Skip to content

chore(deps): bump the actions group across 1 directory with 4 updates - #556

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-470ad862b0
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-470ad862b0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the actions group with 4 updates in the / directory: reviewdog/action-actionlint, zizmorcore/zizmor-action, firebolt-db/action-slack-nightly-notify and actions/create-github-app-token.

Updates reviewdog/action-actionlint from 1.73.2 to 1.80.4

Release notes

Sourced from reviewdog/action-actionlint's releases.

Release v1.80.4

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.3...v1.80.4

Release v1.80.3

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.2...v1.80.3

Release v1.80.2

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.1...v1.80.2

Release v1.80.1

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.0...v1.80.1

Release v1.80.0

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.79.1...v1.80.0

Release v1.79.1

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.79.0...v1.79.1

Release v1.79.0

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.78.1...v1.79.0

Release v1.78.1

... (truncated)

Commits
  • 419a493 bump v1.80.4
  • 4ddb975 Merge branch 'main' into releases/v1
  • e7661f1 Merge pull request #254 from reviewdog/renovate/python-3.15.0-alpine3.24
  • 4fada31 chore(deps): update python:3.15.0-alpine3.24 docker digest to 2699b90
  • b76d06f bump v1.80.3
  • 28d8443 Merge branch 'main' into releases/v1
  • bc97db8 Merge pull request #253 from reviewdog/renovate/python-3.15.0-alpine3.24
  • a2a7e67 chore(deps): update python:3.15.0-alpine3.24 docker digest to e7044cc
  • 3cbf14e bump v1.80.2
  • 7e23c49 Merge branch 'main' into releases/v1
  • Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.6.0 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#2437)

  • The self-hosted-runner audit is now significantly more precise (#2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

  • zizmor is now aware of the image_version workflow trigger (#2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

Updates firebolt-db/action-slack-nightly-notify from 1.0.0 to 1.0.1

Release notes

Sourced from firebolt-db/action-slack-nightly-notify's releases.

v1.0.1

  • slackapi/slack-github-action pinned to v1.27.1 (commit SHA).
  • Release workflow with minimal permissions; lint & scan workflow (actionlint, zizmor) and the standard PR title check.
  • README improvements.
Commits
  • 38a20fc ci: standardize the PR title check (FB-4904) (#2)
  • 9ddce5d ci: pin actions, restrict permissions, add lint & scan workflow (FB-4904) (#1)
  • 903898e docs: Improving readme
  • See full diff in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)
Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view


Note

Low Risk
Version-only pin updates to CI and release helper actions; no application or workflow logic changes beyond newer upstream behavior.

Overview
Bumps pinned versions for four third-party GitHub Actions across three workflows, with no changes to job structure, inputs, or permissions.

In Lint & Scan GitHub Actions, reviewdog/action-actionlint moves to v1.80.4 and zizmorcore/zizmor-action to v0.7.1 (newer actionlint/zizmor tooling for workflow lint and security scans). v2 Nightly updates firebolt-db/action-slack-nightly-notify to v1.0.1 for failure Slack notifications. Release updates actions/create-github-app-token to v3.3.0 for the publish job’s GitHub App token step; existing permission-contents: write usage is unchanged.

Reviewed by Cursor Bugbot for commit 20fd30d. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
dependabot Bot requested a review from a team as a code owner October 23, 2026 08:23
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 23, 2026
Bumps the actions group with 4 updates in the / directory: [reviewdog/action-actionlint](https://github.com/reviewdog/action-actionlint), [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action), [firebolt-db/action-slack-nightly-notify](https://github.com/firebolt-db/action-slack-nightly-notify) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `reviewdog/action-actionlint` from 1.73.2 to 1.80.4
- [Release notes](https://github.com/reviewdog/action-actionlint/releases)
- [Commits](reviewdog/action-actionlint@dbe5299...419a493)

Updates `zizmorcore/zizmor-action` from 0.6.0 to 0.7.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@6599ee8...85b2b9f)

Updates `firebolt-db/action-slack-nightly-notify` from 1.0.0 to 1.0.1
- [Release notes](https://github.com/firebolt-db/action-slack-nightly-notify/releases)
- [Commits](firebolt-db/action-slack-nightly-notify@1bdd915...38a20fc)

Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: firebolt-db/action-slack-nightly-notify
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: reviewdog/action-actionlint
  dependency-version: 1.80.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-470ad862b0 branch from 9ac2172 to 20fd30d Compare October 27, 2026 08:23
@sonarqubecloud

Copy link
Copy Markdown

@dependabot @github

dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 28, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-470ad862b0 branch October 28, 2026 08:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants