chore(deps): bump the github-actions group with 5 updates by dependabot[bot] · Pull Request #23 · zircote/rust-template

dependabot · 2026-02-23T16:49:09Z

Bumps the github-actions group with 5 updates:

Package	From	To
taiki-e/install-action	`2.67.30`	`2.68.8`
github/codeql-action	`4.32.3`	`4.32.4`
github/gh-aw	`0.47.1`	`0.49.4`
orhun/git-cliff-action	`4.7.0`	`4.7.1`
actions/stale	`10.1.1`	`10.2.0`

Updates taiki-e/install-action from 2.67.30 to 2.68.8

Release notes

Sourced from taiki-e/install-action's releases.

2.68.8

Update cargo-nextest@latest to 0.9.129.

Update mise@latest to 2026.2.19.

Update tombi@latest to 0.7.32.

2.68.7

Update mise@latest to 2026.2.18.

Update wasm-bindgen@latest to 0.2.111.

2.68.6

Update wasm-bindgen@latest to 0.2.110.

2.68.5

Update wasm-bindgen@latest to 0.2.109.

2.68.4

Update cargo-nextest@latest to 0.9.128.

2.68.3

Update mise@latest to 2026.2.17.

Update cargo-tarpaulin@latest to 0.35.2.

Update syft@latest to 1.42.1.

2.68.2

Update uv@latest to 0.10.4.

Update tombi@latest to 0.7.31.

Update rclone@latest to 1.73.1.

2.68.1

Update mise@latest to 2026.2.15.

Update tombi@latest to 0.7.30.

Update knope@latest to 0.22.3.

2.68.0

Support gungraun-runner. (#1520, thanks @gamma0987)

Update uv@latest to 0.10.3.

Update typos@latest to 1.43.5.

Update tombi@latest to 0.7.29.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.68.8] - 2026-02-23

Update cargo-nextest@latest to 0.9.129.

Update mise@latest to 2026.2.19.

Update tombi@latest to 0.7.32.

[2.68.7] - 2026-02-22

Update mise@latest to 2026.2.18.

Update wasm-bindgen@latest to 0.2.111.

[2.68.6] - 2026-02-21

Update wasm-bindgen@latest to 0.2.110.

[2.68.5] - 2026-02-20

Update wasm-bindgen@latest to 0.2.109.

[2.68.4] - 2026-02-20

Update cargo-nextest@latest to 0.9.128.

[2.68.3] - 2026-02-19

Update mise@latest to 2026.2.17.

Update cargo-tarpaulin@latest to 0.35.2.

Update syft@latest to 1.42.1.

[2.68.2] - 2026-02-18

Update uv@latest to 0.10.4.

... (truncated)

Commits

cfdb446 Release 2.68.8
350f13b Update cargo-nextest@latest to 0.9.129
8ba6ecc Update mise@latest to 2026.2.19
cf80594 Update tombi@latest to 0.7.32
f92912f Release 2.68.7
4970026 Update mise@latest to 2026.2.18
6043f02 Update wasm-bindgen@latest to 0.2.111
470679b Release 2.68.6
6d8a751 Update wasm-bindgen@latest to 0.2.110
71b4839 Release 2.68.5
Additional commits viewable in compare view

Updates github/codeql-action from 4.32.3 to 4.32.4

Release notes

Sourced from github/codeql-action's releases.

v4.32.4

Update default CodeQL bundle version to 2.24.2. #3493

Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473

When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #3486

Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #3485

Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. #3484

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.32.4 - 20 Feb 2026

Update default CodeQL bundle version to 2.24.2. #3493

Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473

When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #3486

Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #3485

Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. #3484

4.32.3 - 13 Feb 2026

Added experimental support for testing connections to private package registries. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. #3466

4.32.2 - 05 Feb 2026

Update default CodeQL bundle version to 2.24.1. #3460

4.32.1 - 02 Feb 2026

A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422

Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

4.32.0 - 26 Jan 2026

Update default CodeQL bundle version to 2.24.0. #3425

4.31.11 - 23 Jan 2026

When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409

Improved error handling throughout the CodeQL Action. #3415

Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318

The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403

4.31.10 - 12 Jan 2026

Update default CodeQL bundle version to 2.23.9. #3393

4.31.9 - 16 Dec 2025

No user facing changes.

4.31.8 - 11 Dec 2025

... (truncated)

Commits

89a39a4 Merge pull request #3494 from github/update-v4.32.4-39ba80c47
e5d84c8 Apply remaining review suggestions
0c20209 Apply suggestions from code review
314172e Fix typo
cdda72d Add changelog entries
cfda84c Update changelog for v4.32.4
39ba80c Merge pull request #3493 from github/update-bundle/codeql-bundle-v2.24.2
00150da Add changelog note
d97dce6 Update default bundle to codeql-bundle-v2.24.2
50fdbb9 Merge pull request #3492 from github/henrymercer/new-repository-properties-ff
Additional commits viewable in compare view

Updates github/gh-aw from 0.47.1 to 0.49.4

Release notes

Sourced from github/gh-aw's releases.

v0.49.4

🔧 Release Highlights

This maintenance release delivers targeted bug fixes for Playwright integration and internal test reliability improvements.

🐛 Bug Fixes & Improvements

Playwright --no-sandbox argument fix — Corrected the --no-sandbox flag handling so Playwright workflows launch reliably in sandboxed GitHub Actions runners. (#17861)

Shell quoting for awf --allow-domains/--block-domains — Fixed SC1003 shell quoting issue: domain arguments are now correctly double-quoted, preventing unexpected word-splitting in firewall rules. (#17861)

Test isolation for workflow ID env vars — GITHUB_RUN_ID and GH_AW_WORKFLOW_ID are now cleared between test cases in messages.test.cjs, eliminating intermittent test failures caused by leaked state. (#17857)

For complete details, see CHANGELOG.

Generated by Release

What's Changed

fix(tests): clear GITHUB_RUN_ID/GH_AW_WORKFLOW_ID in messages.test.cjs beforeEach by @Copilot in github/gh-aw#17857

[specs] Update layout specification - 2026-02-23 by @github-actions[bot] in github/gh-aw#17860

[docs] Update glossary - weekly full scan by @github-actions[bot] in github/gh-aw#17877

Fix SC1003: use double quotes for awf --allow-domains/--block-domains arguments; fix playwright --no-sandbox arg by @Copilot in github/gh-aw#17861

Full Changelog: github/gh-aw@v0.49.3...v0.49.4

v0.49.3

🌟 Release Highlights

This release brings a new workflow control option to quiet bot comments, improved engine icons, and reliability fixes for download scripts — plus two community-requested improvements.

✨ What's New

Silence activation comments — The new activation-comments: false frontmatter flag lets you disable the bot comments gh-aw posts when activating or falling back on a workflow. Useful for keeping issue/PR comment threads clean. (#17834)

Engine icons for Claude, Codex & Gemini — Local icon assets are now bundled for Claude, Codex, and Gemini alongside a Gemini author entry, giving workflow UIs a consistent visual identity across all supported engines. (#17837)

Community contributor celebration in release highlights — The release highlight generator now cross-references community-labeled issues with merged PRs and explicitly calls out the issue authors. (#17842)

🐛 Bug Fixes & Improvements

web-fetch MCP fix — The web-fetch MCP server was incorrectly generating a container format instead of the expected command/args structure, preventing it from initializing. (#17822)

Duplicate code detector — The detector now correctly emits a noop safe output when no duplication is found, avoiding spurious failures. (#17836)

Retry on transient download failures — Install scripts now pass --retry 3 --retry-delay 5 to curl when downloading the Copilot CLI and AWF binary, automatically recovering from the occasional 502 on public runners. (#17841)

📚 Documentation

Clarified that CLAUDE_CODE_OAUTH_TOKEN is not a supported authentication method. (#17835)

Updated reference documentation with the latest features. (#17830)

... (truncated)

Commits

bf34f99 Fix SC1003: use double quotes for awf --allow-domains/--block-domains argumen...
069d9f5 docs: update glossary with Lockdown Mode, AWF, and Sandbox terms (#17877)
2fd8b78 docs: update layout specification for 2026-02-23 (#17860)
d06df78 fix(tests): clear GITHUB_RUN_ID/GH_AW_WORKFLOW_ID in messages.test.cjs before...
cb678b4 Add --retry 3 with delay to curl downloads to handle transient 502s (#17841)
2f34639 feat: add activation-comments to disable activation/fallback bot comments (...
4094506 feat(release): celebrate community issue authors in release highlights (#17842)
bc1b728 fix(duplicate-code-detector): require noop when no duplication found (#17836)
42b6879 Add Gemini author and local icons for Claude, Codex, and Gemini (#17837)
6125b4b docs: clarify CLAUDE_CODE_OAUTH_TOKEN is not supported (#17835)
Additional commits viewable in compare view

Updates orhun/git-cliff-action from 4.7.0 to 4.7.1

Commits

c93ef52 chore(version): update git-cliff to 2.12.0
2032a55 docs(readme): add an example how to execute arbitrary git-cliff commands (#70)
See full diff in compare view

Updates actions/stale from 10.1.1 to 10.2.0

Release notes

Sourced from actions/stale's releases.

v10.2.0

What's Changed

Bug Fix

Fix checking state cache (fix #1136) and switch to Octokit helper methods by @itchyny in actions/stale#1152

Dependency Updates

Upgrade js-yaml from 4.1.0 to 4.1.1 by @dependabot in actions/stale#1304

Upgrade lodash from 4.17.21 to 4.17.23 by @dependabot in actions/stale#1313

Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by @chiranjib-swain in actions/stale#1312

New Contributors

@itchyny made their first contribution in actions/stale#1152

Full Changelog: actions/stale@v10...v10.2.0

Commits

b5d41d4 build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#1313)
dcd2b94 Fix punycode and url.parse Deprecation Warnings (#1312)
d6f8a33 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1304)
a21a081 Fix checking state cache (fix #1136), also switch to octokit methods (#1152)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.67.30` | `2.68.8` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.32.3` | `4.32.4` | | [github/gh-aw](https://github.com/github/gh-aw) | `0.47.1` | `0.49.4` | | [orhun/git-cliff-action](https://github.com/orhun/git-cliff-action) | `4.7.0` | `4.7.1` | | [actions/stale](https://github.com/actions/stale) | `10.1.1` | `10.2.0` | Updates `taiki-e/install-action` from 2.67.30 to 2.68.8 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@288875d...cfdb446) Updates `github/codeql-action` from 4.32.3 to 4.32.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9e907b5...89a39a4) Updates `github/gh-aw` from 0.47.1 to 0.49.4 - [Release notes](https://github.com/github/gh-aw/releases) - [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md) - [Commits](github/gh-aw@c94abee...bf34f99) Updates `orhun/git-cliff-action` from 4.7.0 to 4.7.1 - [Release notes](https://github.com/orhun/git-cliff-action/releases) - [Commits](orhun/git-cliff-action@e16f179...c93ef52) Updates `actions/stale` from 10.1.1 to 10.2.0 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@9971854...b5d41d4) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.68.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.32.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/gh-aw dependency-version: 0.49.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: orhun/git-cliff-action dependency-version: 4.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/stale dependency-version: 10.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-02-23T16:49:10Z

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-02-23T17:00:30Z

Benchmark Results

No benchmarks configured. Add benchmarks to benches/ directory.

Full results available in CI artifacts.

…98f0b19

github-actions · 2026-02-24T14:17:30Z

Benchmark Results

No benchmarks configured. Add benchmarks to benches/ directory.

Full results available in CI artifacts.

dependabot bot requested a review from zircote as a code owner February 23, 2026 16:49

Merge branch 'main' into dependabot/github_actions/github-actions-51b…

686946e

…98f0b19

zircote merged commit df1b1ef into main Feb 24, 2026
9 checks passed

zircote deleted the dependabot/github_actions/github-actions-51b98f0b19 branch February 24, 2026 14:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the github-actions group with 5 updates#23

chore(deps): bump the github-actions group with 5 updates#23
zircote merged 2 commits intomainfrom
dependabot/github_actions/github-actions-51b98f0b19

dependabot bot commented on behalf of github Feb 23, 2026 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Feb 23, 2026

Uh oh!

github-actions bot commented Feb 23, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.68.8

2.68.7

2.68.6

2.68.5

2.68.4

2.68.3

2.68.2

2.68.1

2.68.0

Changelog

[Unreleased]

[2.68.8] - 2026-02-23

[2.68.7] - 2026-02-22

[2.68.6] - 2026-02-21

[2.68.5] - 2026-02-20

[2.68.4] - 2026-02-20

[2.68.3] - 2026-02-19

[2.68.2] - 2026-02-18

v4.32.4

CodeQL Action Changelog

[UNRELEASED]

4.32.4 - 20 Feb 2026

4.32.3 - 13 Feb 2026

4.32.2 - 05 Feb 2026

4.32.1 - 02 Feb 2026

4.32.0 - 26 Jan 2026

4.31.11 - 23 Jan 2026

4.31.10 - 12 Jan 2026

4.31.9 - 16 Dec 2025

4.31.8 - 11 Dec 2025

v0.49.4

🔧 Release Highlights

🐛 Bug Fixes & Improvements

What's Changed

v0.49.3

🌟 Release Highlights

✨ What's New

🐛 Bug Fixes & Improvements

📚 Documentation

v10.2.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Uh oh!

dependabot bot commented on behalf of github Feb 23, 2026

Labels

Uh oh!

github-actions bot commented Feb 23, 2026

Benchmark Results

Uh oh!

github-actions bot commented Feb 24, 2026

Benchmark Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Feb 23, 2026 •

edited

Loading