Bump the gha-deps group with 13 updates #4074

dependabot · 2026-01-01T00:31:31Z

Bumps the gha-deps group with 13 updates:

Package	From	To
step-security/harden-runner	`2.13.2`	`2.14.0`
actions/checkout	`5.0.0`	`6.0.1`
actions/setup-dotnet	`5.0.0`	`5.0.1`
actions/upload-artifact	`5.0.0`	`6.0.0`
actions/download-artifact	`6.0.0`	`7.0.0`
codecov/codecov-action	`5.5.1`	`5.5.2`
github/codeql-action	`4.31.2`	`4.31.9`
docker/setup-buildx-action	`3.11.1`	`3.12.0`
aws-actions/configure-aws-credentials	`5.1.0`	`5.1.1`
sillsdev/FieldWorks/.github/workflows/CommitMessage.yml	`2eac8948da8a78df13d469a2287ca309b891d62d`	`673ca3760ac775af8c532bdd3a426cf0cd33e9c4`
actions/dependency-review-action	`4.8.1`	`4.8.2`
actions/setup-node	`6.0.0`	`6.1.0`
actions/setup-python	`6.0.0`	`6.1.0`

Updates step-security/harden-runner from 2.13.2 to 2.14.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.14.0

What's Changed

Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.

Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

What's Changed

Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

Commits

20cf305 Merge pull request #622 from step-security/feature/custom-property-skip
c51e8ee feat: skip agent install and post step on subsequent runs for GitHub-hosted r...
e152b90 feat: skip harden-runner based on repository custom property
ee1faec feat: replace skip-harden-runner with skip-on-custom-property input
1dc7c17 feat: add skip-harden-runner input to conditionally skip execution
df199fb Merge pull request #620 from step-security/rc-29
03d096a update agent
4090107 fix: update agent
See full diff in compare view

Updates actions/checkout from 5.0.0 to 6.0.1

Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

update readme/changelog for v6 by @ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

v4.1.5

Update NPM dependencies by @cory-miller in actions/checkout#1703

Bump github/codeql-action from 2 to 3 by @dependabot in actions/checkout#1694

Bump actions/setup-node from 1 to 4 by @dependabot in actions/checkout#1696

Bump actions/upload-artifact from 2 to 4 by @dependabot in actions/checkout#1695

... (truncated)

Commits

8e8c483 Clarify v6 README (#2328)
033fa0d Add worktree support for persist-credentials includeIf (#2327)
c2d88d3 Update all references from v5 and v4 to v6 (#2314)
1af3b93 update readme/changelog for v6 (#2311)
71cf226 v6-beta (#2298)
069c695 Persist creds to a separate file (#2286)
ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
See full diff in compare view

Updates actions/setup-dotnet from 5.0.0 to 5.0.1

Release notes

Sourced from actions/setup-dotnet's releases.

v5.0.1

What's Changed

Upgrade typescript from 5.4.2 to 5.9.2 and document breaking changes in v5 by @dependabot in actions/setup-dotnet#624

Upgrade eslint-plugin-jest from 27.9.0 to 29.0.1 by @dependabot in actions/setup-dotnet#648

Upgrade actions/publish-action from 0.3.0 to 0.4.0 and update macos-13 to macos-15-intel by @dependabot in actions/setup-dotnet#665

Full Changelog: actions/setup-dotnet@v5...v5.0.1

Commits

2016bd2 Bump actions/publish-action from 0.3.0 to 0.4.0 and update macos-13 to macos-...
21e81f6 Bump eslint-plugin-jest from 27.9.0 to 29.0.1 (#648)
7403103 Bump typescript from 5.4.2 to 5.9.2 (#624)
See full diff in compare view

Updates actions/upload-artifact from 5.0.0 to 6.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in actions/upload-artifact#719

fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in actions/upload-artifact#744

prepare release v6.0.0 for Node.js 24 support by @salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

Commits

b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
e516bc8 docs: correct description of Node.js 24 support in README
ddc45ed docs: update README to correct action name for Node.js 24 support
615b319 chore: release v6.0.0 for Node.js 24 support
017748b Merge pull request #744 from actions/fix-storage-blob
38d4c79 chore: rebuild dist
7d27270 chore: add missing license cache files for @actions/core, @actions/io, and mi...
5f643d3 chore: update license files for @actions/artifact@5.0.1 dependencies
1df1684 chore: update package-lock.json with @actions/artifact@5.0.1
b5b1a91 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
Additional commits viewable in compare view

Updates actions/download-artifact from 6.0.0 to 7.0.0

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

New Contributors

@patrikpolyak made their first contribution in actions/download-artifact#440

@salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

Commits

37930b1 Merge pull request #452 from actions/download-artifact-v7-release
72582b9 doc: update readme
0d2ec9d chore: release v7.0.0 for Node.js 24 support
fd7ae8f Merge pull request #451 from actions/fix-storage-blob
d484700 chore: restore minimatch.dep.yml license file
03a8080 chore: remove obsolete dependency license files
56fe6d9 chore: update @actions/artifact license file to 5.0.1
8e3ebc4 chore: update package-lock.json with @actions/artifact@5.0.1
1e3c4b4 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
458627d chore: use local @actions/artifact package for Node.js 24 testing
Additional commits viewable in compare view

Updates codecov/codecov-action from 5.5.1 to 5.5.2

Release notes

Sourced from codecov/codecov-action's releases.

v5.5.2

What's Changed

check gpg only when skip-validation = false by @maxweng-sentry in codecov/codecov-action#1894

chore: disable_search alignment by @freemanzMrojo in codecov/codecov-action#1881

chore(release): 5.5.2 by @thomasrockhu-codecov in codecov/codecov-action#1902

New Contributors

@maxweng-sentry made their first contribution in codecov/codecov-action#1894

@freemanzMrojo made their first contribution in codecov/codecov-action#1881

Full Changelog: codecov/codecov-action@v5.5.1...v5.5.2

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

fix: overwrite pr number on fork by @thomasrockhu-codecov in codecov/codecov-action#1871

build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @app/dependabot in codecov/codecov-action#1868

build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by @app/dependabot in codecov/codecov-action#1867

fix: update to use local app/ dir by @thomasrockhu-codecov in codecov/codecov-action#1872

docs: fix typo in README by @datalater in codecov/codecov-action#1866

Document a codecov-cli version reference example by @webknjaz in codecov/codecov-action#1774

build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by @app/dependabot in codecov/codecov-action#1861

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @app/dependabot in codecov/codecov-action#1833

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

feat: upgrade wrapper to 0.2.4 by @jviall in codecov/codecov-action#1864

Pin actions/github-script by Git SHA by @martincostello in codecov/codecov-action#1859

fix: check reqs exist by @joseph-sentry in codecov/codecov-action#1835

fix: Typo in README by @spalmurray in codecov/codecov-action#1838

docs: Refine OIDC docs by @spalmurray in codecov/codecov-action#1837

build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @app/dependabot in codecov/codecov-action#1829

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by @app/dependabot in codecov/codecov-action#1822

fix: OIDC on forks by @joseph-sentry in codecov/codecov-action#1823

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

671740a chore(release): 5.5.2 (#1902)
96b38e9 chore: disable_search alignment (#1881)
9b6d1f8 check gpg only when skip-validation = false (#1894)
See full diff in compare view

Updates github/codeql-action from 4.31.2 to 4.31.9

Release notes

Sourced from github/codeql-action's releases.

v4.31.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.9 - 16 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.8 - 11 Dec 2025

Update default CodeQL bundle version to 2.23.8. #3354

See the full CHANGELOG.md for more information.

v4.31.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.7 - 05 Dec 2025

Update default CodeQL bundle version to 2.23.7. #3343

See the full CHANGELOG.md for more information.

v4.31.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.5 - 24 Nov 2025

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.31.9 - 16 Dec 2025

No user facing changes.

4.31.8 - 11 Dec 2025

Update default CodeQL bundle version to 2.23.8. #3354

4.31.7 - 05 Dec 2025

Update default CodeQL bundle version to 2.23.7. #3343

4.31.6 - 01 Dec 2025

No user facing changes.

4.31.5 - 24 Nov 2025

Update default CodeQL bundle version to 2.23.6. #3321

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.

Update default CodeQL bundle version to 2.23.5. #3288

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

Bump minimum CodeQL bundle version to 2.17.6. #3223

When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

... (truncated)

Commits

5d4e8d1 Merge pull request #3371 from github/update-v4.31.9-998798e34
1dc115f Update changelog for v4.31.9
998798e Merge pull request #3352 from github/nickrolfe/jar-min-ff-cleanup
5eb7519 Merge pull request #3358 from github/henrymercer/database-upload-telemetry
d29eddb Extract version number to constant
e962687 Merge branch 'main' into henrymercer/database-upload-telemetry
19c7f96 Rename isOverlayBase
ae5de9a Use getErrorMessage in log too
0cb8633 Prefer performance.now()
c07cc0d Merge pull request #3351 from github/henrymercer/ghec-dr-determine-tools-vers...
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.11.1 to 3.12.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.12.0

Deprecate install input by @crazy-max in docker/setup-buildx-action#455

Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/setup-buildx-action#434

Bump brace-expansion from 1.1.11 to 1.1.12 in docker/setup-buildx-action#436

Bump form-data from 2.5.1 to 2.5.5 in docker/setup-buildx-action#432

Bump undici from 5.28.4 to 5.29.0 in docker/setup-buildx-action#435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

Commits

8d2750c Merge pull request #455 from crazy-max/install-deprecated
e81846b deprecate install input
65d18f8 Merge pull request #454 from docker/dependabot/github_actions/actions/checkout-6
000d75d build(deps): bump actions/checkout from 5 to 6
1583c0f Merge pull request #443 from nicolasleger/patch-1
ed158e7 doc: bump actions/checkout from 4 to 5
4cc794f Merge pull request #441 from docker/dependabot/github_actions/actions/checkout-5
4dfc3d6 build(deps): bump actions/checkout from 4 to 5
af1b253 Merge pull request #440 from crazy-max/k3s-build
3c6ab92 ci: k3s test with latest buildx
Additional commits viewable in compare view

Updates aws-actions/configure-aws-credentials from 5.1.0 to 5.1.1

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v5.1.1

5.1.1 (2025-11-24)

Miscellaneous Chores

release 5.1.1 (56d6a58)

various dependency updates

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.1.1 (2025-11-24)

Miscellaneous Chores

release 5.1.1 (56d6a58)

5.1.0 (2025-10-06)

Features

Add global timeout support (#1487) (1584b8b)

add no-proxy support (#1482) (dde9b22)

Improve debug logging in retry logic (#1485) (97ef425)

Bug Fixes

properly expose getProxyForUrl (introduced in #1482) (#1486) (cea4298)

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

Cleanup input handling. Changes invalid boolean input behavior (see #1445)

Features

add skip OIDC option (#1458) (8c45f6b)

Cleanup input handling. Changes invalid boolean input behavior (see #1445) (74b3e27)

support account id allowlist (#1456) (c4be498)

4.3.1 (2025-08-04)

Bug Fixes

update readme to 4.3.1 (#1424) (be2e7ad)

4.3.0 (2025-08-04)

Features

... (truncated)

Commits

61815dc chore(main): release 5.1.1 (#1564)
56d6a58 chore: release 5.1.1
4a54c24 chore(deps-dev): bump glob from 10.4.5 to 10.5.0 (#1563)
b2793c9 chore(deps-dev): bump @types/node from 24.10.0 to 24.10.1 (#1559)
8c230bf chore: Update dist
f7a5b07 chore(deps): bump @aws-sdk/client-sts from 3.928.0 to 3.933.0 (#1558)
730fc04 chore(deps-dev): bump @biomejs/biome from 2.3.4 to 2.3.6 (#1555)
bc0dd36 chore(deps-dev): bump memfs from 4.50.0 to 4.51.0 (#1556)
f2964c7 chore: Update dist
cf46495 chore(deps): bump @aws-sdk/client-sts from 3.922.0 to 3.928.0 (#1548)
Additional commits viewable in compare view

Updates sillsdev/FieldWorks/.github/workflows/CommitMessage.yml from 2eac8948da8a78df13d469a2287ca309b891d62d to 673ca3760ac775af8c532bdd3a426cf0cd33e9c4

Commits

673ca37 LT-22227: Fix crash when using "Duplicate Affix Slot"
3207c4d Name ProDotNetZip.dll when copying (#597)
81c940a Update to ProDotNetZip 1.20 (#563)
0b29d7f LT-22331: Pop-up Lexicon Edit pane in Interlinear view (#596)
7d67a60 LT-22309: Fix RAMP error loading System.IO.Compression
0c9ec79 LT-22265: Hide Invalid Columns in Bulk Edit Phoneme Features (#516)
f061807 LT-21499: Implement DataTreeDelete in Pub/Sub system
3cce920 LT-21478: Move HandleLocalHotlink to Pub/Sub
1508661 Fix width of criteria dropdown in complex concordance (#592)
7f0a17c LT-21522: Implement RestoreScrollPosition in Pub/Sub system
Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.8.1 to 4.8.2

Release notes

Sourced from actions/dependency-review-action's releases.

v4.8.2

Minor fixes:

Fix PURL parsing for scoped packages (#1008 from @danielhardej)

Fix for large summaries (#1007 from @gitulisca)

README includes a working example for allow-dependencies-licenses (#1009 from @danielhardej)

Commits

3c4e3dc Merge pull request #1016 from actions/dra-release
02930b2 Update CONTRIBUTING to reflect new guidelines
49ffd9f Update CONTRIBUTING to reflect the need to build
70cb25e 4.8.2 release
ebabd31 Merge pull request #1008 from danielhardej/danielhardej-patch-20251023
19f9360 Update package-lock.json
5fd2f98 Bump @types/jest to version 29.5.14
28647f4 Fix PURL parsing by removing encodeURI
f620fd1 Merge pull request #1013 from actions/dangoor/token-fix
9b42b7e Remove bad token reference
Additional commits viewable in compare view

Updates actions/setup-node from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-node's releases.

v6.1.0

What's Changed

Enhancement:

Remove always-auth configuration handling by @priyagupta108 in actions/setup-node#1436

Dependency updates:

Upgrade @actions/cache from 4.0.3 to 4.1.0 by @dependabot[bot] in actions/setup-node#1384

Upgrade actions/checkout from 5 to 6 by @dependabot[bot] in actions/setup-node#1439

Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in actions/setup-node#1435

Documentation update:

Add example for restore-only cache in documentation by @aparnajyothi-y in actions/setup-node#1419

Full Changelog: actions/setup-node@v6...v6.1.0

Commits

395ad32 Bump js-yaml from 3.14.1 to 3.14.2 (#1435)
a4d2e2b Bump actions/checkout from 5 to 6 (#1439)
b9b25d4 Remove always-auth configuration handling from action (#1436)
633bb92 Bump @actions/cache from 4.0.3 to 4.1.0 (#1384)
dda4788 Add example for restore-only cache in documentation (#1419)
See full diff in compare view

Updates actions/setup-python from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-python's releases.

v6.1.0

What's Changed

Enhancements:

Add support for pip-install input by @gowridurgad in actions/setup-python#1201

Add graalpy early-access and windows builds by @timfel in actions/setup-python#880

Dependency and Documentation updates:

Enhanced wording and updated example usage for allow-prereleases by @yarikoptic in actions/setup-python#979

Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by @dependabot in actions/setup-python#1139

Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by @dependabot in actions/setup-python#1094

Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by @dependabot in actions/setup-python#1199

Upgrade requests from 2.32.2 to 2.32.4 by @dependabot in actions/setup-python#1130

Upgrade prettier f...
Description has been truncated

This change is

Bumps the gha-deps group with 13 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.13.2` | `2.14.0` | | [actions/checkout](https://github.com/actions/checkout) | `5.0.0` | `6.0.1` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.0.0` | `5.0.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5.0.0` | `6.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `6.0.0` | `7.0.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.1` | `5.5.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.31.2` | `4.31.9` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.11.1` | `3.12.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `5.1.0` | `5.1.1` | | [sillsdev/FieldWorks/.github/workflows/CommitMessage.yml](https://github.com/sillsdev/fieldworks) | `2eac8948da8a78df13d469a2287ca309b891d62d` | `673ca3760ac775af8c532bdd3a426cf0cd33e9c4` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.8.1` | `4.8.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.0.0` | `6.1.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.0.0` | `6.1.0` | Updates `step-security/harden-runner` from 2.13.2 to 2.14.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@95d9a5d...20cf305) Updates `actions/checkout` from 5.0.0 to 6.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@08c6903...8e8c483) Updates `actions/setup-dotnet` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@d4c9434...2016bd2) Updates `actions/upload-artifact` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...b7c566a) Updates `actions/download-artifact` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@018cc2c...37930b1) Updates `codecov/codecov-action` from 5.5.1 to 5.5.2 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@5a10915...671740a) Updates `github/codeql-action` from 4.31.2 to 4.31.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@0499de3...5d4e8d1) Updates `docker/setup-buildx-action` from 3.11.1 to 3.12.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@e468171...8d2750c) Updates `aws-actions/configure-aws-credentials` from 5.1.0 to 5.1.1 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@0094301...61815dc) Updates `sillsdev/FieldWorks/.github/workflows/CommitMessage.yml` from 2eac8948da8a78df13d469a2287ca309b891d62d to 673ca3760ac775af8c532bdd3a426cf0cd33e9c4 - [Release notes](https://github.com/sillsdev/fieldworks/releases) - [Commits](sillsdev/FieldWorks@2eac894...673ca37) Updates `actions/dependency-review-action` from 4.8.1 to 4.8.2 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@40c09b7...3c4e3dc) Updates `actions/setup-node` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@2028fbc...395ad32) Updates `actions/setup-python` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@e797f83...83679a8) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-deps - dependency-name: actions/checkout dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha-deps - dependency-name: actions/setup-dotnet dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-deps - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha-deps - dependency-name: actions/download-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha-deps - dependency-name: codecov/codecov-action dependency-version: 5.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-deps - dependency-name: github/codeql-action dependency-version: 4.31.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-deps - dependency-name: docker/setup-buildx-action dependency-version: 3.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-deps - dependency-name: aws-actions/configure-aws-credentials dependency-version: 5.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-deps - dependency-name: sillsdev/FieldWorks/.github/workflows/CommitMessage.yml dependency-version: 673ca3760ac775af8c532bdd3a426cf0cd33e9c4 dependency-type: direct:production dependency-group: gha-deps - dependency-name: actions/dependency-review-action dependency-version: 4.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-deps - dependency-name: actions/setup-node dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-deps - dependency-name: actions/setup-python dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-deps ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-01-01T00:31:40Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-01-01T00:31:56Z

⚠️ Commit Message Format Issues ⚠️

commit b417432e5d:
7: B1 Line exceeds max length (103>80): "| step-security/harden-runner | 2.13.2 | 2.14.0 |"
9: B1 Line exceeds max length (87>80): "| actions/setup-dotnet | 5.0.0 | 5.0.1 |"
10: B1 Line exceeds max length (93>80): "| actions/upload-artifact | 5.0.0 | 6.0.0 |"
11: B1 Line exceeds max length (97>80): "| actions/download-artifact | 6.0.0 | 7.0.0 |"
12: B1 Line exceeds max length (91>80): "| codecov/codecov-action | 5.5.1 | 5.5.2 |"
13: B1 Line exceeds max length (89>80): "| github/codeql-action | 4.31.2 | 4.31.9 |"
14: B1 Line exceeds max length (101>80): "| docker/setup-buildx-action | 3.11.1 | 3.12.0 |"
15: B1 Line exceeds max length (121>80): "| aws-actions/configure-aws-credentials | 5.1.0 | 5.1.1 |"
16: B1 Line exceeds max length (191>80): "| sillsdev/FieldWorks/.github/workflows/CommitMessage.yml | 2eac8948da8a78df13d469a2287ca309b891d62d | 673ca3760ac775af8c532bdd3a426cf0cd33e9c4 |"
17: B1 Line exceeds max length (111>80): "| actions/dependency-review-action | 4.8.1 | 4.8.2 |"
18: B1 Line exceeds max length (83>80): "| actions/setup-node | 6.0.0 | 6.1.0 |"
19: B1 Line exceeds max length (87>80): "| actions/setup-python | 6.0.0 | 6.1.0 |"
24: B1 Line exceeds max length (151>80): "- Commits"
29: B1 Line exceeds max length (140>80): "- Commits"
33: B1 Line exceeds max length (144>80): "- Commits"
37: B1 Line exceeds max length (147>80): "- Commits"
41: B1 Line exceeds max length (149>80): "- Commits"
46: B1 Line exceeds max length (146>80): "- Commits"
51: B1 Line exceeds max length (144>80): "- Commits"
55: B1 Line exceeds max length (150>80): "- Commits"
58: B1 Line exceeds max length (84>80): "- Release notes"
59: B1 Line exceeds max length (94>80): "- Changelog"
60: B1 Line exceeds max length (161>80): "- Commits"
62: B1 Line exceeds max length (155>80): "Updates sillsdev/FieldWorks/.github/workflows/CommitMessage.yml from 2eac8948da8a78df13d469a2287ca309b891d62d to 673ca3760ac775af8c532bdd3a426cf0cd33e9c4"
64: B1 Line exceeds max length (143>80): "- Commits"
68: B1 Line exceeds max length (156>80): "- Commits"
72: B1 Line exceeds max length (142>80): "- Commits"
76: B1 Line exceeds max length (144>80): "- Commits"

codecov · 2026-01-01T00:34:42Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.57%. Comparing base (f78ef22) to head (b417432).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4074   +/-   ##
=======================================
  Coverage   74.57%   74.57%           
=======================================
  Files         295      295           
  Lines       10938    10938           
  Branches     1372     1372           
=======================================
  Hits         8157     8157           
  Misses       2385     2385           
  Partials      396      396

Flag	Coverage Δ
backend	`85.59% <ø> (ø)`
frontend	`66.02% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Bump the gha-deps group with 13 updates #4074

Bump the gha-deps group with 13 updates #4074

Uh oh!

dependabot bot commented on behalf of github Jan 1, 2026 •

edited by jasonleenaylor

Loading

Uh oh!

coderabbitai bot commented Jan 1, 2026

Review skipped

Uh oh!

github-actions bot commented Jan 1, 2026

Uh oh!

codecov bot commented Jan 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Bump the gha-deps group with 13 updates #4074

Are you sure you want to change the base?

Bump the gha-deps group with 13 updates #4074

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 1, 2026 • edited by jasonleenaylor Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.14.0

What's Changed

v2.13.3

What's Changed

v6.0.1

What's Changed

v6.0.0

What's Changed

v6-beta

What's Changed

v5.0.1

What's Changed

Changelog

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v5.0.1

What's Changed

v6.0.0

v6 - What's new

Node.js 24

What's Changed

v7.0.0

v7 - What's new

Node.js 24

What's Changed

New Contributors

v5.5.2

What's Changed

New Contributors

v5.5.2

What's Changed

v5.5.1

What's Changed

v5.5.0

What's Changed

v5.4.3

What's Changed

v5.4.2

v4.31.9

CodeQL Action Changelog

4.31.9 - 16 Dec 2025

v4.31.8

CodeQL Action Changelog

4.31.8 - 11 Dec 2025

v4.31.7

CodeQL Action Changelog

4.31.7 - 05 Dec 2025

v4.31.6

CodeQL Action Changelog

4.31.6 - 01 Dec 2025

v4.31.5

CodeQL Action Changelog

4.31.5 - 24 Nov 2025

CodeQL Action Changelog

[UNRELEASED]

4.31.9 - 16 Dec 2025

4.31.8 - 11 Dec 2025

4.31.7 - 05 Dec 2025

4.31.6 - 01 Dec 2025

4.31.5 - 24 Nov 2025

4.31.4 - 18 Nov 2025

4.31.3 - 13 Nov 2025

4.31.2 - 30 Oct 2025

dependabot bot commented on behalf of github Jan 1, 2026 •

edited by jasonleenaylor

Loading

codecov bot commented Jan 1, 2026 •

edited

Loading