Bump the actions-minor group across 1 directory with 2 updates by dependabot[bot] · Pull Request #4318 · github/codeql-action

dependabot · 2026-11-11T17:56:10Z

Bumps the actions-minor group with 2 updates in the /.github/workflows directory: actions/setup-dotnet and actions/setup-java.

Updates actions/setup-dotnet from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.1.0

What's Changed

Enhancements

Add check-latest input to reuse a locally installed .NET SDK and skip network calls by @v-mahabaleshwars in actions/setup-dotnet#774

Add skip-lts-prepass input to optimize .NET SDK installation process by @v-chiranjib-swain in actions/setup-dotnet#791

Add fallback install directory when default is not writable by @v-priyagupta108 in actions/setup-dotnet#785

Documentation

Document sdk.version validation for rollForward in global.json by @v-priyagupta108 in actions/setup-dotnet#763

Docs: Add Microsoft docs link for dotnet-quality options by @v-priyagupta108 in actions/setup-dotnet#773

Docs: Updating Documentation in README by @v-lmvysakh in actions/setup-dotnet#776

Clarify dotnet-quality behavior for multiple SDK versions by @v-mahabaleshwars in actions/setup-dotnet#780

Dependency Updates

Fix security vulnerabilities by @v-HarithaVattikuti in actions/setup-dotnet#767

ci: make validation caches read-only by @philip-gai in actions/setup-dotnet#777

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#764

Bump browserslist from 4.28.2 to 4.28.8 by @dependabot in actions/setup-dotnet#781

Bump eslint from 10.5.0 to 10.11.0 by @dependabot in actions/setup-dotnet#772

Bump eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-dotnet#771

Bump undici from 6.28.0 to 6.29.1 by @dependabot in actions/setup-dotnet#784

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#788

Bump handlebars from 4.7.9 to 4.7.10 by @dependabot in actions/setup-dotnet#792

Bump brace-expansion by @dependabot in actions/setup-dotnet#790

Prepare v6.1.0 release with updated cache dependency by @v-HarithaVattikuti in actions/setup-dotnet#798

New Contributors

@v-lmvysakh made their first contribution in actions/setup-dotnet#776

@v-chiranjib-swain made their first contribution in actions/setup-dotnet#791

Full Changelog: actions/setup-dotnet@v6.0.0...v6.1.0

Commits

0f4a354 Prepare v6.1.0 release with updated cache dependency (#798)
6ec5c6b Add fallback install directory when default is not writable (#785)
62573f4 Bump brace-expansion (#790)
67290a9 Bump handlebars from 4.7.9 to 4.7.10 (#792)
0072421 Bump actions/checkout from 7.0.0 to 7.0.1 (#788)
9ead317 Bump undici from 6.28.0 to 6.29.1 (#784)
349aa19 Add skip-lts-prepass input to optimize .NET SDK installation process (#791)
e2cf7c6 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#771)
7576362 Bump eslint from 10.5.0 to 10.11.0 (#772)
074373f Add check-latest input to reuse a locally installed .NET SDK and skip network...
Additional commits viewable in compare view

Updates actions/setup-java from 6.1.0 to 6.2.0

Release notes

Sourced from actions/setup-java's releases.

v6.2.0

What's Changed

Fix Liberica SDKMAN patch release resolution by @brunoborges in actions/setup-java#1291

Update Undici to 6.29.1 by @brunoborges in actions/setup-java#1308

chore(deps): bump the monthly-npm-updates group with 12 updates by @dependabot[bot] in actions/setup-java#1309

Fix Liberica Java 25 release resolution by @brunoborges in actions/setup-java#1313

Add repository-specific Copilot instructions by @brunoborges in actions/setup-java#1312

Support exact Corretto release versions by @electrum in actions/setup-java#1310

Support Maven mirrors in generated settings.xml by @brunoborges in actions/setup-java#1289

New Contributors

@electrum made their first contribution in actions/setup-java#1310

Full Changelog: actions/setup-java@v6.1.0...v6.2.0

Commits

77dd5b2 Support Maven mirrors in generated settings.xml (#1289)
644a850 Support exact Corretto release versions (#1310)
dade0c5 Save uncommitted changes (#1312)
ef0b922 Fix Liberica Java 25 release resolution (#1313)
e144521 chore(deps): bump the monthly-npm-updates group with 12 updates (#1309)
8cd57eb Update Undici to 6.29.1 (#1308)
816722a Fix Liberica SDKMAN patch release resolution (#1291)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions-minor group with 2 updates in the /.github/workflows directory: [actions/setup-dotnet](https://github.com/actions/setup-dotnet) and [actions/setup-java](https://github.com/actions/setup-java). Updates `actions/setup-dotnet` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@a98b568...0f4a354) Updates `actions/setup-java` from 6.1.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b843ebf...77dd5b2) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: actions/setup-java dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

🟡 Changes recommended

Two active moderate findings remain because generated workflow pins are not synchronized with their source pins, risking regeneration inconsistencies and verification failures.

2 open issues

What changed in this PR

This pull request updates pinned GitHub Actions used by the repository's debug and generated workflow tests.

Changes:

Bumps actions/setup-dotnet from v6.0.0 to v6.1.0.
Bumps actions/setup-java from v6.1.0 to v6.2.0.
Updates the generated workflow references, while the corresponding source pins in pr-checks/sync.ts remain unchanged.

File	Description
.github/workflows/debug-artifacts-safe.yml	Updates the .NET setup action used by the safe debug-artifact workflow.
.github/workflows/debug-artifacts-failure-safe.yml	Updates the .NET setup action used by the failure-safe debug-artifact workflow.
.github/workflows/__with-checkout-path.yml	Updates the generated workflow action references.
.github/workflows/__upload-sarif.yml	Updates the generated SARIF workflow action references.
.github/workflows/__upload-ref-sha-input.yml	Updates the generated ref-SHA input workflow action references.
.github/workflows/__unset-environment.yml	Updates the generated environment-handling workflow action references.
.github/workflows/__swift-custom-build.yml	Updates the generated Swift custom-build workflow action references.
.github/workflows/__split-workflow.yml	Updates the generated split-workflow action references.
.github/workflows/__remote-config.yml	Updates the generated remote-configuration workflow action references.
.github/workflows/__packaging-inputs-js.yml	Updates the generated JavaScript packaging-inputs workflow action references.
.github/workflows/__packaging-config-js.yml	Updates the generated JavaScript packaging configuration workflow action references.
.github/workflows/__packaging-config-inputs-js.yml	Updates the generated packaging configuration-inputs workflow action references.
.github/workflows/__packaging-codescanning-config-inputs-js.yml	Updates the generated code-scanning packaging workflow action references.
.github/workflows/__multi-language-autodetect.yml	Updates the generated multi-language autodetection workflow action references.
.github/workflows/__local-bundle.yml	Updates the generated local-bundle workflow action references.
.github/workflows/__linux-arm64.yml	Updates the generated Linux ARM64 workflow action references.
.github/workflows/__go-custom-queries.yml	Updates the generated Go custom-queries workflow action references.
.github/workflows/__export-file-baseline-information.yml	Updates the generated baseline-information workflow action references.
.github/workflows/__build-mode-manual.yml	Updates the generated manual-build-mode workflow action references.
.github/workflows/__build-mode-autobuild.yml	Updates the generated Java autobuild workflow action references.
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml	Updates the generated direct-tracing workflow action references.
.github/workflows/__autobuild-action.yml	Updates the generated .NET autobuild workflow action references.
.github/workflows/__analyze-ref-input.yml	Updates the generated analyze-ref-input workflow action references.
.github/workflows/__all-platform-bundle.yml	Updates the generated all-platform bundle workflow action references.

_{Review effort: Lite (auto)}

        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0


        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6.2.0


github-actions · 2026-11-11T18:00:11Z

Pushed a commit to rebuild the Action. Please approve running the PR checks.

dependabot Bot requested a review from a team as a code owner November 11, 2026 17:56

dependabot Bot added the Rebuild Re-transpile JS & re-generate workflows label Nov 11, 2026

Copilot AI auto review requested due to automatic review settings November 11, 2026 17:56

github-actions Bot added the size/XS Should be very easy to review label Nov 11, 2026

Copilot started reviewing November 11, 2026 17:56

View session

github-actions Bot removed the Rebuild Re-transpile JS & re-generate workflows label Nov 11, 2026

Copilot AI reviewed Nov 11, 2026

View reviewed changes

Rebuild

3c3df83

Navigation Menu

Repository navigation

Bump the actions-minor group across 1 directory with 2 updates - #4318

Bump the actions-minor group across 1 directory with 2 updates#4318
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/dot-github/workflows/actions-minor-0f7f0ed164

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 11, 2026

v6.1.0

What's Changed

Enhancements

Documentation

Dependency Updates

New Contributors

v6.2.0

What's Changed

New Contributors

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant