - 26 Jan 2026

  • Update default CodeQL bundle version to 2.24.0. #3425

4.31.11 - 23 Jan 2026

  • When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409
  • Improved error handling throughout the CodeQL Action. #3415
  • Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318
  • The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403

... (truncated)

Commits
  • b6dfacb Merge pull request #3542 from github/henrymercer/parallel-unit-tests
  • 6123416 Merge remote-tracking branch 'origin/main' into henrymercer/parallel-unit-tests
  • a6594f9 Merge pull request #3540 from github/henrymercer/stub-actions-vars
  • 71d7981 Address review comments
  • e9e9733 Merge branch 'main' into henrymercer/stub-actions-vars
  • 8e17ec9 Merge branch 'main' into henrymercer/parallel-unit-tests
  • aae9418 Fix test name
  • 36148cc Run more actions util tests serially
  • a5b959e Merge pull request #3537 from github/henrymercer/overlay-status-record-job
  • d1ac77f Merge pull request #3527 from github/mbg/start-proxy/remove-unused
  • Additional commits viewable in compare view

Updates actions/setup-node from 6.2.0 to 6.3.0

Release notes

Sourced from actions/setup-node's releases.

v6.3.0

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

Commits

Updates actions/dependency-review-action from 4.8.3 to 4.9.0

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

  • There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @​felickz!
  • Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @​jantiebot!
  • There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @​juxtin!

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

Commits
  • 2031cfc Merge pull request #1064 from actions/ahpook/release-4.9.0
  • d02fa39 Updates for release 4.9.0
  • 4038a34 Merge pull request #1021 from actions/dependabot/github_actions/actions/check...
  • a632b83 Merge pull request #1058 from actions/dependabot/github_actions/actions/stale...
  • 57a3d46 Merge pull request #1060 from jantiebot/main
  • 5ecdc4b Merge pull request #1045 from forks-felickz/main
  • e8c2f9a fix: remove inferrable type annotation to pass eslint
  • 0e129e1 Prettier - Refactor summary table rendering for improved readability
  • aa60746 Add 'show-patched-versions' option to configuration and update summary handling
  • e404798 Merge upstream actions/dependency-review-action main
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 6.0.0 to 7.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

Commits

Updates awslabs/mcp from 2026.02.20260224185711 to 2026.03.20260304183356

Release notes

Sourced from awslabs/mcp's releases.

2026.03.20260304183356

What's Changed

New Contributors

Full Changelog: 2026.02.20260224185711...2026.03.20260304183356

Commits
  • 775dc03 chore: bump packages for release/2026.03.20260304183356 (#2565)
  • 58133ab fix(mcp-lambda-handler): resolve Optional[T] to correct JSON Schema type inst...
  • af5845f chore(aws-api-mcp-server): upgrade AWS CLI to v1.44.50 (#2558)
  • 7787df8 feat: enforce MCP tool naming conventions and 64-char limit (#616) (#2467)
  • 836584a fix: update trivy-action to v0.34.2 (#2556)
  • a03b3cb chore(deps): update github-actions: bump the github-actions-version-updates g...
  • d129dd3 fix(dsql): Update broken github links to pass that PR-lint (#2470)
  • cdbab44 feat: add billing conductor tools to billing and cost Management MCP (#2516)
  • b11a945 fix(docs): replace dots with dashes in core and dynamodb MCP server names (#4...
  • 8702fc8 fix: expand http config validation (#2544)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): update github-actions: bump the github-actions-version-u…
0c0a7c0 
…pdates group with 6 updates

Bumps the github-actions-version-updates group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.3.0` | `7.3.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `c0fc915677567258ee3c194d03ffe7ae3dc8d741` | `b6dfacb528092ed900ca0cfec2957487685c3bfd` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.3.0` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.8.3` | `4.9.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.0` |
| [awslabs/mcp](https://github.com/awslabs/mcp) | `2026.02.20260224185711` | `2026.03.20260304183356` |


Updates `astral-sh/setup-uv` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@eac588a...5a095e7)

Updates `github/codeql-action` from c0fc915677567258ee3c194d03ffe7ae3dc8d741 to b6dfacb528092ed900ca0cfec2957487685c3bfd
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c0fc915...b6dfacb)

Updates `actions/setup-node` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@6044e13...53b8394)

Updates `actions/dependency-review-action` from 4.8.3 to 4.9.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@05fe457...2031cfc)

Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@b7c566a...bbbca2d)

Updates `awslabs/mcp` from 2026.02.20260224185711 to 2026.03.20260304183356
- [Release notes](https://github.com/awslabs/mcp/releases)
- [Commits](1184105...775dc03)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-version-updates
- dependency-name: github/codeql-action
  dependency-version: b6dfacb528092ed900ca0cfec2957487685c3bfd
  dependency-type: direct:production
  dependency-group: github-actions-version-updates
- dependency-name: actions/setup-node
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-version-updates
- dependency-name: actions/dependency-review-action
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-version-updates
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-version-updates
- dependency-name: awslabs/mcp
  dependency-version: 2026.03.20260304183356
  dependency-type: direct:production
  dependency-group: github-actions-version-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file or issues from dependenices github_actions Pull requests that update GitHub Actions code labels Mar 5, 2026
@dependabot dependabot bot requested a review from a team as a code owner March 5, 2026 01:59
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file or issues from dependenices label Mar 5, 2026
@dependabot dependabot bot added the github_actions Pull requests that update GitHub Actions code label Mar 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file or issues from dependenices github_actions Pull requests that update GitHub Actions code

Projects

awslabs/mcp Project
Status: To triage

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants