chore: Bump the "dependencies" group with 5 updates across multiple ecosystems by dependabot[bot] · Pull Request #292 · OrcaCD/orca-cd

dependabot · 2026-09-12T06:08:45Z

Bumps the dependencies group in /backend with 10 updates:

Package	From	To
github.com/compose-spec/compose-go/v2	`2.14.0`	`2.15.0`
github.com/docker/cli	`29.7.2+incompatible`	`29.8.0+incompatible`
github.com/docker/compose/v5	`5.5.0`	`5.5.1`
github.com/go-jose/go-jose/v4	`4.1.4`	`4.1.5`
github.com/golang-migrate/migrate/v4	`4.19.1`	`4.20.1`
github.com/moby/moby/api	`1.55.0`	`1.56.0`
github.com/moby/moby/client	`0.5.1`	`0.6.0`
github.com/nicholas-fedor/shoutrrr	`0.19.0`	`0.20.0`
golang.org/x/oauth2	`0.36.0`	`0.37.0`
golang.org/x/time	`0.15.0`	`0.16.0`

Updates github.com/compose-spec/compose-go/v2 from 2.14.0 to 2.15.0

Release notes

Sourced from github.com/compose-spec/compose-go/v2's releases.

v2.15.0

What's Changed

Bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in compose-spec/compose-go#905

fix(override): merge ulimits into the base value by @vsaraikin in compose-spec/compose-go#907

loader: skip re-merge of identical resources imported through diamond includes by @davireis in compose-spec/compose-go#906

add @glours as codeowner by @glours in compose-spec/compose-go#916

Update README.md by @ndeloof in compose-spec/compose-go#917

fix(override): prevent panic on non-string list elements by @glours in compose-spec/compose-go#915

introduce Project.WithoutUnresolvedOptionalDependencies by @ndeloof in compose-spec/compose-go#922

fix(loader): guard versionWarning global against data races by @glours in compose-spec/compose-go#919

fix(types): avoid data race in WithServicesTransform by @glours in compose-spec/compose-go#920

replace uses of testify and update logrus to reduce indirect dependencies by @thaJeztah in compose-spec/compose-go#921

override: sequence merge ignores strictly-identical duplicate entries by @ndeloof in compose-spec/compose-go#924

fix(types): reject unrecognized pull_policy values instead of defaulting by @glours in compose-spec/compose-go#923

fix: ignore default .env probe on permission denied by @ndeloof in compose-spec/compose-go#925

test: cover short/long ulimit syntax combinations in override merge by @ndeloof in compose-spec/compose-go#912

tests: codify the testing contract by @ndeloof in compose-spec/compose-go#914

fix: merge attributes of repeated variable occurrences in ExtractVariables by @ndeloof in compose-spec/compose-go#911

cli: validate COMPOSE_FILE entries point to actual compose files by @ndeloof in compose-spec/compose-go#909

New Contributors

@vsaraikin made their first contribution in compose-spec/compose-go#907

@davireis made their first contribution in compose-spec/compose-go#906

Full Changelog: compose-spec/compose-go@v2.14.0...v2.15.0

Commits

4ddbf11 cli: validate COMPOSE_FILE entries point to actual compose files
500d50c fix: merge attributes of repeated variable occurrences in ExtractVariables
57f6c16 tests: run named table cases as subtests
261851b loader/tests: completeness test keeps the conformance matrix exhaustive
3843a20 loader/tests: link every attribute file to the spec section it locks
728b3f2 loader/tests: loadsAs expresses expectations as canonical YAML
f8211c4 docs: TESTING.md codifies the testing contract
95dbfdf test: cover short/long ulimit syntax combinations in override merge
5a10b5a fix: ignore default .env probe on permission denied
f0442ff fix(types): reject unrecognized pull_policy values instead of defaulting
Additional commits viewable in compare view

Updates github.com/docker/cli from 29.7.2+incompatible to 29.8.0+incompatible

Commits

88096ef Merge pull request #7288 from thaJeztah/bump_jose
c50ce17 vendor: github.com/go-jose/go-jose/v4 v4.1.5
cec24c7 Merge pull request #7285 from vvoland/update-docker
d5ea3bd vendor: github.com/moby/moby/client v0.6.0
7cf09ba vendor: github.com/moby/moby/api v1.56.0
6239084 Merge pull request #7108 from zhangyoufu/umask
45a3e0b e2e/container: Skip umask test until engine support
79dd1f4 Merge pull request #7284 from thaJeztah/trust_bump
32bfe54 cmd/docker-trust: update dependencies
d703697 cmd/docker-trust: fix tests
Additional commits viewable in compare view

Updates github.com/docker/compose/v5 from 5.5.0 to 5.5.1

Release notes

Sourced from github.com/docker/compose/v5's releases.

v5.5.1

What's Changed

✨ Improvements

Feat(hooks): capture and surface lifecycle hook output by @glours in docker/compose#14091

Feat(tracing): surface otel shutdown errors via --debug by @htoyoda18 in docker/compose#14152

🐛 Fixes

Fix(events): validate service names before subscribing to events by @glours in docker/compose#14076

Fix: bake target names collision for services differing by . vs _ by @ndeloof in docker/compose#14058

Fix(watch): sync into a symlinked directory instead of failing by @Endika in docker/compose#14084

Fix(hooks): include hook output in the error when a hook fails by @dennislapchenko in docker/compose#14088

Fix(build): TTY progress on Windows — hand the real stdout to buildkit by @ndeloof in docker/compose#14090

Fix(watch): sync all files on initial_sync, regardless of mtime by @glours in docker/compose#14096

Fix(network): pass IPAM options when creating networks by @glours in docker/compose#14094

Fix(ps): honor psFormat from Docker CLI config when no --format flag given by @glours in docker/compose#14095

Fix: dependency wait timeout surfaced only by luck by @ndeloof in docker/compose#14105

Fix: hold startMx on the start path actually exercised by @ndeloof in docker/compose#14106

Fix(watch): exclude Dockerfile and compose files from initial sync by @htoyoda18 in docker/compose#14117

Fix(display): stop ttyWriter.Done from hanging after context cancel by @glours in docker/compose#14119

Fix(build): honor provenance/sbom false in per-service bake attest by @glours in docker/compose#14112

Fix(compose): reject unknown subcommands under bridge/transformations by @glours in docker/compose#14143

Fix(plugins): honor PATHEXT for provider lookup on Windows by @ndeloof in docker/compose#14159

Fix(watch): stop swallowing SetRecursive errors via nolint by @glours in docker/compose#14165

Fix(bridge): confirm before wiping non-empty convert output dir by @glours in docker/compose#14174

Fix(down): spare dangling images of orphaned services, like their tagged image by @htoyoda18 in docker/compose#14154

🔧 Internal

CI: raise e2e go-test timeout to 20m by @ndeloof in docker/compose#14072

Lint: replace gocyclo with gocognit by @ndeloof in docker/compose#14057

Test(e2e): prepend provider bin dir to PATH in provider tests by @glours in docker/compose#14079

Refactor: dismantle the gocognit hotspots, one concern per function by @ndeloof in docker/compose#14060

Test(e2e): declarative Scenario layer, project files under testdata// by @ndeloof in docker/compose#14087

Docs: document engine container event sequences in up monitor by @ndeloof in docker/compose#14024

E2E: fix test resource isolation and make standalone parallelism configurable by @glours in docker/compose#14073

API: ScaleOptions carries the replica counts by @ndeloof in docker/compose#14077

Chore: explicit, unique, greppable internal names by @ndeloof in docker/compose#14049

Docs: update CONTRIBUTING.md to reflect current tooling and practices by @glours in docker/compose#14098

API: option structs document what the implementation actually honors by @ndeloof in docker/compose#14078

Test: unit-lock the imperative start path by @ndeloof in docker/compose#14104

CLI: display.Mode always resolves to the mode actually rendered by @ndeloof in docker/compose#14103

CI: validate generated mocks are in sync by @ndeloof in docker/compose#14102

Docs(sdk): document the EventProcessor API that actually exists by @ndeloof in docker/compose#14131

Test(e2e): gate the e2e suite behind the build tag the docs already promise by @ndeloof in docker/compose#14132

Build: error messages name the real remedy, not a removed builder by @ndeloof in docker/compose#14133

Docs(contributing): legibility guidelines — comments state behavior, not history by @ndeloof in docker/compose#14135

Test(docs): compile the sdk.md examples by @ndeloof in docker/compose#14136

Chore(compose): rename convergence.go, whose convergence engine no longer exists by @ndeloof in docker/compose#14129

Chore(compose): comments state behavior, not history by @ndeloof in docker/compose#14130

Test(build): re-enable wrong ssh key id test by @htoyoda18 in docker/compose#14120

Chore(compose): orphan semantics stated where up and down diverge by @ndeloof in docker/compose#14142

... (truncated)

Commits

5f94fb0 bump compose-go to version v2.15.0
20717ba fix(down): spare dangling images of orphaned services, like their tagged image
a966bad fix(down): spare dangling images of orphaned services, like their tagged image
a896529 fix(bridge): confirm before wiping non-empty convert output dir
98c49ed build(deps): golang.org/x/crypto v0.56.0
5284c98 feat(deps): github.com/moby/buildkit v0.33.0
70da291 build(deps): github.com/gofrs/flock v0.13.1
b237fe1 build(deps): go.opentelemetry.io/otel v1.46.0, contrib v0.71.0
5966473 Update to go1.26.8
4121ec7 test(e2e): bump compose-bridge images to v0.0.7
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.5

Fixed security issues

cipher/cbc_hmac: don't panic on empty ciphertext (#292)

cipher/cbc_hmac: don't panic on invalid key (#291)

json: limit stack depth (#290)

jwt: reject out-of-range NumericDate values (#278)

Check alg against pubkey curve during verify. (#293)

Reject malformed Ed25519 JWKs (#250)

jws: choose verification key per-signature (#243)

Changed

Verify OpaqueSigner's Public() return is public (#260)

jws: skip signature on ErrJWKSKidNotFound (#248)

Handle JWE JSON without protected header (#240)

jws: don't strip internal whitespace before parsing JSON (#239)

jws: fewer calls to OpaqueSigner.Public() (#224)

Return a specific error when parsing empty string (#216)

Reject typed nil at Verify time (#285)

Commits

b10771e Reject typed nil at Verify time
56f3866 Check alg against pubkey curve during verify. (#293)
74114c2 cipher/cbc_hmac: don't panic on empty ciphertext (#292)
6b364f3 cipher/cbc_hmac: don't panic on invalid key (#291)
a31af25 json: limit stack depth (#290)
7f5beb3 jwt: reject out-of-range NumericDate values (#278)
e37f31a Test on Go 1.26 and 1.27 (#284)
5b371ae Reject malformed Ed25519 JWKs (#250)
ad7f32d Bump actions/setup-python from 6 to 7 (#275)
1563054 Bump actions/setup-go from 6 to 7 (#274)
Additional commits viewable in compare view

Updates github.com/golang-migrate/migrate/v4 from 4.19.1 to 4.20.1

Release notes

Sourced from github.com/golang-migrate/migrate/v4's releases.

v4.20.1

[!NOTE] This release is the immediate mitigation of the CI / release failure in v4.20.0, to distribute the latest version to all registries.

What's Changed

ci: fix GoReleaser build matrix by @Fontinalis in golang-migrate/migrate#1434

Full Changelog: golang-migrate/migrate@v4.20.0...v4.20.1

v4.20.0

[!WARNING] Due to a bug in the release workflow, GoReleaser failed and v4.20.0 was not published to Docker or other package registries. We did not want to re-tag (due to the possible impacts of that action), so we will attempt to backfill this shortly.

To mitigate this in the immediate term, v4.20.1 is being released with the patched workflow and distributed to all registries.

What's Changed

ci: update golangci-lint to v2 by @PascalBourdier in golang-migrate/migrate#1341

Upgrade pgx v5 to latest version by @achanda in golang-migrate/migrate#1320

Bump go.opentelemetry.io/otel/sdk from 1.36.0 to 1.40.0 in the go_modules group across 1 directory by @dependabot[bot] in golang-migrate/migrate#1361

fix(security): migrate docker/docker to moby/moby modules (BlackDuck Polaris findings) by @fzl-22 in golang-migrate/migrate#1402

Bump google.golang.org/grpc from 1.74.2 to 1.79.3 in the go_modules group across 1 directory by @dependabot[bot] in golang-migrate/migrate#1373

build: use Go 1.25 and 1.26 to build project by @joschi in golang-migrate/migrate#1389

test(yugabyte): run YugabyteDB tests with supported versions by @joschi in golang-migrate/migrate#1396

spanner: Update spansql statement parser version by @adamhicks in golang-migrate/migrate#1398

build: bump alpine docker image to 3.24 by @Fontinalis in golang-migrate/migrate#1431

fix(mongodb): replace deprecated DecodeBytes by @Fontinalis in golang-migrate/migrate#1432

build(deps): bump the go_modules group across 1 directory with 3 updates by @dependabot[bot] in golang-migrate/migrate#1429

fix(source/aws_s3): paginate ListObjects to load >1000 migrations by @EylonLevy in golang-migrate/migrate#1412

perf(source): build migrations index lazily to avoid quadratic startup by @YuheiTakagawa in golang-migrate/migrate#1424

test: add MSSQL 2025 to test matrix by @joschi in golang-migrate/migrate#1390

test: update PostgreSQL test matrix by @joschi in golang-migrate/migrate#1388

New Contributors

@PascalBourdier made their first contribution in golang-migrate/migrate#1341

@achanda made their first contribution in golang-migrate/migrate#1320

@fzl-22 made their first contribution in golang-migrate/migrate#1402

@adamhicks made their first contribution in golang-migrate/migrate#1398

@EylonLevy made their first contribution in golang-migrate/migrate#1412

@YuheiTakagawa made their first contribution in golang-migrate/migrate#1424

Full Changelog: golang-migrate/migrate@v4.19.1...v4.20.0

Commits

504568a ci: fix GoReleaser build matrix (#1434)
9429a3c test: update PostgreSQL test matrix (#1388)
276d060 test: add MSSQL 2025 to test matrix (#1390)
10173f0 perf(source): build migrations index lazily to avoid quadratic startup (#1424)
5bcd008 fix(source/aws_s3): paginate ListObjects to load >1000 migrations (#1412)
15c4690 build(deps): bump the go_modules group across 1 directory with 3 updates (#1429)
3eac5d5 fix(mongodb): replace deprecated DecodeBytes (#1432)
01a9643 build: bump alpine docker image to 3.24 (#1431)
7724986 spanner: Update spansql statement parser version (#1398)
18966c7 test(yugabyte): run YugabyteDB tests with supported versions (#1396)
Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.55.0 to 1.56.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.56.0

1.56.0

Changelog

GET /containers/json now supports an annotation filter to filter containers by annotation, either by key (annotation=key) or by key and value (annotation="key=value"), similar to the existing label filter. moby/moby#53538

POST /containers/create now supports HostConfig.Umask to set the initial umask for a Unix container. When set, the daemon includes the value in the OCI process configuration for the container's entrypoint, exec processes, and healthchecks. When omitted, the runtime's default behavior applies.moby/moby#53463

api/docs: sync API docs v1.25 - v1.55. moby/moby#53246

api/swagger: Align Healthcheck name with Go struct. moby/moby#53567

api/types/plugin: Deprecated plugin.Privileges sorting methods in favor of slices.SortFunc. moby/moby#53511

api/types/plugin: fix Privileges Swap implementation. moby/moby#53510

api: Bump to 1.56. moby/moby#53425

api: document Task.NetworksAttachments in the swagger definition. moby/moby#53082

api: remove gotest.tools from tests. moby/moby#53535

api: swagger: Use int64 for build query params. moby/moby#53520

api: use blackbox testing. moby/moby#53525

Fix API reference documenting an unsupported names filter for GET /configs. moby/moby#53447

Commits

9b2179d Merge pull request #53572 from vvoland/api-docs-cut
575cf82 Merge pull request #53571 from thaJeztah/bump_tools
20beedb api/docs: Cut v1.56
bb86302 Merge pull request #53569 from vvoland/afvsock-lsm
65be55a Merge pull request #53513 from thaJeztah/daemon_fix_list
0af79c4 Merge pull request #53570 from vvoland/process-release
7d1ce6a Merge pull request #53568 from renovate-bot/renovate/github.com-mdlayher-sock...
0df1a00 Dockerfile: update cli v29.7.2, compose v5.5.1, buildx v0.37.0
e1d06bd Drop replace rules
b40d37e Merge pull request #53359 from vvoland/ext-namegenerator
Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.5.1 to 0.6.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.6.0

0.6.0

Changelog

pkg/jsonmessage: add new WithMessagePrinter option to use a custom printer for messages. moby/moby#53489

api: Bump to 1.56. moby/moby#53425

minor cleanups, refactors. moby/moby#53509

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.6.0 (2013-08-22)

Runtime: Load authConfig only when needed and fix useless WARNING

Runtime: Add lxc-conf flag to allow custom lxc options

Runtime: Fix race conditions in parallel pull

Runtime: Improve CMD, ENTRYPOINT, and attach docs.

Documentation: Small fix to docs regarding adding docker groups

Documentation: Add MongoDB image example

Builder: Add USER instruction do Dockerfile

Documentation: updated default -H docs

Remote API: Sort Images by most recent creation date.

Builder: Add workdir support for the Buildfile

Runtime: Add an option to set the working directory

Runtime: Show tag used when image is missing

Documentation: Update readme with dependencies for building

Documentation: Add instructions for creating and using the docker group

Remote API: Reworking opaque requests in registry module

Runtime: Fix Graph ByParent() to generate list of child images per parent image.

Runtime: Add Image name to LogEvent tests

Documentation: Add sudo to examples and installation to documentation

Hack: Bash Completion: Limit commands to containers of a relevant state

Remote API: Add image name in /events

Runtime: Apply volumes-from before creating volumes

Runtime: Make docker run handle SIGINT/SIGTERM

Runtime: Prevent crash when .dockercfg not readable

Hack: Add docker dependencies coverage testing into docker-ci

Runtime: Add -privileged flag and relevant tests, docs, and examples

Packaging: Docker-brew 0.5.2 support and memory footprint reduction

Runtime: Install script should be fetched over https, not http.

Packaging: Add new docker dependencies into docker-ci

Runtime: Use Go 1.1.2 for dockerbuilder

Registry: Improve auth push

Runtime: API, issue 1471: Use groups for socket permissions

Documentation: PostgreSQL service example in documentation

Contrib: bash completion script

Tests: Improve TestKillDifferentUser to prevent timeout on buildbot

Documentation: Fix typo in docs for docker run -dns

Documentation: Adding a reference to ps -a

Runtime: Correctly detect IPv4 forwarding

Packaging: Revert "docker.upstart: avoid spawning a sh process"

Runtime: Use ranged for loop on channels

Runtime: Fix typo: fmt.Sprint -> fmt.Sprintf

Tests: Fix typo in TestBindMounts (runContainer called without image)

Runtime: add websocket support to /container//attach/ws

Runtime: Mount /dev/shm as a tmpfs

Builder: Only count known instructions as build steps

Builder: Fix docker build and docker events output

Runtime: switch from http to https for get.docker.io

Tests: Improve TestGetContainersTop so it does not rely on sleep

Packaging: Docker-brew and Docker standard library

Testing: Add some tests in server and utils

... (truncated)

Commits

f4a4f1c Bump to 0.6.0
f925edd Merge pull request #1525 from griff/1503-fix
12715c8 Merge pull request #1609 from jpetazzo/release-docker-with-docker
326dadd Merge pull request #1565 from dotcloud/only_load_authconfig_when_needed
a3510c9 Merge pull request #1560 from dotcloud/439-allow-lxc-args
262d57e Merge pull request #1623 from mhennings/1592-fix-race-conditions-in-parallel-...
551092f Add lxc-conf flag to allow custom lxc options
3f802f4 Fix race conditions in parallel pull
0b9c8e2 Merge pull request #1596 from metalivedev/1149-easyfixes
42fe550 Merge pull request #1614 from denibertovic/docs
Additional commits viewable in compare view

Updates github.com/nicholas-fedor/shoutrrr from 0.19.0 to 0.20.0

Release notes

Sourced from github.com/nicholas-fedor/shoutrrr's releases.

v0.20.0

Features

feat: add support for injecting custom DialContext by @nicholas-fedor in nicholas-fedor/shoutrrr#1321

feat: add Home Assistant notification service by @nicholas-fedor in nicholas-fedor/shoutrrr#1328

Dependency Updates

chore(deps): update github.com/google/pprof digest to 6331bc6 by @renovate[bot] in nicholas-fedor/shoutrrr#1320

Full Changelog: nicholas-fedor/shoutrrr@v0.19.0...v0.20.0

Changelog

Sourced from github.com/nicholas-fedor/shoutrrr's changelog.

[0.20.0] - 2026-09-08

Added

Add Home Assistant notification service by @nicholas-fedor in #1328

Add support for injecting custom DialContext by @nicholas-fedor in #1321

Chores

Update nicholas-fedor/go-proxy-pull-action action to v1.1.51 by @renovate[bot] in #1326

Lock file maintenance by @renovate[bot] in #1323

Update nicholas-fedor/go-proxy-pull-action action to v1.1.50 by @renovate[bot] in #1322

Update github.com/google/pprof digest to 6331bc6 by @renovate[bot] in #1320

Update github.com/google/pprof digest to d6c3cb2 by @renovate[bot] in #1318

Update emqx/emqx:latest docker digest to 3b6d9c0 by @renovate[bot] in #1316

Update matrixdotorg/synapse:latest docker digest to 1231c84 by @renovate[bot] in #1314

Update cimg/go docker tag to v1.27.1 by @renovate[bot] in #1312

Commits

f78bf0f feat: add Home Assistant notification service (#1328)
b2da7e4 chore(deps): update nicholas-fedor/go-proxy-pull-action action to v1.1.51 (#1...
9e5da6c docs(changelog): update changelog (#1325)
d508ed9 chore(deps): lock file maintenance (#1323)
7478834 docs(changelog): update changelog (#1324)
921f52d feat: add support for injecting custom DialContext (#1321)
42eb930 chore(deps): update nicholas-fedor/go-proxy-pull-action action to v1.1.50 (#1...
f40aebc docs(changelog): update changelog (#1317)
5178c46 chore(deps): update github.com/google/pprof digest to 6331bc6 (#1320)
469cfa7 chore(deps): update github.com/google/pprof digest to d6c3cb2 (#1318)
Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Commits

c624b89 google: change the snake case endpoint to kebab-case
09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
See full diff in compare view

Updates golang.org/x/time from 0.15.0 to 0.16.0

Commits

fb013b3 all: upgrade go directive to at least 1.26.0 [generated]
See full diff in compare view

Bumps the dependencies group with 5 updates:

Package	From	To
pnpm/action-setup	`6.0.10`	`6.1.0`
github/codeql-action/init	`4.37.9`	`4.38.0`
github/codeql-action/analyze	`4.37.9`	`4.38.0`
crowdin/github-action	`3.0.1`	`3.0.2`
zizmorcore/zizmor-action	`0.6.3`	`0.6.4`

Updates pnpm/action-setup from 6.0.10 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

feat: support pnpm v12 by @zkochan in pnpm/action-setup#288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

Commits

ea17c68 feat: support pnpm v12 (#288)
See full diff in compare view

Updates github/codeql-action/init from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
02d5093 Update changelog for v4.38.0
7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
bfcc52b Run slow macOS checks on larger runners

Bumps the dependencies group in /backend with 10 updates: | Package | From | To | | --- | --- | --- | | [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) | `2.14.0` | `2.15.0` | | [github.com/docker/cli](https://github.com/docker/cli) | `29.7.2+incompatible` | `29.8.0+incompatible` | | [github.com/docker/compose/v5](https://github.com/docker/compose) | `5.5.0` | `5.5.1` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.4` | `4.1.5` | | [github.com/golang-migrate/migrate/v4](https://github.com/golang-migrate/migrate) | `4.19.1` | `4.20.1` | | [github.com/moby/moby/api](https://github.com/moby/moby) | `1.55.0` | `1.56.0` | | [github.com/moby/moby/client](https://github.com/moby/moby) | `0.5.1` | `0.6.0` | | [github.com/nicholas-fedor/shoutrrr](https://github.com/nicholas-fedor/shoutrrr) | `0.19.0` | `0.20.0` | | [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.36.0` | `0.37.0` | | [golang.org/x/time](https://github.com/golang/time) | `0.15.0` | `0.16.0` | Updates `github.com/compose-spec/compose-go/v2` from 2.14.0 to 2.15.0 - [Release notes](https://github.com/compose-spec/compose-go/releases) - [Commits](compose-spec/compose-go@v2.14.0...v2.15.0) Updates `github.com/docker/cli` from 29.7.2+incompatible to 29.8.0+incompatible - [Commits](docker/cli@v29.7.2...v29.8.0) Updates `github.com/docker/compose/v5` from 5.5.0 to 5.5.1 - [Release notes](https://github.com/docker/compose/releases) - [Commits](docker/compose@v5.5.0...v5.5.1) Updates `github.com/go-jose/go-jose/v4` from 4.1.4 to 4.1.5 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.4...v4.1.5) Updates `github.com/golang-migrate/migrate/v4` from 4.19.1 to 4.20.1 - [Release notes](https://github.com/golang-migrate/migrate/releases) - [Commits](golang-migrate/migrate@v4.19.1...v4.20.1) Updates `github.com/moby/moby/api` from 1.55.0 to 1.56.0 - [Release notes](https://github.com/moby/moby/releases) - [Commits](moby/moby@api/v1.55.0...api/v1.56.0) Updates `github.com/moby/moby/client` from 0.5.1 to 0.6.0 - [Release notes](https://github.com/moby/moby/releases) - [Changelog](https://github.com/moby/moby/blob/v0.6.0/CHANGELOG.md) - [Commits](moby/moby@v0.5.1...v0.6.0) Updates `github.com/nicholas-fedor/shoutrrr` from 0.19.0 to 0.20.0 - [Release notes](https://github.com/nicholas-fedor/shoutrrr/releases) - [Changelog](https://github.com/nicholas-fedor/shoutrrr/blob/main/CHANGELOG.md) - [Commits](nicholas-fedor/shoutrrr@v0.19.0...v0.20.0) Updates `golang.org/x/oauth2` from 0.36.0 to 0.37.0 - [Commits](golang/oauth2@v0.36.0...v0.37.0) Updates `golang.org/x/time` from 0.15.0 to 0.16.0 - [Commits](golang/time@v0.15.0...v0.16.0) chore: Bump the dependencies group with 5 updates Bumps the dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.10` | `6.1.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.38.0` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.38.0` | | [crowdin/github-action](https://github.com/crowdin/github-action) | `3.0.1` | `3.0.2` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.3` | `0.6.4` | Updates `pnpm/action-setup` from 6.0.10 to 6.1.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@0977fd9...ea17c68) Updates `github/codeql-action/init` from 4.37.9 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdf488f...b96794f) Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdf488f...b96794f) Updates `crowdin/github-action` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/crowdin/github-action/releases) - [Commits](crowdin/github-action@71fdb88...0d5670f) Updates `zizmorcore/zizmor-action` from 0.6.3 to 0.6.4 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@70fb788...cc914d7) chore: Bump pnpm/pnpm from 12.3.4 to 12.4.0 in the dependencies group Bumps the dependencies group with 1 update: pnpm/pnpm. Updates `pnpm/pnpm` from 12.3.4 to 12.4.0 chore: Bump the dependencies group in /frontend with 12 updates Bumps the dependencies group in /frontend with 12 updates: | Package | From | To | | --- | --- | --- | | [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.7.0` | `1.8.0` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.32` | `1.170.33` | | [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin) | `1.168.35` | `1.168.36` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.39.0` | `1.43.0` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.19.1` | `4.21.0` | | [@inlang/cli](https://github.com/opral/inlang) | `3.3.4` | `3.3.5` | | [@inlang/paraglide-js](https://github.com/opral/paraglide-js) | `2.25.0` | `2.25.1` | | [@inlang/plugin-m-function-matcher](https://github.com/opral/inlang/tree/HEAD/packages/plugins/m-function-matcher) | `2.2.13` | `2.2.14` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.5.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.2.7` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.66.0` | `0.67.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.81.0` | `1.82.0` | Updates `@base-ui/react` from 1.7.0 to 1.8.0 - [Release notes](https://github.com/mui/base-ui/releases) - [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md) - [Commits](https://github.com/mui/base-ui/commits/v1.8.0/packages/react) Updates `@tanstack/react-router` from 1.170.32 to 1.170.33 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.33/packages/react-router) Updates `@tanstack/router-plugin` from 1.168.35 to 1.168.36 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.36/packages/router-plugin) Updates `lucide-react` from 1.39.0 to 1.43.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.43.0/packages/lucide-react) Updates `shadcn` from 4.19.1 to 4.21.0 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.21.0/packages/shadcn) Updates `@inlang/cli` from 3.3.4 to 3.3.5 - [Commits](https://github.com/opral/inlang/commits) Updates `@inlang/paraglide-js` from 2.25.0 to 2.25.1 - [Changelog](https://github.com/opral/paraglide-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/opral/paraglide-js/commits) Updates `@inlang/plugin-m-function-matcher` from 2.2.13 to 2.2.14 - [Changelog](https://github.com/opral/inlang/blob/main/packages/plugins/m-function-matcher/CHANGELOG.md) - [Commits](https://github.com/opral/inlang/commits/HEAD/packages/plugins/m-function-matcher) Updates `@types/node` from 26.4.1 to 26.5.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react-dom` from 19.2.5 to 19.2.7 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `oxfmt` from 0.66.0 to 0.67.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.67.0/npm/oxfmt) Updates `oxlint` from 1.81.0 to 1.82.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.82.0/npm/oxlint) chore: Bump the dependencies group in /e2e with 2 updates Bumps the dependencies group in /e2e with 2 updates: [@playwright/test](https://github.com/microsoft/playwright) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Updates `@playwright/test` from 1.62.1 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.1...v1.63.0) Updates `@types/node` from 26.4.1 to 26.5.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: github.com/compose-spec/compose-go/v2 dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/docker/cli dependency-version: 29.8.0+incompatible dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/docker/compose/v5 dependency-version: 5.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/golang-migrate/migrate/v4 dependency-version: 4.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/moby/moby/api dependency-version: 1.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/moby/moby/client dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/nicholas-fedor/shoutrrr dependency-version: 0.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: golang.org/x/oauth2 dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: golang.org/x/time dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: pnpm/action-setup dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github/codeql-action/init dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github/codeql-action/analyze dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: crowdin/github-action dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: pnpm/pnpm dependency-version: 12.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@base-ui/react" dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@tanstack/react-router" dependency-version: 1.170.33 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@tanstack/router-plugin" dependency-version: 1.168.36 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: lucide-react dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: shadcn dependency-version: 4.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@inlang/cli" dependency-version: 3.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@inlang/paraglide-js" dependency-version: 2.25.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@inlang/plugin-m-function-matcher" dependency-version: 2.2.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@types/node" dependency-version: 26.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/react-dom" dependency-version: 19.2.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: oxfmt dependency-version: 0.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: oxlint dependency-version: 1.82.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@playwright/test" dependency-version: 1.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/node" dependency-version: 26.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies go Pull requests that update go code labels Sep 12, 2026

github-actions Bot added frontend backend ci labels Sep 12, 2026

alex289 approved these changes Sep 12, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore: Bump the "dependencies" group with 5 updates across multiple ecosystems - #292

chore: Bump the "dependencies" group with 5 updates across multiple ecosystems#292
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/dependencies-cfd7c031a6

dependabot Bot commented on behalf of github Sep 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 12, 2026

v2.15.0

What's Changed

New Contributors

v5.5.1

What's Changed

✨ Improvements

🐛 Fixes

🔧 Internal

v4.1.5

Fixed security issues

Changed

v4.20.1

What's Changed

v4.20.0

What's Changed

New Contributors

api/v1.56.0

1.56.0

Changelog

client/v0.6.0

0.6.0

Changelog

0.6.0 (2013-08-22)

v0.20.0

Features

Dependency Updates

[0.20.0] - 2026-09-08

Added

Chores

v6.1.0

What's Changed

v4.38.0

CodeQL Action Changelog

[UNRELEASED]

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant