Bump the ci group across 1 directory with 6 updates by dependabot[bot] · Pull Request #284 · mathieu-benoit/sail-sharp

dependabot · 2026-09-18T16:09:51Z

Bumps the ci group with 6 updates in the / directory:

Package	From	To
docker/setup-docker-action	`5.4.0`	`5.5.0`
docker/setup-buildx-action	`4.3.0`	`4.4.0`
docker/build-push-action	`7.3.0`	`7.4.0`
docker/github-builder/.github/workflows/build.yml	`1.16.0`	`1.17.0`
score-spec/setup-score	`3.2.4`	`3.2.5`
github/codeql-action/upload-sarif	`4.37.7`	`4.38.0`

Updates docker/setup-docker-action from 5.4.0 to 5.5.0

Release notes

Sourced from docker/setup-docker-action's releases.

v5.5.0

Preserve rootless mode during cleanup by @crazy-max in docker/setup-docker-action#325

Update regctl to v0.11.6 in docker/setup-docker-action#321

Bump @docker/actions-toolkit from 0.93.0 to 0.100.0 in docker/setup-docker-action#311

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/setup-docker-action#322

Bump brace-expansion from 1.1.16 to 1.1.18 in docker/setup-docker-action#314

Bump csv-parse from 7.0.1 to 7.0.2 in docker/setup-docker-action#323

Bump ip-address from 10.2.0 to 10.4.0 in docker/setup-docker-action#315

Bump js-yaml from 4.3.0 to 4.3.2 in docker/setup-docker-action#318 docker/setup-docker-action#324

Bump postcss from 8.5.15 to 8.5.25 in docker/setup-docker-action#313

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-docker-action#320

Bump undici from 6.27.0 to 6.28.1 in docker/setup-docker-action#316

Full Changelog: docker/setup-docker-action@v5.4.0...v5.5.0

Commits

2bf61fb Merge pull request #321 from docker/deps/regctl-version
396ae77 chore(deps): update Regctl version from v0.11.5 to v0.11.6
a657f17 Merge pull request #324 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
8e05055 Merge pull request #325 from crazy-max/fix-rootless-cleanup
84d7134 chore: update generated content
fe741c5 preserve rootless mode during cleanup
b12a697 build(deps): bump js-yaml from 4.3.1 to 4.3.2
57d5b57 Merge pull request #311 from docker/dependabot/npm_and_yarn/docker/actions-to...
cf1375f [dependabot skip] chore: update generated content
4cabdff build(deps): bump @docker/actions-toolkit from 0.93.0 to 0.100.0
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 4.3.0 to 4.4.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.0

Use official Buildx releases for cloud driver by @crazy-max in docker/setup-buildx-action#606

Pull BuildKit image before builder creation by @crazy-max in docker/setup-buildx-action#609

Use shared error helpers for Buildx and Docker commands by @crazy-max in docker/setup-buildx-action#620

Bump @docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614

Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

Commits

594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
bd6e702 chore: update generated content
6268c9d pull BuildKit image before builder creation
e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
533ed8e build(deps): bump the codeql-actions group with 2 updates
bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
d5079fb chore: update generated content
226a616 use shared error helpers for Buildx and Docker commands
77ce7f4 Merge pull request #619 from docker/dependabot/npm_and_yarn/docker/actions-to...
0dc1dc9 [dependabot skip] chore: update generated content
Additional commits viewable in compare view

Updates docker/build-push-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

Use the shared error helper for Buildx commands by @crazy-max in docker/build-push-action#1620

Prevent workflow command injection in metadata logs by @crazy-max in docker/build-push-action#1617

Bump @docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592

Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613

Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615

Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611

Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606

Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577

Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

Commits

c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
459b674 [dependabot skip] chore: update generated content
4dedcb2 chore(deps): Bump @docker/actions-toolkit from 0.99.0 to 0.100.0
379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
9877975 chore: update generated content
7ed0556 use the shared Buildx error summary helper
91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
80dbc86 [dependabot skip] chore: update generated content
50cac3a chore(deps): Bump @docker/actions-toolkit from 0.98.0 to 0.99.0
03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
Additional commits viewable in compare view

Updates docker/github-builder/.github/workflows/build.yml from 1.16.0 to 1.17.0

Release notes

Sourced from docker/github-builder/.github/workflows/build.yml's releases.

v1.17.0

bake: allow the default target input to apply by @crazy-max in docker/github-builder#275

bake: fix missing privateRepo output by @crazy-max in docker/github-builder#274

update github-builder-runtime module to 0.95.0 in docker/github-builder#279

update cosign to v3.1.3 in docker/github-builder#232

update BuildKit Syft Scanner image to 1.12.0 in docker/github-builder#278

update docker/setup-buildx-action from 4.2.0 to 4.3.0 in docker/github-builder#281

Full Changelog: docker/github-builder@v1.16.0...v1.17.0

Commits

58cb9f5 Merge pull request #276 from docker/dependabot/github_actions/crazy-max-dot-g...
db901a8 build(deps): Bump the crazy-max-dot-github group across 1 directory with 2 up...
4ce32a4 Merge pull request #281 from docker/dependabot/github_actions/docker/setup-bu...
6f3b6a7 build(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0
825a075 Merge pull request #279 from docker/deps/docker-github-builder-runtime-module
99e180f chore(deps): update github-builder-runtime module to 0.95.0
543520a Merge pull request #278 from docker/deps/sbom-image
5e30673 chore(deps): update BuildKit Syft Scanner image to 1.12.0
e338501 Merge pull request #232 from docker/deps/cosign-version
e7776b8 chore(deps): update Cosign version to v3.1.3
Additional commits viewable in compare view

Updates score-spec/setup-score from 3.2.4 to 3.2.5

Release notes

Sourced from score-spec/setup-score's releases.

v3.2.5

What's Changed

Bump the ci group across 1 directory with 2 updates by @dependabot[bot] in score-spec/setup-score#109

Bump eslint from 10.6.0 to 10.7.0 in the ci group by @dependabot[bot] in score-spec/setup-score#108

Bump eslint from 10.7.0 to 10.8.0 in the ci group by @dependabot[bot] in score-spec/setup-score#110

Bump the ci group across 1 directory with 2 updates by @dependabot[bot] in score-spec/setup-score#113

Bump step-security/harden-runner from 2.20.0 to 2.20.1 in the ci group by @dependabot[bot] in score-spec/setup-score#111

Bump brace-expansion by @dependabot[bot] in score-spec/setup-score#114

Bump step-security/harden-runner from 2.20.1 to 2.21.0 in the ci group by @dependabot[bot] in score-spec/setup-score#115

Bump eslint from 10.8.1 to 10.9.1 in the ci group by @dependabot[bot] in score-spec/setup-score#116

Bump step-security/harden-runner from 2.21.0 to 2.21.1 in the ci group by @dependabot[bot] in score-spec/setup-score#117

Bump the ci group with 2 updates by @dependabot[bot] in score-spec/setup-score#118

Bump undici from 6.27.0 to 6.28.1 by @dependabot[bot] in score-spec/setup-score#120

Bump @humanfs/node from 0.16.6 to 0.16.8 by @dependabot[bot] in score-spec/setup-score#119

Full Changelog: score-spec/setup-score@v3.2.4...v3.2.5

Commits

433682e Merge pull request #119 from score-spec/dependabot/npm_and_yarn/humanfs/node-...
30bbf6a Merge branch 'main' into dependabot/npm_and_yarn/humanfs/node-0.16.8
f401070 Merge pull request #120 from score-spec/dependabot/npm_and_yarn/undici-6.28.1
2b80781 Bump undici from 6.27.0 to 6.28.1
7365dae Bump @humanfs/node from 0.16.6 to 0.16.8
8e12cd1 Merge pull request #118 from score-spec/dependabot/npm_and_yarn/ci-a652836641
05c32e9 Merge pull request #117 from score-spec/dependabot/github_actions/ci-4c70b186bc
63ea424 Bump the ci group with 2 updates
41e569c Bump step-security/harden-runner from 2.21.0 to 2.21.1 in the ci group
9b08b3e Merge pull request #116 from score-spec/dependabot/npm_and_yarn/ci-d3820027f2
Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.37.7 to 4.38.0

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.0

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
02d5093 Update changelog for v4.38.0
7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
bfcc52b Run slow macOS checks on larger runners
8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
0b7ca40 Add changelog note
40484b3 Update default bundle to codeql-bundle-v2.27.0
977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
40a6b38 Address toolcache cleanup review feedback
deece8f Apply suggestion from @henrymercer
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the ci group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/setup-docker-action](https://github.com/docker/setup-docker-action) | `5.4.0` | `5.5.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.3.0` | `4.4.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` | | [docker/github-builder/.github/workflows/build.yml](https://github.com/docker/github-builder) | `1.16.0` | `1.17.0` | | [score-spec/setup-score](https://github.com/score-spec/setup-score) | `3.2.4` | `3.2.5` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.7` | `4.38.0` | Updates `docker/setup-docker-action` from 5.4.0 to 5.5.0 - [Release notes](https://github.com/docker/setup-docker-action/releases) - [Commits](docker/setup-docker-action@77e84db...2bf61fb) Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@37fe631...594f3bf) Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@53b7df9...c3c9e26) Updates `docker/github-builder/.github/workflows/build.yml` from 1.16.0 to 1.17.0 - [Release notes](https://github.com/docker/github-builder/releases) - [Commits](docker/github-builder@a492c6d...58cb9f5) Updates `score-spec/setup-score` from 3.2.4 to 3.2.5 - [Release notes](https://github.com/score-spec/setup-score/releases) - [Commits](score-spec/setup-score@888a7de...433682e) Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff2f1c6...b96794f) --- updated-dependencies: - dependency-name: docker/setup-docker-action dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/setup-buildx-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/github-builder/.github/workflows/build.yml dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: score-spec/setup-score dependency-version: 3.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-18T16:12:42Z

Overview

Image reference	`my-sample-workload:latest`	`my-sample-workload:latest`
- digest	`752df9357aba`	`752df9357aba`
- tag	`latest`	`latest`
- provenance	`b098976`	`000e7df`
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	56 MB	56 MB
- packages	21	21
Base Image	`dotnet:10.0.10-alpine3.24`	`dotnet:10.0.10-alpine3.24`
- vulnerabilities

Policies (0 improved, 0 worsened)

Health score: my-sample-workload:latest C (61%) → my-sample-workload:latest C (61%)

Policy Name	`my-sample-workload:latest`	`my-sample-workload:latest`	Standing
Default non-root user	✅	✅	No Change
No copyleft licenses	⚠️ 8	⚠️ 8	No Change
No fixable critical or high vulnerabilities	⚠️ 11	⚠️ 11	No Change
No high-profile vulnerabilities	✅	✅	No Change
No outdated base images	⚠️	⚠️	No Change
No unapproved base images	✅	✅	No Change
Supply chain attestations	✅	✅	No Change

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 18, 2026

Navigation Menu

Bump the ci group across 1 directory with 6 updates - #284

Bump the ci group across 1 directory with 6 updates#284
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/ci-6da671e577

dependabot Bot commented on behalf of github Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 18, 2026

v5.5.0

v4.4.0

v7.4.0

v1.17.0

v3.2.5

What's Changed

v4.38.0

v4.37.9

v4.37.8

CodeQL Action Changelog

[UNRELEASED]

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants