chore(deps): bump the github-actions group across 2 directories with 9 updates by dependabot[bot] · Pull Request #10495 · aquasecurity/trivy

dependabot · 2026-04-08T10:52:47Z

Bumps the github-actions group with 8 updates in the / directory:

Package	From	To
actions/cache	`5.0.3`	`5.0.4`
actions/upload-artifact	`6.0.0`	`7.0.0`
azure/setup-helm	`4.3.1`	`5.0.0`
sigstore/cosign-installer	`4.0.0`	`4.1.1`
docker/setup-qemu-action	`3.7.0`	`4.0.0`
docker/setup-buildx-action	`3.12.0`	`4.0.0`
docker/build-push-action	`6.19.2`	`7.0.0`
docker/setup-docker-action	`4.7.0`	`5.0.0`

Bumps the github-actions group with 1 update in the /.github/actions/setup-go directory: actions/setup-go.

Updates actions/cache from 5.0.3 to 5.0.4

Release notes

Sourced from actions/cache's releases.

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

6682284 Merge pull request #1738 from actions/prepare-v5.0.4
e340396 Update RELEASES
8a67110 Add licenses
1865903 Update dependencies & patch security vulnerabilities
5656298 Merge pull request #1722 from RyPeck/patch-1
4e380d1 Fix cache key in examples.md for bun.lock
b7e8d49 Merge pull request #1701 from actions/Link-/fix-proxy-integration-tests
984a21b Add traffic sanity check step
acf2f1f Fix resolution
95a07c5 Add wait for proxy
Additional commits viewable in compare view

Updates actions/upload-artifact from 6.0.0 to 7.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

Commits

bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
02a8460 Add proxy integration test
See full diff in compare view

Updates azure/setup-helm from 4.3.1 to 5.0.0

Release notes

Sourced from azure/setup-helm's releases.

v5.0.0

Changed

#259 Update Node.js runtime from node20 to node24

#263 Bump undici

#257 Bump undici and @actions/http-client

#256 Bump minimatch

#248 Bump the actions group with 2 updates

#247 Bump the actions group with 3 updates

#246 Bump @types/node from 25.0.2 to 25.0.3 in the actions group

#245 Bump the actions group with 3 updates

#243 Bump the actions group with 2 updates

#240 Bump prettier from 3.6.2 to 3.7.3 in the actions group

#229 Bump the actions group across 1 directory with 3 updates

#231 Bump js-yaml from 3.14.1 to 3.14.2

#234 Bump glob from 10.4.5 to 10.5.0

#225 Fix build error

#222 Bump @types/node from 24.7.2 to 24.8.1 in the actions group

#220 Bump the actions group across 1 directory with 4 updates

#216 Bump the actions group across 1 directory with 4 updates

#213 Bump the actions group with 2 updates

#211 Bump undici

#212 Bump jest from 30.0.5 to 30.1.2 in the actions group

#210 Bump @types/node from 24.2.1 to 24.3.0 in the actions group

Changelog

Sourced from azure/setup-helm's changelog.

Change Log

[5.0.0] - 2026-03-23

Changed

#259 Update Node.js runtime from node20 to node24

#263 Bump undici

#257 Bump undici and @actions/http-client

#256 Bump minimatch

#248 Bump the actions group with 2 updates

#247 Bump the actions group with 3 updates

#246 Bump @types/node from 25.0.2 to 25.0.3 in the actions group

#245 Bump the actions group with 3 updates

#243 Bump the actions group with 2 updates

#240 Bump prettier from 3.6.2 to 3.7.3 in the actions group

#229 Bump the actions group across 1 directory with 3 updates

#231 Bump js-yaml from 3.14.1 to 3.14.2

#234 Bump glob from 10.4.5 to 10.5.0

#225 Fix build error

#222 Bump @types/node from 24.7.2 to 24.8.1 in the actions group

#220 Bump the actions group across 1 directory with 4 updates

#216 Bump the actions group across 1 directory with 4 updates

#213 Bump the actions group with 2 updates

#211 Bump undici

#212 Bump jest from 30.0.5 to 30.1.2 in the actions group

#210 Bump @types/node from 24.2.1 to 24.3.0 in the actions group

[4.3.1] - 2025-08-12

Changed

#167 Pinning Action Dependencies for Security and Reliability

#181 Fix types, and update node version.

#191 chore(tests): Mock arch to make tests pass on arm host

#192 chore: remove unnecessary prebuild script

#203 Update helm version retrieval to use JSON output for latest version

#207 ci(workflows): update helm version to v3.18.4 and add matrix for tests

Added

#197 Add pre-commit hook

[4.3.0] - 2025-02-15

#152 feat: log when restoring from cache

#157 Dependencies Update

#137 Add dependabot

[4.2.0] - 2024-04-15

... (truncated)

Commits

dda3372 build
3894c84 chore(release): v5.0.0 (#265)
ca66f38 Update Node.js runtime from node20 to node24 (#259)
316ed5a Bump undici (#263)
bc9bc0c Bump undici and @actions/http-client (#257)
16e3094 Bump minimatch (#256)
6e42753 Bump actions/stale in /.github/workflows in the actions group (#255)
9651d9d Bump actions/checkout in /.github/workflows in the actions group (#251)
658bff9 Bump the actions group with 2 updates (#248)
331c814 Bump the actions group with 3 updates (#247)
Additional commits viewable in compare view

Updates sigstore/cosign-installer from 4.0.0 to 4.1.1

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.1

What's Changed

chore: update default cosign-release to v3.0.5 in sigstore/cosign-installer#223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

Bump cosign to 3.0.5 in sigstore/cosign-installer#220

fix: add retry to curl downloads for transient network failures in sigstore/cosign-installer#210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

Commits

cad07c2 chore: update default cosign-release to v3.0.5 (#223)
ba7bc0a fix: add retry to curl downloads for transient network failures (#210)
5a292e1 Bump cosign to 3.0.5 (#220)
351ea76 Bump actions/checkout from 6.0.1 to 6.0.2 (#217)
c17565f test with go 1.26 too (#221)
a6fdd19 Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)
430b6a7 docs: fix registry from gcr.io to ghcr.io (#213)
4d14d7f feat: update to v3.0.3 (#212)
f148005 fix: use env vars for template expansions; show curl errors (#207)
c3f2d79 Bump actions/checkout from 6.0.0 to 6.0.1 (#208)
Additional commits viewable in compare view

Updates docker/setup-qemu-action from 3.7.0 to 4.0.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/setup-qemu-action#245

Switch to ESM and update config/test wiring by @crazy-max in docker/setup-qemu-action#241

Bump @actions/core from 1.11.1 to 3.0.0 in docker/setup-qemu-action#244

Bump @docker/actions-toolkit from 0.67.0 to 0.77.0 in docker/setup-qemu-action#243

Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in docker/setup-qemu-action#240

Bump js-yaml from 3.14.1 to 3.14.2 in docker/setup-qemu-action#231

Bump lodash from 4.17.21 to 4.17.23 in docker/setup-qemu-action#238

Full Changelog: docker/setup-qemu-action@v3.7.0...v4.0.0

Commits

ce36039 Merge pull request #245 from crazy-max/node24
6386344 node 24 as default runtime
1ea3db7 Merge pull request #243 from docker/dependabot/npm_and_yarn/docker/actions-to...
b56a002 chore: update generated content
c43f02d build(deps): bump @docker/actions-toolkit from 0.67.0 to 0.77.0
ce10c58 Merge pull request #244 from docker/dependabot/npm_and_yarn/actions/core-3.0.0
429fc9d chore: update generated content
060e5f8 build(deps): bump @actions/core from 1.11.1 to 3.0.0
44be13e Merge pull request #231 from docker/dependabot/npm_and_yarn/js-yaml-3.14.2
1897438 chore: update generated content
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.12.0 to 4.0.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/setup-buildx-action#483

Remove deprecated inputs/outputs by @crazy-max in docker/setup-buildx-action#464

Switch to ESM and update config/test wiring by @crazy-max in docker/setup-buildx-action#481

Bump @actions/core from 1.11.1 to 3.0.0 in docker/setup-buildx-action#475

Bump @docker/actions-toolkit from 0.63.0 to 0.79.0 in docker/setup-buildx-action#482 docker/setup-buildx-action#485

Bump js-yaml from 4.1.0 to 4.1.1 in docker/setup-buildx-action#452

Bump lodash from 4.17.21 to 4.17.23 in docker/setup-buildx-action#472

Bump minimatch from 3.1.2 to 3.1.5 in docker/setup-buildx-action#480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

Commits

4d04d5d Merge pull request #485 from docker/dependabot/npm_and_yarn/docker/actions-to...
cd74e05 chore: update generated content
eee38ec build(deps): bump @docker/actions-toolkit from 0.77.0 to 0.79.0
7a83f65 Merge pull request #484 from docker/dependabot/github_actions/docker/setup-qe...
a5aa967 Merge pull request #464 from crazy-max/rm-deprecated
e73d53f build(deps): bump docker/setup-qemu-action from 3 to 4
28a438e Merge pull request #483 from crazy-max/node24
034e9d3 chore: update generated content
b4664d8 remove deprecated inputs/outputs
a8257de node 24 as default runtime
Additional commits viewable in compare view

Updates docker/build-push-action from 6.19.2 to 7.0.0

Release notes

Sourced from docker/build-push-action's releases.

v7.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/build-push-action#1470

Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @crazy-max in docker/build-push-action#1473

Remove legacy export-build tool support for build summary by @crazy-max in docker/build-push-action#1474

Switch to ESM and update config/test wiring by @crazy-max in docker/build-push-action#1466

Bump @actions/core from 1.11.1 to 3.0.0 in docker/build-push-action#1454

Bump @docker/actions-toolkit from 0.62.1 to 0.79.0 in docker/build-push-action#1453 docker/build-push-action#1472 docker/build-push-action#1479

Bump minimatch from 3.1.2 to 3.1.5 in docker/build-push-action#1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

Commits

d08e5c3 Merge pull request #1479 from docker/dependabot/npm_and_yarn/docker/actions-t...
cbd2dff chore: update generated content
f76f51f chore(deps): Bump @docker/actions-toolkit from 0.78.0 to 0.79.0
7d03e66 Merge pull request #1473 from crazy-max/rm-deprecated-envs
98f853d chore: update generated content
cadccf6 remove deprecated envs
03fe877 Merge pull request #1478 from docker/dependabot/github_actions/docker/setup-b...
827e366 chore(deps): Bump docker/setup-buildx-action from 3 to 4
e25db87 Merge pull request #1474 from crazy-max/rm-export-build-tool
1ac2573 Merge pull request #1470 from crazy-max/node24
Additional commits viewable in compare view

Updates docker/setup-docker-action from 4.7.0 to 5.0.0

Release notes

Sourced from docker/setup-docker-action's releases.

v5.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/setup-docker-action#215

Switch to ESM and update config/test wiring by @crazy-max in docker/setup-docker-action#212

Bump @actions/core from 2.0.1 to 3.0.0 in docker/setup-docker-action#205

Bump @docker/actions-toolkit from 0.71.0 to 0.77.0 in docker/setup-docker-action#204

Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in docker/setup-docker-action#208

Bump lodash from 4.17.21 to 4.17.23 in docker/setup-docker-action#202

Bump fast-xml-parser from 5.3.3 to 5.4.1 in docker/setup-docker-action#207 docker/setup-docker-action#209

Full Changelog: docker/setup-docker-action@v4.7.0...v5.0.0

Commits

1a6edb0 Merge pull request #215 from crazy-max/node24
1c63d0a node 24 as default runtime
36efcb9 Merge pull request #214 from crazy-max/fix-vendoring
61e47f6 Merge pull request #213 from crazy-max/update-yarn
64e9804 dockerfile: fix vendoring
ca54cb1 update yarn to 4.9.2
2d1c601 Merge pull request #209 from docker/dependabot/npm_and_yarn/fast-xml-parser-5...
87e5e87 Merge pull request #208 from docker/dependabot/npm_and_yarn/isaacs/brace-expa...
c5620ae chore: update generated content
76747bc build(deps): bump fast-xml-parser from 5.3.4 to 5.3.6
Additional commits viewable in compare view

Updates actions/setup-go from 6.3.0 to 6.4.0

Release notes

Sourced from actions/setup-go's releases.

v6.4.0

What's Changed

Enhancement

Add go-download-base-url input for custom Go distributions by @gdams in actions/setup-go#721

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-go#727

Documentation update

Rearrange README.md, add advanced-usage.md by @priyagupta108 in actions/setup-go#724

Fix Microsoft build of Go link by @gdams in actions/setup-go#734

New Contributors

@gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

Commits

4a36011 docs: fix Microsoft build of Go link (#734)
8f19afc feat: add go-download-base-url input for custom Go distributions (#721)
27fdb26 Bump minimatch from 3.1.2 to 3.1.5 (#727)
def8c39 Rearrange README.md, add advanced-usage.md (#724)
See full diff in compare view

…9 updates Bumps the github-actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/cache](https://github.com/actions/cache) | `5.0.3` | `5.0.4` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.0` | | [azure/setup-helm](https://github.com/azure/setup-helm) | `4.3.1` | `5.0.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.0.0` | `4.1.1` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.7.0` | `4.0.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.0.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.0.0` | | [docker/setup-docker-action](https://github.com/docker/setup-docker-action) | `4.7.0` | `5.0.0` | Bumps the github-actions group with 1 update in the /.github/actions/setup-go directory: [actions/setup-go](https://github.com/actions/setup-go). Updates `actions/cache` from 5.0.3 to 5.0.4 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@cdf6c1f...6682284) Updates `actions/upload-artifact` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b7c566a...bbbca2d) Updates `azure/setup-helm` from 4.3.1 to 5.0.0 - [Release notes](https://github.com/azure/setup-helm/releases) - [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md) - [Commits](Azure/setup-helm@1a275c3...dda3372) Updates `sigstore/cosign-installer` from 4.0.0 to 4.1.1 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@faadad0...cad07c2) Updates `docker/setup-qemu-action` from 3.7.0 to 4.0.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@c7c5346...ce36039) Updates `docker/setup-buildx-action` from 3.12.0 to 4.0.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@8d2750c...4d04d5d) Updates `docker/build-push-action` from 6.19.2 to 7.0.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@10e90e3...d08e5c3) Updates `docker/setup-docker-action` from 4.7.0 to 5.0.0 - [Release notes](https://github.com/docker/setup-docker-action/releases) - [Commits](docker/setup-docker-action@e43656e...1a6edb0) Updates `actions/setup-go` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4b73464...4a36011) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: azure/setup-helm dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-docker-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 8, 2026

dependabot Bot requested a review from knqyf263 as a code owner April 8, 2026 10:52

dependabot Bot force-pushed the dependabot/github_actions/github-actions-7c9df56687 branch from 7fa9f0a to 11a2737 Compare April 9, 2026 11:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the github-actions group across 2 directories with 9 updates#10495

chore(deps): bump the github-actions group across 2 directories with 9 updates#10495
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-7c9df56687

dependabot Bot commented on behalf of github Apr 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.0.4

What's Changed

New Contributors

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

v7.0.0

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v5.0.0

Changed

Change Log

[5.0.0] - 2026-03-23

Changed

[4.3.1] - 2025-08-12

Changed

Added

[4.3.0] - 2025-02-15

[4.2.0] - 2024-04-15

v4.1.1

What's Changed

v4.1.0

What's Changed

v4.0.0

v4.0.0

v7.0.0

v5.0.0

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 8, 2026 •

edited

Loading