build(deps): bump the github-actions group across 2 directories with 5 updates by dependabot[bot] · Pull Request #5887 · getsentry/sentry-dotnet

dependabot · 2026-11-06T08:16:29Z

Bumps the github-actions group with 5 updates in the / directory:

Package	From	To
getsentry/craft/.github/workflows/changelog-preview.yml	`3.3.0`	`3.9.0`
github/codeql-action/init	`4.39.1`	`4.39.2`
github/codeql-action/analyze	`4.39.1`	`4.39.2`
gradle/actions/setup-gradle	`6.4.0`	`6.4.1`
actions/setup-dotnet	`6.0.0`	`6.1.0`

Bumps the github-actions group with 1 update in the /.github/actions/environment directory: actions/setup-dotnet.

Updates getsentry/craft/.github/workflows/changelog-preview.yml from 3.3.0 to 3.9.0

Release notes

Sourced from getsentry/craft/.github/workflows/changelog-preview.yml's releases.

3.9.0

Prerelease promotion and commit-driven versions expand release flow; blocking responds faster, deployment environments are classified correctly, and stale history can be removed.

New Features ✨

Prerelease versioning now supports promotion to stable releases and successive versions driven by commit changes.

(prepare) Handle prereleases in auto-versioning and add pre version by @BYK with @sentry-junior in #957

Bug Fixes 🐛

Release blocking now halts immediately for open blockers while handling lookup failures and repository targeting reliably.

(action) Stop the release when release-blocker issues are open by @BYK with @sentry-junior in #956

Internal Changes 🔧

Non-master builds avoid false environments, while master deployments remain production-bound and administrators can remove stale history.

Don't create a 'false' deployment on non-master builds by @BYK with @sentry-junior in #958

3.8.0

Version bumps now update repository files more safely through workspace-aware validation, preventing invalid paths and no-op preparations from writing changes.

New Features ✨

Automatic version bumps now update repository files safely, with workspace-aware configuration and strict validation before writes.

(versioning) Update extra version files during automatic bumps by @BYK with @sentry-junior in #955

3.7.1

Dry-run versioning is more repeatable, while built-in development bumps preserve output and avoid redundant post-release bumps after pre-releases.

Bug Fixes 🐛

Dry-run version bumps stay isolated and repeat consistently without checkout changes or temporary branch failures.

(prepare) Keep dry-run version bumps in the worktree by @BYK with @sentry-junior in #954

Internal Changes 🔧

Release configuration now uses built-in development bumps, preserves version output, and skips redundant bumps after pre-releases.

Use built-in postReleaseBump for the development version by @BYK with @sentry-junior in #951

3.7.0

Publishing now automates development-version updates, while changelog filtering keeps meaningful entries and omits generated bump commits.

New Features ✨

... (truncated)

Changelog

Sourced from getsentry/craft/.github/workflows/changelog-preview.yml's changelog.

Changelog

3.10.0

Deployments now wait for builds and expose failures, while release tooling supports Craft 3 and prevents accidental pre-1.0 major version jumps.

New Features ✨

GitHub Pages deployments now wait for builds and report failures with deployment details.

(gh-pages) Wait for the Pages build and retry when it fails by @BYK with @sentry-junior in #961

Bug Fixes 🐛

The reusable release workflow now uses the Craft v3 action, enabling Craft 3 configuration and current release-blocker handling. For versions below 1.0.0, craft prepare auto and craft prepare pre convert commit-selected major bumps to minor versions. Use craft prepare major or an explicit exact version to release 1.0.0. JSON changelog output and PR previews still show the raw major bump type.

(release) Use craft v3 action in reusable release workflow by @BYK with @sentry-junior in #959

(version) Keep auto and pre below 1.0.0 on breaking changes by @sentry-junior in #962

3.9.0

Prerelease promotion and commit-driven versions expand release flow; blocking responds faster, deployment environments are classified correctly, and stale history can be removed.

New Features ✨

Prerelease versioning now supports promotion to stable releases and successive versions driven by commit changes.

(prepare) Handle prereleases in auto-versioning and add pre version by @BYK with @sentry-junior in #957

Bug Fixes 🐛

Release blocking now halts immediately for open blockers while handling lookup failures and repository targeting reliably.

(action) Stop the release when release-blocker issues are open by @BYK with @sentry-junior in #956

Internal Changes 🔧

Non-master builds avoid false environments, while master deployments remain production-bound and administrators can remove stale history.

Don't create a 'false' deployment on non-master builds by @BYK with @sentry-junior in #958

3.8.0

Version bumps now update repository files more safely through workspace-aware validation, preventing invalid paths and no-op preparations from writing changes.

New Features ✨

Automatic version bumps now update repository files safely, with workspace-aware configuration and strict validation before writes.

(versioning) Update extra version files during automatic bumps by @BYK with @sentry-junior in #955

... (truncated)

Commits

2e29b08 release: 3.9.0
f145d33 fix(action): Stop the release when release-blocker issues are open (#956)
8240d4b feat(prepare): Handle prereleases in auto-versioning and add pre version (#...
5d844cb ci: Don't create a 'false' deployment on non-master builds (#958)
f623a04 meta: Bump new development version
dc74600 Merge commit '78cac764e2316a8eb6ed6cd2736c5195d3db4d51'
78cac76 release: 3.8.0
b6d4d48 feat(versioning): Update extra version files during automatic bumps (#955)
fc794d4 meta: Bump new development version
e74e7c1 Merge commit 'd725f285bc864ea8aeb300f189a8680cde6aa22a'
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.39.1 to 4.39.2

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.2

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

1fc58d0 Merge pull request #4286 from github/update-v4.39.2-c05042115
d998481 Update changelog for v4.39.2
c050421 Merge pull request #4284 from github/update-bundle/codeql-bundle-v2.27.4
750fe8f Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4
adfcd5f Add changelog note
2ef3b62 Update default bundle to codeql-bundle-v2.27.4
b35c6c6 Merge pull request #4251 from github/mbg/refactor-util/errors
ac9f257 Merge remote-tracking branch 'origin/main' into mbg/refactor-util/errors
52cf185 Merge pull request #4278 from github/mbg/macos27/xcode-detection
95dd6bf Fix new test not providing typical input
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.39.1 to 4.39.2

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.2

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

1fc58d0 Merge pull request #4286 from github/update-v4.39.2-c05042115
d998481 Update changelog for v4.39.2
c050421 Merge pull request #4284 from github/update-bundle/codeql-bundle-v2.27.4
750fe8f Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4
adfcd5f Add changelog note
2ef3b62 Update default bundle to codeql-bundle-v2.27.4
b35c6c6 Merge pull request #4251 from github/mbg/refactor-util/errors
ac9f257 Merge remote-tracking branch 'origin/main' into mbg/refactor-util/errors
52cf185 Merge pull request #4278 from github/mbg/macos27/xcode-detection
95dd6bf Fix new test not providing typical input
Additional commits viewable in compare view

Updates gradle/actions/setup-gradle from 6.4.0 to 6.4.1

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.4.1

Security fix

This release fixes a security vulnerability in the dependency-submission action: GHSA-chpw-2mqm-95cc. All users should upgrade.

What's Changed

Combined dependency updates by @bigdaz in gradle/actions#1105

Update to latest Dependency Graph plugin by @bigdaz in gradle/actions#1106

Full Changelog: gradle/actions@v6.4.0...v6.4.1

Commits

8da46b5 [bot] Update dist directory
dcf6f72 Merge commit from fork
bf74269 Update to latest Dependency Graph plugin (#1106)
65a6ba9 [bot] Update dist directory
35eba4f Combined dependency updates (#1105)
1cff18a Update known wrapper checksums (#1075)
399f0d3 Update known wrapper checksums
ecf8cf2 Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0 (#1080)
d740e82 Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0
f9f39a9 Bump references to Develocity Gradle plugin from 4.5.0 to 4.5.1 (#1072)
Additional commits viewable in compare view

Updates actions/setup-dotnet from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.1.0

What's Changed

Enhancements

Add check-latest input to reuse a locally installed .NET SDK and skip network calls by @v-mahabaleshwars in actions/setup-dotnet#774

Add skip-lts-prepass input to optimize .NET SDK installation process by @v-chiranjib-swain in actions/setup-dotnet#791

Add fallback install directory when default is not writable by @v-priyagupta108 in actions/setup-dotnet#785

Documentation

Document sdk.version validation for rollForward in global.json by @v-priyagupta108 in actions/setup-dotnet#763

Docs: Add Microsoft docs link for dotnet-quality options by @v-priyagupta108 in actions/setup-dotnet#773

Docs: Updating Documentation in README by @v-lmvysakh in actions/setup-dotnet#776

Clarify dotnet-quality behavior for multiple SDK versions by @v-mahabaleshwars in actions/setup-dotnet#780

Dependency Updates

Fix security vulnerabilities by @v-HarithaVattikuti in actions/setup-dotnet#767

ci: make validation caches read-only by @philip-gai in actions/setup-dotnet#777

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#764

Bump browserslist from 4.28.2 to 4.28.8 by @dependabot in actions/setup-dotnet#781

Bump eslint from 10.5.0 to 10.11.0 by @dependabot in actions/setup-dotnet#772

Bump eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-dotnet#771

Bump undici from 6.28.0 to 6.29.1 by @dependabot in actions/setup-dotnet#784

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#788

Bump handlebars from 4.7.9 to 4.7.10 by @dependabot in actions/setup-dotnet#792

Bump brace-expansion by @dependabot in actions/setup-dotnet#790

Prepare v6.1.0 release with updated cache dependency by @v-HarithaVattikuti in actions/setup-dotnet#798

New Contributors

@v-lmvysakh made their first contribution in actions/setup-dotnet#776

@v-chiranjib-swain made their first contribution in actions/setup-dotnet#791

Full Changelog: actions/setup-dotnet@v6.0.0...v6.1.0

Commits

0f4a354 Prepare v6.1.0 release with updated cache dependency (#798)
6ec5c6b Add fallback install directory when default is not writable (#785)
62573f4 Bump brace-expansion (#790)
67290a9 Bump handlebars from 4.7.9 to 4.7.10 (#792)
0072421 Bump actions/checkout from 7.0.0 to 7.0.1 (#788)
9ead317 Bump undici from 6.28.0 to 6.29.1 (#784)
349aa19 Add skip-lts-prepass input to optimize .NET SDK installation process (#791)
e2cf7c6 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#771)
7576362 Bump eslint from 10.5.0 to 10.11.0 (#772)
074373f Add check-latest input to reuse a locally installed .NET SDK and skip network...
Additional commits viewable in compare view

Updates actions/setup-dotnet from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.1.0

What's Changed

Enhancements

Add check-latest input to reuse a locally installed .NET SDK and skip network calls by @v-mahabaleshwars in actions/setup-dotnet#774

Add skip-lts-prepass input to optimize .NET SDK installation process by @v-chiranjib-swain in actions/setup-dotnet#791

Add fallback install directory when default is not writable by @v-priyagupta108 in actions/setup-dotnet#785

Documentation

Document sdk.version validation for rollForward in global.json by @v-priyagupta108 in actions/setup-dotnet#763

Docs: Add Microsoft docs link for dotnet-quality options by @v-priyagupta108 in actions/setup-dotnet#773

Docs: Updating Documentation in README by @v-lmvysakh in actions/setup-dotnet#776

Clarify dotnet-quality behavior for multiple SDK versions by @v-mahabaleshwars in actions/setup-dotnet#780

Dependency Updates

Fix security vulnerabilities by @v-HarithaVattikuti in actions/setup-dotnet#767

ci: make validation caches read-only by @philip-gai in actions/setup-dotnet#777

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#764

Bump browserslist from 4.28.2 to 4.28.8 by @dependabot in actions/setup-dotnet#781

Bump eslint from 10.5.0 to 10.11.0 by @dependabot in actions/setup-dotnet#772

Bump eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-dotnet#771

Bump undici from 6.28.0 to 6.29.1 by @dependabot in actions/setup-dotnet#784

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#788

Bump handlebars from 4.7.9 to 4.7.10 by @dependabot in actions/setup-dotnet#792

Bump brace-expansion by @dependabot in actions/setup-dotnet#790

Prepare v6.1.0 release with updated cache dependency by @v-HarithaVattikuti in actions/setup-dotnet#798

New Contributors

@v-lmvysakh made their first contribution in actions/setup-dotnet#776

@v-chiranjib-swain made their first contribution in actions/setup-dotnet#791

Full Changelog: actions/setup-dotnet@v6.0.0...v6.1.0

Commits

0f4a354 Prepare v6.1.0 release with updated cache dependency (#798)
6ec5c6b Add fallback install directory when default is not writable (#785)
62573f4 Bump brace-expansion (#790)
67290a9 Bump handlebars from 4.7.9 to 4.7.10 (#792)
0072421 Bump actions/checkout from 7.0.0 to 7.0.1 (#788)
9ead317 Bump undici from 6.28.0 to 6.29.1 (#784)
349aa19 Add skip-lts-prepass input to optimize .NET SDK installation process (#791)
e2cf7c6 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#771)
7576362 Bump eslint from 10.5.0 to 10.11.0 (#772)
074373f Add check-latest input to reuse a locally installed .NET SDK and skip network...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…5 updates Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [getsentry/craft/.github/workflows/changelog-preview.yml](https://github.com/getsentry/craft) | `3.3.0` | `3.9.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.39.1` | `4.39.2` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.39.1` | `4.39.2` | | [gradle/actions/setup-gradle](https://github.com/gradle/actions) | `6.4.0` | `6.4.1` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `6.0.0` | `6.1.0` | Bumps the github-actions group with 1 update in the /.github/actions/environment directory: [actions/setup-dotnet](https://github.com/actions/setup-dotnet). Updates `getsentry/craft/.github/workflows/changelog-preview.yml` from 3.3.0 to 3.9.0 - [Release notes](https://github.com/getsentry/craft/releases) - [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md) - [Commits](getsentry/craft@4b763f5...2e29b08) Updates `github/codeql-action/init` from 4.39.1 to 4.39.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9b32540...1fc58d0) Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9b32540...1fc58d0) Updates `gradle/actions/setup-gradle` from 6.4.0 to 6.4.1 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@3f5f9ad...8da46b5) Updates `actions/setup-dotnet` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@a98b568...0f4a354) Updates `actions/setup-dotnet` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@a98b568...0f4a354) --- updated-dependencies: - dependency-name: getsentry/craft/.github/workflows/changelog-preview.yml dependency-version: 3.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: gradle/actions/setup-gradle dependency-version: 6.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-dotnet dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-dotnet dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

ric-oliv

A heads-up for the 7.0.0 GA release, since craft 3.9.0 shows up here. The Release workflow already runs 3.9.0 through getsentry/craft@v3, so this applies today.

Craft 3.9.0 changed what auto does after a prerelease. getsentry/craft#957 has the details. Our latest tag is 7.0.0-rc.3, so a Release run with the version left blank or set to auto now cuts 7.0.0-rc.4 instead of 7.0.0. To ship GA, type 7.0.0 in the version input. Releases from main's 6.x line work as before.

#5865 also turned on the new pre version. It continues the current prerelease series, so 7.0.0-rc.3 goes to 7.0.0-rc.4. A new series starts at -alpha.0, so we'll have to type the first v8 prerelease version if we want -rc or -preview naming.

dependabot Bot requested review from jamescrosswell and ric-oliv as code owners November 6, 2026 08:16

dependabot Bot added Dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 6, 2026

github-actions Bot added the risk: medium PR risk score: medium label Nov 6, 2026

ric-oliv approved these changes Nov 6, 2026

View reviewed changes

ric-oliv merged commit 75dd1a7 into main Nov 6, 2026
79 of 80 checks passed

ric-oliv deleted the dependabot/github_actions/github-actions-7d3312e75a branch November 6, 2026 09:42

Navigation Menu

Repository navigation

build(deps): bump the github-actions group across 2 directories with 5 updates - #5887

build(deps): bump the github-actions group across 2 directories with 5 updates#5887
ric-oliv merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-7d3312e75a

dependabot Bot commented on behalf of github Nov 6, 2026

Uh oh!

ric-oliv left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 6, 2026

3.9.0

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

3.8.0

New Features ✨

3.7.1

Bug Fixes 🐛

Internal Changes 🔧

3.7.0

New Features ✨

Changelog

3.10.0

New Features ✨

Bug Fixes 🐛

3.9.0

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

3.8.0

New Features ✨

v4.39.2

CodeQL Action Changelog

[UNRELEASED]

4.39.3 - 04 Nov 2026

4.39.2 - 03 Nov 2026

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

v4.39.2

CodeQL Action Changelog

[UNRELEASED]

4.39.3 - 04 Nov 2026

4.39.2 - 03 Nov 2026

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

v6.4.1

Security fix

What's Changed

v6.1.0

What's Changed

Enhancements

Documentation

Dependency Updates

New Contributors

v6.1.0

What's Changed

Enhancements

Documentation

Dependency Updates

New Contributors

Uh oh!

ric-oliv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant