Bump the actions group across 1 directory with 7 updates

[dependabot]

Bumps the actions group with 7 updates in the / directory:

Package	From	To
actions/checkout	4	7
actions/setup-python	5	6
actions/cache/restore	5.0.5	6.1.0
actions/cache/save	5.0.5	6.1.0
step-security/harden-runner	2.19.1	2.19.4
trufflesecurity/trufflehog	3.95.3	3.95.6
actions/stale	10.2.0	10.3.0

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248
• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• v6-beta by @​ericsciple in actions/checkout#2298

... (truncated)

Commits

• 9c091bb update error wording (#2467)
• 1044a6d getting ready for checkout v7 release (#2464)
• f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
• d914b26 upgrade module to esm and update dependencies (#2463)
• 537c7ef Bump @​actions/core and @​actions/tool-cache and Remove uuid (#2459)
• 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
• 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
• 0f9f3aa Bump actions/publish-immutable-action (#2458)
• f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
• df4cb1c Update changelog for v6.0.3 (#2446)
• Additional commits viewable in compare view

Updates actions/setup-python from 5 to 6

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in actions/setup-python#1164

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

• Add support for pip-version by @​priyagupta108 in actions/setup-python#1129
• Enhance reading from .python-version by @​krystof-k in actions/setup-python#787
• Add version parsing from Pipfile by @​aradkdj in actions/setup-python#1067

Bug fixes:

• Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by @​aparnajyothi-y in actions/setup-python#1183
• Change missing cache directory error to warning by @​aparnajyothi-y in actions/setup-python#1182
• Add Architecture-Specific PATH Management for Python with --user Flag on Windows by @​aparnajyothi-y in actions/setup-python#1122
• Include python version in PyPy python-version output by @​cdce8p in actions/setup-python#1110
• Update docs: clarification on pip authentication with setup-python by @​priya-kinthali in actions/setup-python#1156

Dependency updates:

• Upgrade idna from 2.9 to 3.7 in /tests/data by @​dependabot[bot] in actions/setup-python#843
• Upgrade form-data to fix critical vulnerabilities #182 & #183 by @​aparnajyothi-y in actions/setup-python#1163
• Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by @​aparnajyothi-y in actions/setup-python#1165
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in actions/setup-python#1181
• Upgrade @​actions/tool-cache from 2.0.1 to 2.0.2 by @​dependabot[bot] in actions/setup-python#1095

New Contributors

• @​krystof-k made their first contribution in actions/setup-python#787
• @​cdce8p made their first contribution in actions/setup-python#1110
• @​aradkdj made their first contribution in actions/setup-python#1067

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

What's Changed

• Workflow updates related to Ubuntu 20.04 by @​aparnajyothi-y in actions/setup-python#1065
• Fix for Candidate Not Iterable Error by @​aparnajyothi-y in actions/setup-python#1082
• Upgrade semver and @​types/semver by @​dependabot in actions/setup-python#1091
• Upgrade prettier from 2.8.8 to 3.5.3 by @​dependabot in actions/setup-python#1046
• Upgrade ts-jest from 29.1.2 to 29.3.2 by @​dependabot in actions/setup-python#1081

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

What's Changed

Enhancements:

• Support free threaded Python versions like '3.13t' by @​colesbury in actions/setup-python#973
• Enhance Workflows: Include ubuntu-arm runners, Add e2e Testing for free threaded and Upgrade @​action/cache from 4.0.0 to 4.0.3 by @​priya-kinthali in actions/setup-python#1056
• Add support for .tool-versions file in setup-python by @​mahabaleshwars in actions/setup-python#1043

Bug fixes:

• Fix architecture for pypy on Linux ARM64 by @​mayeut in actions/setup-python#1011 This update maps arm64 to aarch64 for Linux ARM64 PyPy installations.

... (truncated)

Commits

• ece7cb0 Fix pip cache error handling on Windows. (#1040)
• 1d18d7a Update advanced-usage.md (#811)
• d2b357a Update dependency versions and test workflow configuration (#1322)
• 8f639b1 Merge pull request #1324 from jasongin/update-actions-cache-5.1.0
• 6731c2b Resolve high-severity audit issues
• 0cb1a84 Add RHEL support and include Linux distro in cache keys (#1323)
• dc6eab6 Update dist
• 6f4b74b Strict equality
• fa8bde1 Bump @​actions/cache to 5.1.0, log cache write denied
• c8813ba Upgrade @​actions dependencies and update licenses (#1303)
• Additional commits viewable in compare view

Updates actions/cache/restore from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache/restore's releases.

v6.1.0

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

• Update packages, migrate to ESM by @​Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache/restore's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

• Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token
• Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

• Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
• Migrated to ESM module system
• Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

• Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
• Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
• Bump fast-xml-parser to v5.5.6

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

• 55cc834 Merge pull request #1768 from jasongin/readonly-cache
• d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
• 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
• e9b91fd Prettier fixes
• e4884b8 Rebuild dist
• 10baf01 Fixed licenses
• e39b386 Fix test mock return order
• b692820 PR feedback
• 6074912 Rebuild dist bundles as ESM to match type:module
• 5a912e8 Fix lint and jest issues
• Additional commits viewable in compare view

Updates actions/cache/save from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache/save's releases.

v6.1.0

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

• Update packages, migrate to ESM by @​Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache/save's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

• Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token
• Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

• Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
• Migrated to ESM module system
• Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

• Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
• Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
• Bump fast-xml-parser to v5.5.6

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

• 55cc834 Merge pull request #1768 from jasongin/readonly-cache
• d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
• 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
• e9b91fd Prettier fixes
• e4884b8 Rebuild dist
• 10baf01 Fixed licenses
• e39b386 Fix test mock return order
• b692820 PR feedback
• 6074912 Rebuild dist bundles as ESM to match type:module
• 5a912e8 Fix lint and jest issues
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.19.1 to 2.19.4

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.4

What's Changed

• Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4

v2.19.3

What's Changed

• Default to audit mode when api-key missing with use-policy-store by @​varunsh-coder in step-security/harden-runner#665

Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3

v2.19.2

What's Changed

• Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2

Commits

• 9af89fc Merge pull request #667 from step-security/update-agent-v1.8.6
• 485dce8 Update agent to v1.8.6
• ab7a940 Merge pull request #665 from step-security/fix/use-policy-store-default-audit
• ec41b78 Default to audit mode when api-key missing with use-policy-store
• 9ca718d Merge pull request #664 from step-security/update-agent-v1.8.5
• 1dee3df Update agent to v1.8.5
• See full diff in compare view

Updates trufflesecurity/trufflehog from 3.95.3 to 3.95.6

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.6

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in trufflesecurity/trufflehog#5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in trufflesecurity/trufflehog#4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in trufflesecurity/trufflehog#4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in trufflesecurity/trufflehog#4994
• Update test containers dependency by @​trufflesteeeve in trufflesecurity/trufflehog#4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in trufflesecurity/trufflehog#5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in trufflesecurity/trufflehog#4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5008
• Updating Klaviyo PK new format by @​breetan in trufflesecurity/trufflehog#5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in trufflesecurity/trufflehog#5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in trufflesecurity/trufflehog#4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in trufflesecurity/trufflehog#5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in trufflesecurity/trufflehog#4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in trufflesecurity/trufflehog#4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in trufflesecurity/trufflehog#5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in trufflesecurity/trufflehog#4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in trufflesecurity/trufflehog#5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in trufflesecurity/trufflehog#5035

New Contributors

• @​Dawn-Fighter made their first contribution in trufflesecurity/trufflehog#4968
• @​Hackerchen716 made their first contribution in trufflesecurity/trufflehog#4994
• @​breetan made their first contribution in trufflesecurity/trufflehog#5009
• @​lukem-ts made their first contribution in trufflesecurity/trufflehog#5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in trufflesecurity/trufflehog#4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in trufflesecurity/trufflehog#4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in trufflesecurity/trufflehog#4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in trufflesecurity/trufflehog#4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in trufflesecurity/trufflehog#4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in trufflesecurity/trufflehog#4954
• Automate corpora testing in CI by @​mustansir14 in trufflesecurity/trufflehog#4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in trufflesecurity/trufflehog#4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in trufflesecurity/trufflehog#4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in trufflesecurity/trufflehog#4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in trufflesecurity/trufflehog#4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in trufflesecurity/trufflehog#4961

... (truncated)

Commits

• 30d5bb9 S3: surface bucket listing failures and fix multi-role object count (#5035)
• f0739f1 close todo - embed small HTTP test fixtures (#5001)
• 36d680a add filetype=sdist param so we get the correct response code (#4988)
• 248ffd5 fix(dropbox): prevent long sl.u. tokens from being truncated before verificat...
• afbdaa8 Fix: Resolve known dedup issues in notifierWorker (#5028)
• 7bcf376 [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat fla...
• 84a2b33 Fix Renovate lookup: update setup-captain version comment (#4999)
• ac0805e [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag...
• d03d087 GitHub finegrain analyzer was improperly handling errors (#4498)
• b64cefe set redacted value to last 4 characters of secret, to match how the secret ty...
• Additional commits viewable in compare view

Updates actions/stale from 10.2.0 to 10.3.0

Release notes

Sourced from actions/stale's releases.

v10.3.0

What's Changed

Bug Fix

• Enhancement: ignore stale labeling events by @​shamoon in actions/stale#1311

Dependency Updates

• Upgrade dependencies (@​actions/core, @​octokit/plugin-retry, @​typescript-eslint) by @​Copilot in actions/stale#1335

New Contributors

• @​shamoon made their first contribution in actions/stale#1311

Full Changelog: actions/stale@v10...v10.3.0

Commits

• eb5cf3a chore: upgrade dependencies and bump version to 10.3.0 (#1335)
• db5d06a Enhancement: ignore stale labeling events (#1311)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions