chore(deps): bump the github-actions group with 10 updates

[dependabot]

Bumps the github-actions group with 10 updates:

Package	From	To
actions/checkout	3.6.0	4.2.2
github/codeql-action	3.28.16	3.28.18
denoland/setup-deno	2.0.2	2.0.3
actions/dependency-review-action	4.7.0	4.7.1
microsoft/DevSkim-Action	1.0.15	1.0.16
ossf/scorecard-action	2.4.1	2.4.2
rojopolis/spellcheck-github-actions	0.48.0	0.49.0
actions/ai-inference	1.0.0	1.1.0
super-linter/super-linter	7.3.0	7.4.0
trufflesecurity/trufflehog	3.88.28	3.88.35

Updates actions/checkout from 3.6.0 to 4.2.2

Release notes

Sourced from actions/checkout's releases.

v4.2.2

What's Changed

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

New Contributors

• @​Jcambass made their first contribution in actions/checkout#1919

Full Changelog: actions/checkout@v4.2.0...v4.2.1

v4.2.0

What's Changed

• Add Ref and Commit outputs by @​lucacome in actions/checkout#1180
• Dependabot updates in actions/checkout#1777 & actions/checkout#1872

New Contributors

• @​yasonk made their first contribution in actions/checkout#1869
• @​lucacome made their first contribution in actions/checkout#1180

Full Changelog: actions/checkout@v4.1.7...v4.2.0

v4.1.7

What's Changed

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

New Contributors

• @​orhantoy made their first contribution in actions/checkout#1774

Full Changelog: actions/checkout@v4.1.6...v4.1.7

v4.1.6

What's Changed

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732
• Update for 4.1.6 release by @​cory-miller in actions/checkout#1733

Full Changelog: actions/checkout@v4.1.5...v4.1.6

v4.1.5

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

v4.2.0

• Add Ref and Commit outputs by @​lucacome in actions/checkout#1180
• Dependency updates by @​dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

v4.1.6

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732

v4.1.5

• Update NPM dependencies by @​cory-miller in actions/checkout#1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in actions/checkout#1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in actions/checkout#1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in actions/checkout#1695
• README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @​cory-miller in actions/checkout#1707

v4.1.4

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in actions/checkout#1692
• Add dependabot config by @​cory-miller in actions/checkout#1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in actions/checkout#1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in actions/checkout#1643

v4.1.3

• Check git version before attempting to disable sparse-checkout by @​jww3 in actions/checkout#1656
• Add SSH user parameter by @​cory-miller in actions/checkout#1685
• Update actions/checkout version in update-main-version.yml by @​jww3 in actions/checkout#1650

v4.1.2

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in actions/checkout#1598

v4.1.1

• Correct link to GitHub Docs by @​peterbe in actions/checkout#1511
• Link to release page from what's new section by @​cory-miller in actions/checkout#1514

v4.1.0

• Add support for partial checkout filters

... (truncated)

Commits

• 11bd719 Prepare 4.2.2 Release (#1953)
• e3d2460 Expand unit test coverage (#1946)
• 163217d url-helper.ts now leverages well-known environment variables. (#1941)
• eef6144 Prepare 4.2.1 release (#1925)
• 6b42224 Add workflow file for publishing releases to immutable action package (#1919)
• de5a000 Check out other refs/* by commit if provided, fall back to ref (#1924)
• d632683 Prepare 4.2.0 release (#1878)
• 6d193bf Bump braces from 3.0.2 to 3.0.3 (#1777)
• db0cee9 Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1872)
• b684943 Add Ref and Commit outputs (#1180)
• Additional commits viewable in compare view

Updates github/codeql-action from 3.28.16 to 3.28.18

Release notes

Sourced from github/codeql-action's releases.

v3.28.18

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.18 - 16 May 2025

• Update default CodeQL bundle version to 2.21.3. #2893
• Skip validating SARIF produced by CodeQL for improved performance. #2894
• The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

See the full CHANGELOG.md for more information.

v3.28.17

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.17 - 02 May 2025

• Update default CodeQL bundle version to 2.21.2. #2872

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.

3.28.18 - 16 May 2025

• Update default CodeQL bundle version to 2.21.3. #2893
• Skip validating SARIF produced by CodeQL for improved performance. #2894
• The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

3.28.17 - 02 May 2025

• Update default CodeQL bundle version to 2.21.2. #2872

3.28.16 - 23 Apr 2025

• Update default CodeQL bundle version to 2.21.1. #2863

3.28.15 - 07 Apr 2025

• Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842

3.28.14 - 07 Apr 2025

• Update default CodeQL bundle version to 2.21.0. #2838

3.28.13 - 24 Mar 2025

No user facing changes.

3.28.12 - 19 Mar 2025

• Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.
• Update default CodeQL bundle version to 2.20.7. #2810

3.28.11 - 07 Mar 2025

• Update default CodeQL bundle version to 2.20.6. #2793

3.28.10 - 21 Feb 2025

• Update default CodeQL bundle version to 2.20.5. #2772
• Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

... (truncated)

Commits

• ff0a06e Merge pull request #2896 from github/update-v3.28.18-b86edfc27
• a41e084 Update changelog for v3.28.18
• b86edfc Merge pull request #2893 from github/update-bundle/codeql-bundle-v2.21.3
• e93b900 Merge branch 'main' into update-bundle/codeql-bundle-v2.21.3
• 510dfa3 Merge pull request #2894 from github/henrymercer/skip-validating-codeql-sarif
• 492d783 Merge branch 'main' into henrymercer/skip-validating-codeql-sarif
• 83bdf3b Merge pull request #2859 from github/update-supported-enterprise-server-versions
• cffc916 Merge pull request #2891 from austinpray-mixpanel/patch-1
• 4420887 Add deprecation warning for CodeQL 2.16.5 and earlier
• 4e178c5 Update supported versions table in README
• Additional commits viewable in compare view

Updates denoland/setup-deno from 2.0.2 to 2.0.3

Release notes

Sourced from denoland/setup-deno's releases.

v2.0.3

Full Changelog: denoland/setup-deno@v2.0.2...v2.0.3

Commits

• e95548e 2.0.3 (#102)
• 8273ddd fix: switch back to package.json as it's necessary for GH actions (#101)
• 609c005 feat: include a hash of deno.lock files in the cache key automatically (#98)
• aa0fea1 feat: add built-in caching via inputs (#89)
• db3496c feat: add "lts" version option (#97)
• d74ee56 refactor: convert action to TS and bundle code (#95)
• See full diff in compare view

Updates actions/dependency-review-action from 4.7.0 to 4.7.1

Release notes

Sourced from actions/dependency-review-action's releases.

v4.7.1

• Packages added to allow-dependencies-licenses will be allowed even if the package in question has no license information #889
• License expressions (e.g. Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g. Ruby)

Commits

• da24556 Merge pull request #933 from actions/dangoor/471-release
• 9af0caf Bump version number for 4.7.1
• d8f2df2 Merge pull request #932 from actions/907-disallow-expression
• 6e9307a Discard allow list entries that are not SPDX IDs
• 8805179 Merge pull request #930 from actions/889-allow-no-license
• 014300b Update build
• 34486f3 Check namespaces when excluding license checks
• 9b155d6 Update build
• f199659 Allowing dependencies works with no licenses
• See full diff in compare view

Updates microsoft/DevSkim-Action from 1.0.15 to 1.0.16

Release notes

Sourced from microsoft/DevSkim-Action's releases.

v1.0.16

What's Changed

• Fix CodeQL version in README example by @​Vinicius-Evangelista in microsoft/DevSkim-Action#33
• Fix archive crawling by @​thomasleplus in microsoft/DevSkim-Action#32

New Contributors

• @​Vinicius-Evangelista made their first contribution in microsoft/DevSkim-Action#33
• @​thomasleplus made their first contribution in microsoft/DevSkim-Action#32

Full Changelog: microsoft/DevSkim-Action@v1.0.15...v1.0.16

Commits

• 4b50479 Fix archive crawling (#32)
• ab90723 docs: update codeql action version in readme (#33)
• See full diff in compare view

Updates ossf/scorecard-action from 2.4.1 to 2.4.2

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.2

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: ossf/scorecard-action@v2.4.1...v2.4.2

Commits

• 05b42c6 🌱 bump docker to ghcr v2.4.2 (#1548)
• b225da6 Bump github.com/ossf/scorecard/v5 from v5.2.0 to v5.2.1 (#1550)
• 9399f6f 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
• e1daa8c 🌱 Bump the github-actions group across 1 directory with 5 updates (#...
• 9fe6511 🌱 Bump golang.org/x/net from 0.39.0 to 0.40.0 (#1542)
• 25b9cd9 🌱 Bump github.com/ossf/scorecard/v5 from v5.1.1 to v5.2.0 (#1547)
• 18cc9b8 🌱 Bump golang.org/x/net from 0.38.0 to 0.39.0 (#1536)
• db78142 🌱 Bump the github-actions group with 2 updates (#1538)
• de386ed 🌱 Bump golang from 1.24.1 to 1.24.2 in the docker-images group (#1534)
• 5b7cedb 🌱 Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 (#1537)
• Additional commits viewable in compare view

Updates rojopolis/spellcheck-github-actions from 0.48.0 to 0.49.0

Release notes

Sourced from rojopolis/spellcheck-github-actions's releases.

0.49.0

What's Changed

• Bump docker/build-push-action from 6.15.0 to 6.16.0 by @​dependabot in rojopolis/spellcheck-github-actions#239
• Bump python from 3.13.2-slim-bookworm to 3.13.3-slim-bookworm by @​dependabot in rojopolis/spellcheck-github-actions#238
• Bump docker/build-push-action from 6.16.0 to 6.17.0 by @​dependabot in rojopolis/spellcheck-github-actions#240
• Issue 241 and other things by @​jonasbn in rojopolis/spellcheck-github-actions#242

• Support for Italian as requested by: Stefan Oderbolz (@​metaode) via issue #241, the support is both for aspell and hunspell

• Docker image updated to Python 3.13.3 slim via PR #238 from Dependabot. Release notes for Python 3.13.3

• pymdown-extensions have been updated to: 10.15.0 hopefully addressing the issue outlined in issue #233 from: Micha Hobert (@​Isengo1989). @​facelessuser made the release of the dependency and I have included it in this release

Full Changelog: rojopolis/spellcheck-github-actions@0.48.0...0.49.0

Changelog

Sourced from rojopolis/spellcheck-github-actions's changelog.

Change Log for spellcheck-github-actions

0.49.0, 2025-05-22, feature release, update not required

• Support for Italian as requested by: Stefan Oderbolz (@​metaodi) via issue #241, the support is both for aspell and hunspell

• Docker image updated to Python 3.13.3 slim via PR #238 from Dependabot. Release notes for Python 3.13.3

• pymdown-extensions have been updated to: 10.15.0 hopefully addressing the issue outlined in issue #233 from: Micha Hobert (@​Isengo1989). @​facelessuser made the release of the dependency and I have included it in this release

0.48.0, 2025-04-01, feature release, update not required

• Support for hunspell via PR #224 from @​funkill

  These opens up for use of hunspell instead of the default: aspell. The following languages are supported:

  • English
  • German
  • Spanish
  • French
  • Russian
  • Ukranian

  And the aspell language support has been extended with:

  • Russian
  • Ukranian

  So the two spell checkers are aligned.

• The action now emits more information on what versions of tools it is using thanks to PR #234 from @​brooke-hamilton

  The tools are:

  • aspell
  • hunspell
  • pyspelling

• One step closer to full Docker image build automation via PR #218 from @​shyim.

  This means that the PR #108 from @​sxd was closed - the contribution from @​sxd was highly appreciated since it helped to understand the problem area and the solution.

  PR #218 addresses issue: #193, which was a request for arm64 support. Issue #80 is still open and will not be closed until we have a fully automated build process for the Docker image.

0.47.0, 2025-02-11, maintenance release, update not required

• Docker image updated to Python 3.13.2 slim via PR #228 from Dependabot. Release notes for Python 3.13.2

0.46.0, 2025-01-07, maintenance release, update not required

... (truncated)

Commits

• 584b2ae Merge pull request #242 from rojopolis/issue_241
• 5375356 Preparing release 0.49.0
• 79bd8b1 Forgot to bump the version numbers in meta-data and documentation
• c823f02 Merge pull request #240 from rojopolis/dependabot/github_actions/docker/build...
• f961343 Merge pull request #238 from rojopolis/dependabot/docker/python-3.13.3-slim-b...
• ba71ec0 Bump docker/build-push-action from 6.16.0 to 6.17.0
• 7a77430 Merge pull request #239 from rojopolis/dependabot/github_actions/docker/build...
• a04e607 Bump docker/build-push-action from 6.15.0 to 6.16.0
• d68b218 Bump python from 3.13.2-slim-bookworm to 3.13.3-slim-bookworm
• See full diff in compare view

Updates actions/ai-inference from 1.0.0 to 1.1.0

Release notes

Sourced from actions/ai-inference's releases.

v1.1.0

What's Changed

• read prompt from file and print output to file by @​aiqiaoy in actions/ai-inference#15
• Clarify description in README by @​joshmgross in actions/ai-inference#10
• Bump @​rollup/rollup-linux-x64-gnu from 4.39.0 to 4.40.0 by @​dependabot in actions/ai-inference#13
• Bump the npm-development group across 1 directory with 14 updates by @​dependabot in actions/ai-inference#16
• Bumps all package versions, and re-builds by @​maraisr in actions/ai-inference#25
• Bump super-linter/super-linter from 7.3.0 to 7.4.0 in the actions-minor group by @​dependabot in actions/ai-inference#24
• Bump @​github/local-action from 2.2.1 to 3.2.1 by @​dependabot in actions/ai-inference#28
• feat: Add system-prompt-file input for file-based system prompts by @​mattleibow in actions/ai-inference#27

New Contributors

• @​aiqiaoy made their first contribution in actions/ai-inference#15
• @​joshmgross made their first contribution in actions/ai-inference#10
• @​maraisr made their first contribution in actions/ai-inference#25
• @​mattleibow made their first contribution in actions/ai-inference#27

Full Changelog: actions/ai-inference@v1...v1.1.0

Commits

• d645f06 Merge pull request #27 from mattleibow/dev/system-prompt-file
• 9c57490 regen
• aa31275 Merge remote-tracking branch 'upstream/main' into dev/system-prompt-file
• cacab0d Merge pull request #28 from actions/dependabot/npm_and_yarn/github/local-acti...
• 8562e77 Bump @​github/local-action from 2.2.1 to 3.2.1
• 9aac9c7 Formatting
• eb37c9a Formatting
• 7ee5d23 Merge pull request #24 from actions/dependabot/github_actions/actions-minor-8...
• c9a9379 Bump super-linter/super-linter in the actions-minor group
• ad31e75 Merge pull request #25 from actions/mr/bump-versions
• Additional commits viewable in compare view

Updates super-linter/super-linter from 7.3.0 to 7.4.0

Release notes

Sourced from super-linter/super-linter's releases.

v7.4.0

7.4.0 (2025-05-13)

🚀 Features

• add env var for npm-groovy-lint failon level (#6530) (418c922)
• check in-progress commit msg with commitlint (#6757) (57345c5), closes #6411
• disable xmllint verbose output if debuging (#6747) (e6c42ca), closes #6653
• do not hide php composer output (#6637) (1c62141)
• pass optional arguments to gitleaks (#6756) (109384b), closes #6601
• set github_before_sha on pull requests (#6687) (d7f5222)
• support eslint flat config files (#6619) (d349d57)
• support ktlint format fix (#6748) (5cb5915), closes #6618
• warn the user on conflicting tools (#6759) (b4aaae9)

🐛 Bugfixes

• check if commit count is defined before using (#6733) (d007229)
• check return code and misc test improvements (#6697) (7f46ec3)
• configure nbqa tools (#6761) (e31adf9), closes #6736
• consider git dirs safe (#6675) (101d5a6)
• do not use a pager on git log (#6765) (f5bae0c)
• emit prettier verbose output when debugging (#6636) (4e1eb5f)
• export github_before_sha (#6714) (6401906)
• fix default values for prettier fix vars (#6769) (4230ecc), closes #6768
• more robust error checking and test fixes (#6693) (1c70566)
• skip symbolic links when passing files to prettier (#6620) (417a58a)
• update editorconfig-checker config file name (#6730) (72f02f0)

⬆️ Dependency updates

• bundler: bump the rubocop group in /dependencies with 10 updates (#6661) (2757a99)
• bundler: bump the rubocop group in /dependencies with 4 updates (#6782) (17cf935)
• docker: bump python in the docker-base-images group (#6723) (960298b)
• docker: bump the docker group across 1 directory with 17 updates (#6776) (8b602a4)
• java: bump com.google.googlejavaformat:google-java-format (#6780) (aa3f3f8)
• java: bump com.puppycrawl.tools:checkstyle (#6639) (59f2b6b)
• npm: bump @​babel/eslint-parser in /dependencies (#6762) (fd53895)
• npm: bump @​babel/runtime-corejs3 (#6651) (8fbf79e)
• npm: bump @​stoplight/spectral-cli in /dependencies (#6742) (56355b5)
• npm: bump asl-validator from 3.13.0 to 3.14.0 in /dependencies (#6631) (30aa4b3)
• npm: bump asl-validator from 3.14.0 to 3.15.0 in /dependencies (#6777) (660f7dc)
• npm: bump next (#6676) (f171ee5)
• npm: bump next (#6708) (43faf95)
• npm: bump next (#6729) (536538a)
• npm: bump npm-groovy-lint from 15.1.0 to 15.2.0 in /dependencies (#6779) (c19a3da)
• npm: bump prettier from 3.5.2 to 3.5.3 in /dependencies (#6629) (6864c8c)

... (truncated)

Changelog

Sourced from super-linter/super-linter's changelog.

Changelog

7.4.0 (2025-05-13)

🚀 Features

• add env var for npm-groovy-lint failon level (#6530) (418c922)
• check in-progress commit msg with commitlint (#6757) (57345c5), closes #6411
• disable xmllint verbose output if debuging (#6747) (e6c42ca), closes #6653
• do not hide php composer output (#6637) (1c62141)
• pass optional arguments to gitleaks (#6756) (109384b), closes #6601
• set github_before_sha on pull requests (#6687) (d7f5222)
• support eslint flat config files (#6619) (d349d57)
• support ktlint format fix (#6748) (5cb5915), closes #6618
• warn the user on conflicting tools (#6759) (b4aaae9)

🐛 Bugfixes

• check if commit count is defined before using (#6733) (d007229)
• check return code and misc test improvements (#6697) (7f46ec3)
• configure nbqa tools (#6761) (e31adf9), closes #6736
• consider git dirs safe (#6675) (101d5a6)
• do not use a pager on git log (#6765) (f5bae0c)
• emit prettier verbose output when debugging (#6636) (4e1eb5f)
• export github_before_sha (#6714) (6401906)
• fix default values for prettier fix vars (#6769) (4230ecc), closes #6768
• more robust error checking and test fixes (#6693) (1c70566)
• skip symbolic links when passing files to prettier (#6620) (417a58a)
• update editorconfig-checker config file name (#6730) (72f02f0)

⬆️...

Description has been truncated

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.