Repository navigation
chore(deps): update GitHub Actions - #3988
Merged
Merged
Conversation
fro-bot
Bot
added
action
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
3 times, most recently
from
October 13, 2026 02:14
2a49e86 to
581d750
Compare
This was referenced Oct 13, 2026
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
October 13, 2026 23:51
581d750 to
20c7a8f
Compare
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
October 14, 2026 23:26
20c7a8f to
744daf6
Compare
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
October 15, 2026 13:41
744daf6 to
6cfee9e
Compare
This was referenced Oct 16, 2026
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
October 18, 2026 08:09
c70becc to
a5030fc
Compare
marcusrbrown
approved these changes
Oct 18, 2026
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
October 18, 2026 08:11
a5030fc to
f7b8f3c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.2.0→v3.3.0v0.119.2→v0.123.0v4.38.0→v4.39.0v2.4.3→v2.5.0Release Notes
actions/create-github-app-token
v3.3.0Compare Source
Features
Bug Fixes
fro-bot/agent
v0.123.0Compare Source
Features
Build System
Bug Fixes
Continuous Integration
Miscellaneous Chores
v0.122.3Compare Source
What's new
The bundled Systematic plugin tightens workflow controls: only allowlisted skills can activate a guarded workflow epoch, and bundled handoff targets and skill references now resolve correctly. It also fixes guard handling for large operation identities and observes operations only while guarded work can use them.
The update includes security fixes that bound indexed source-map processing and reject injected URI authority components, plus a patch for a Sharp/librsvg vulnerability. Its scheduled release gate now accepts GitHub-signed release commits. #1828
Full changelog
0.122.3 (2026-10-15)
Build System
Bug Fixes
Continuous Integration
Miscellaneous Chores
v0.122.2Compare Source
Build System
Miscellaneous Chores
v0.122.1Compare Source
What's new
Operator visibility
Gateway operators can now see when a run is waiting for a question or approval across the live stream, reconnects, run summaries, and question notifications. Waiting state is refreshed from the request registries, cleared when requests settle, and never overlays a terminal run; question notifications also link directly to the matching run. The operator contract is now 1.11.0, so the dashboard must be deployed in the same window. #1825
Reliability
The runtime-verification sweep can now verify repositories pinned to recent releases without oversized GitHub API responses. It compares the pin against preflight and reads the bounded
ahead_bycount, preserving the same verified/stale result while reducing the current-pin response from about 2.24 MB to 8.6 KB. #1821Vitest 5 no longer discovers the repository-root config from package directories, which had silently bypassed shared HOME/XDG isolation and test exclusions. Package test commands now point to the shared config explicitly, and the workspace test image includes that config and its required scripts. #1816
Full changelog
0.122.1 (2026-10-13)
Build System
Bug Fixes
Continuous Integration
Miscellaneous Chores
v0.122.0Compare Source
What's new
The Action and workspace executor now default to the patched OpenCode 1.19.0 harness build, keeping both execution surfaces on the same version. OpenCode 1.19 no longer installs updates automatically: the interactive TUI can show update notices, but applying an update to a harness install fails; the server used by the Action does not run update checks.
OpenCode has frozen V1, so the harness continues to carry its existing patches and updates its carry ledger with the upstream status and guidance for future carry branches. The V2 line uses a different package scope and is outside the dependency update cap. #1806 #1810
Full changelog
0.122.0 (2026-10-12)
Features
Build System
v0.121.0Compare Source
What's new
You can now invoke the patched OpenCode build through an
opencodecommand on PATH after installing@fro.bot/harnessglobally. The shim resolves the binary through the harness's explicit resolution order, so tools such as the OpenCode SDK can launch it by name;harness doctoralso reports which binary that command will run.The shim forwards termination signals to the child and waits for it to exit, preventing the server from being left running when the wrapper is stopped. The Action also replaces preinstalled OpenCode builds that do not match the configured pin, rather than silently reusing them. #1800
Harness provenance output now makes the frozen integration commit easier to identify:
harness infoandharness patcheslink to it when it is present, andharness --versionprints its SHA alongside the build SHA. For stock upstream releases, where the integration commit is not in this repository, the SHA remains unlinked; development scaffolds reportintegration:dev. #1803Full changelog
0.121.0 (2026-10-12)
Features
Build System
Documentation
Continuous Integration
v0.120.0Compare Source
Features
Build System
Bug Fixes
Documentation
Miscellaneous Chores
v0.119.3Compare Source
What's new
Scheduled and manually dispatched runs using
working-dirmode can now perform GitHub operations explicitly required by their task, such as creating or closing issues. The delivery contract previously restricted these runs to non-mutating shell commands, blocking maintenance tasks that needed to update GitHub.Code-delivery restrictions remain in place, and non-posting runs still prohibit creating GitHub comments, issues, or reports. #1781
Full changelog
0.119.3 (2026-10-11)
Bug Fixes
github/codeql-action
v4.39.0Compare Source
codeql-action/analyzestep now validates that a correct argument for thecheckout_pathinput has been provided. Thecheckout_pathinput must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used bycodeql-action/init, then the CodeQL Action now produces a warning. #4148codeql-action/start-proxystep that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic ascodeql-action/init. This primarily benefits customers who are using GitHub instances other thangithub.comwhere thecodeql-action/start-proxystep may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198v4.38.3Compare Source
v4.38.2Compare Source
v4.38.1Compare Source
ossf/scorecard-action
v2.5.0Compare Source
What's Changed
This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.
For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.
@justaugustus in #1716
cmd/installer) now creates.github/workflows/scorecard.yml, and stillrecognizes existing
scorecards.ymlandscorecards-analysis.ymlworkflows. by @justaugustus in #1716with. by @justaugustus in #1718
@arpitjain099 in #1709
results_formatacceptsintoto, which wraps the JSON results in an in-toto attestationstatement. by @puerco in #1702
Other
RELEASE.md by @justaugustus in #1716
New Contributors
Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0
v2.4.4Compare Source
What's Changed
This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.
Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4
Configuration
📅 Schedule: (in timezone America/Phoenix)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.