Skip to content

ci: bump the github-actions group across 1 directory with 4 updates - #29

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-87e96867ea
Open

ci: bump the github-actions group across 1 directory with 4 updates#29
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-87e96867ea

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 4 updates in the / directory: crate-ci/typos, step-security/harden-runner, actions/setup-node and zizmorcore/zizmor-action.

Updates crate-ci/typos from 1.49.0 to 1.51.1

Release notes

Sourced from crate-ci/typos's releases.

v1.51.1

[1.51.1] - 2026-10-06

Features

  • Add ARM Windows builds

v1.51.0

[1.51.0] - 2026-10-06

Fixes

  • Don't correct bimap

Features

v1.50.3

[1.50.3] - 2026-09-25

Fixes

  • Don'y panicwhen case-converting non-ASCII corrections

v1.50.2

[1.50.2] - 2026-09-15

Fixes

  • Don't panic when files being examined are removed

v1.50.1

[1.50.1] - 2026-09-01

Fixes

  • Don't correct asend in Python code

v1.50.0

[1.50.0] - 2026-08-28

Features

v1.49.1

[1.49.1] - 2026-08-27

Fixes

... (truncated)

Changelog

Sourced from crate-ci/typos's changelog.

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased] - ReleaseDate

[1.51.1] - 2026-10-06

Features

  • Add ARM Windows builds

[1.51.0] - 2026-10-06

Fixes

  • Don't correct bimap

Features

[1.50.3] - 2026-09-25

Fixes

  • Don'y panicwhen case-converting non-ASCII corrections

[1.50.2] - 2026-09-15

Fixes

  • Don't panic when files being examined are removed

[1.50.1] - 2026-09-01

Fixes

  • Don't correct asend in Python code

[1.50.0] - 2026-08-28

Features

[1.49.1] - 2026-08-27

... (truncated)

Commits
  • 7f9d081 chore: Release
  • 4fc41d7 docs: Update changelog
  • eb4f299 Merge pull request #1602 from meop/ci/platform-release-matrix
  • 7623265 ci: release a win-arm64-msvc artifact
  • cf01e3f ci: match any windows runner when staging the release archive
  • dcea711 chore: Release
  • 73ce342 chore: Release
  • 58d970f docs: Update changelog
  • d59c567 Merge pull request #1634 from epage/bimap
  • 3689e3c fix(dict): Remove bimap from being corrected
  • Additional commits viewable in compare view

Updates step-security/harden-runner from 2.20.1 to 2.22.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.1

What's Changed

  • Fixed security rules not initializing on GHES self-hosted runners
  • Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

What's Changed

  • Linux ARM64 support for community tier
  • GHES support for self-hosted VMs (enterprise tier)
  • MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

v2.21.1

What's Changed

  • Improved performance of the disable-sudo feature.
  • Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
  • Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
  • Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

What's Changed

  • Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
  • Improved Support for AWS CodeBuild GitHub Actions Runners.
  • Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

Commits
  • ccd8616 Merge pull request #704 from h0x0er/jatin/ghes-endp
  • 037ccfd implicitly add ghes endpoint in allowList
  • e7438c7 Merge pull request #703 from h0x0er/jatin/ghes-codebuild-fixes
  • afb0b33 fixes for armour rules not getting initialised
  • 351661c Merge pull request #701 from step-security/rc-44
  • 1dc7f2e Merge pull request #702 from h0x0er/jatin/ghes-changes-up
  • af5ca38 simplified ghes config creation
  • 9a6d710 fix2
  • 74c65ea fix
  • ceac816 resovled comments
  • Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.6.2 to 0.6.4

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.4

Sponsorship is appreciated!

zizmor 1.30.1 is now the default version.

Release notes: zizmorcore/zizmor-action#1301

v0.6.3

zizmor 1.30.0 is now the default version.

Release notes: zizmorcore/zizmor-action#1300

Commits
  • cc914d7 Sync zizmor versions (#166)
  • bae72b7 chore(deps): bump the github-actions group with 2 updates (#165)
  • 27604f9 chore(deps): bump the github-actions group with 2 updates (#164)
  • c41d665 README: bump pins (#163)
  • 70fb788 Sync zizmor versions (#162)
  • 7999d8c chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 in ...
  • 2ae1ce9 chore(deps): bump github/codeql-action/upload-sarif (#160)
  • 951a5ee Skip prerelease versions in sync-zizmor-versions workflow (#158)
  • 79f0191 chore(deps): bump github/codeql-action/upload-sarif (#156)
  • 26a3ae6 sync-zizmor-versions: retry up to 5 times (#155)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci: bump the github-actions group across 1 directory with 4 updates
147ec09 
Bumps the github-actions group with 4 updates in the / directory: [crate-ci/typos](https://github.com/crate-ci/typos), [step-security/harden-runner](https://github.com/step-security/harden-runner), [actions/setup-node](https://github.com/actions/setup-node) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `crate-ci/typos` from 1.49.0 to 1.51.1
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/main/CHANGELOG.md)
- [Commits](crate-ci/typos@8a48f81...7f9d081)

Updates `step-security/harden-runner` from 2.20.1 to 2.22.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@b09bb98...ccd8616)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `zizmorcore/zizmor-action` from 0.6.2 to 0.6.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@3dc1ecc...cc914d7)

---
updated-dependencies:
- dependency-name: crate-ci/typos
  dependency-version: 1.51.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: step-security/harden-runner
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants