chore(deps): Bump the actions-updates group across 1 directory with 5 updates by dependabot[bot] · Pull Request #171 · edera-dev/protect-webhook

dependabot · 2026-02-16T04:40:04Z

Bumps the actions-updates group with 5 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.14.0`	`2.14.2`
actions/checkout	`6.0.1`	`6.0.2`
astral-sh/setup-uv	`7.1.6`	`7.3.0`
actions/setup-python	`6.1.0`	`6.2.0`
docker/login-action	`3.6.0`	`3.7.0`

Updates step-security/harden-runner from 2.14.0 to 2.14.2

Release notes

Sourced from step-security/harden-runner's releases.

v2.14.2

What's Changed

Security fix: Fixed a medium severity vulnerability where outbound network connections using sendto, sendmsg, and sendmmsg socket system calls could bypass audit logging when using egress-policy: audit. This issue only affects the Community Tier in audit mode; block mode and Enterprise Tier were not affected. See GHSA-cpmj-h4f6-r6pq for details.

Full Changelog: step-security/harden-runner@v2.14.1...v2.14.2

v2.14.1

What's Changed

In some self-hosted environments, the agent could briefly fall back to public DNS resolvers during startup if the system DNS was not yet available. This behavior was unintended for GitHub-hosted runners and has now been fixed to prevent any use of public DNS resolvers.

Fixed npm audit vulnerabilities

Full Changelog: step-security/harden-runner@v2.14.0...v2.14.1

Commits

5ef0c07 Merge pull request #635 from step-security/rc-34
eb43c7b update agent
e3f713f Merge pull request #631 from step-security/rc-31
423acdd chore: fix npm audit vulnerabilities
0ddb86c update agent
See full diff in compare view

Updates actions/checkout from 6.0.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

... (truncated)

Commits

de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
See full diff in compare view

Updates astral-sh/setup-uv from 7.1.6 to 7.3.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.3.0 🌈 New features and bug fixes for activate-environment

Changes

This release contains a few bug fixes and a new feature for the activate-environment functionality.

🐛 Bug fixes

fix: warn instead of error when no python to cache @eifinger (#762)

fix: use --clear to create venv @eifinger (#761)

🚀 Enhancements

feat: add venv-path input for activate-environment @eifinger (#746)

🧰 Maintenance

chore: update known checksums for 0.10.0 @github-actions[bot] (#759)

refactor: tilde-expansion tests as unittests and no self-hosted tests @eifinger (#760)

chore: update known checksums for 0.9.30 @github-actions[bot] (#756)

chore: update known checksums for 0.9.29 @github-actions[bot] (#748)

📚 Documentation

Fix punctuation @pm-dev563 (#747)

⬆️ Dependency updates

Bump typesafegithub/github-actions-typing from 2.2.1 to 2.2.2 @dependabot[bot] (#753)

Bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 @dependabot[bot] (#751)

Bump actions/checkout from 6.0.1 to 6.0.2 @dependabot[bot] (#740)

Bump release-drafter/release-drafter from 6.1.0 to 6.2.0 @dependabot[bot] (#743)

Bump eifinger/actionlint-action from 1.9.3 to 1.10.0 @dependabot[bot] (#731)

Bump actions/setup-node from 6.1.0 to 6.2.0 @dependabot[bot] (#738)

v7.2.0 🌈 add outputs python-version and python-cache-hit

Changes

Among some minor typo fixes and quality of life features for developers of actions the main feature of this release are new outputs:

python-version: The Python version that was set (same content as existing UV_PYTHON)

python-cache-hit: A boolean value to indicate the Python cache entry was found

While implementing this it became clear, that it is easier to handle the Python binaries in a separate cache entry. The added benefit for users is that the "normal" cache containing the dependencies can be used in all runs no matter if these cache the Python binaries or not.

[!NOTE]
This release will invalidate caches that contain the Python binaries. This happens a single time.

🐛 Bug fixes

chore: remove stray space from UV_PYTHON_INSTALL_DIR message @akx (#720)

... (truncated)

Commits

eac588a Bump typesafegithub/github-actions-typing from 2.2.1 to 2.2.2 (#753)
a97c6cb Bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 (#751)
02182fa fix: warn instead of error when no python to cache (#762)
a3b3eae chore: update known checksums for 0.10.0 (#759)
78cebec fix: use --clear to create venv (#761)
b6b8e2c refactor: tilde-expansion tests as unittests and no self-hosted tests (#760)
e31bec8 chore: update known checksums for 0.9.30 (#756)
db2b65e Bump actions/checkout from 6.0.1 to 6.0.2 (#740)
3511ff7 feat: add venv-path input for activate-environment (#746)
99b0f04 Fix punctuation (#747)
Additional commits viewable in compare view

Updates actions/setup-python from 6.1.0 to 6.2.0

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

Upgrade dependencies to Node 24 compatible versions by @salmanmkc in actions/setup-python#1259

Upgrade urllib3 from 2.5.0 to 2.6.3 in /__tests__/data by @dependabot in actions/setup-python#1253 and actions/setup-python#1264

Full Changelog: actions/setup-python@v6...v6.2.0

Commits

a309ff8 Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)
bfe8cc5 Upgrade @actions dependencies to Node 24 compatible versions (#1259)
4f41a90 Bump urllib3 from 2.5.0 to 2.6.0 in /tests/data (#1253)
See full diff in compare view

Updates docker/login-action from 3.6.0 to 3.7.0

Release notes

Sourced from docker/login-action's releases.

v3.7.0

Add scope input to set scopes for the authentication token by @crazy-max in docker/login-action#912

Add support for AWS European Sovereign Cloud ECR by @dphi in docker/login-action#914

Ensure passwords are redacted with registry-auth input by @crazy-max in docker/login-action#911

build(deps): bump lodash from 4.17.21 to 4.17.23 in docker/login-action#915

Full Changelog: docker/login-action@v3.6.0...v3.7.0

Commits

c94ce9f Merge pull request #915 from docker/dependabot/npm_and_yarn/lodash-4.17.23
8339c95 Merge pull request #912 from docker/scope
c83e932 build(deps): bump lodash from 4.17.21 to 4.17.23
b268aa5 chore: update generated content
a603229 documentation for scope input
7567f92 Add scope input to set scopes for the authentication token
0567fa5 Merge pull request #914 from dphi/add-support-for-amazonaws.eu
f6ef577 feat: add support for AWS European Sovereign Cloud ECR registries
916386b Merge pull request #911 from crazy-max/ensure-redact
5b3f94a chore: update generated content
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates Bumps the actions-updates group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.14.0` | `2.14.2` | | [actions/checkout](https://github.com/actions/checkout) | `6.0.1` | `6.0.2` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.1.6` | `7.3.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.1.0` | `6.2.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.6.0` | `3.7.0` | Updates `step-security/harden-runner` from 2.14.0 to 2.14.2 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@20cf305...5ef0c07) Updates `actions/checkout` from 6.0.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@8e8c483...de0fac2) Updates `astral-sh/setup-uv` from 7.1.6 to 7.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@681c641...eac588a) Updates `actions/setup-python` from 6.1.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@83679a8...a309ff8) Updates `docker/login-action` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@5e57cd1...c94ce9f) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: astral-sh/setup-uv dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates - dependency-name: docker/login-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates ... Signed-off-by: dependabot[bot] <support@github.com>