chore(deps): bump the actions-minor-patch group across 1 directory with 3 updates by dependabot[bot] · Pull Request #1013 · cipherstash/stack

dependabot · 2026-10-02T18:06:32Z

Bumps the actions-minor-patch group with 3 updates in the / directory: anthropics/claude-code-action, github/codeql-action and release-plz/action.

Updates anthropics/claude-code-action from 1.0.225 to 1.0.247

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.247

Full Changelog: anthropics/claude-code-action@v1.0.246...v1.0.247

v1.0.246

Full Changelog: anthropics/claude-code-action@v1.0.245...v1.0.246

v1.0.245

Full Changelog: anthropics/claude-code-action@v1.0.244...v1.0.245

v1.0.244

Full Changelog: anthropics/claude-code-action@v1.0.243...v1.0.244

v1.0.243

Full Changelog: anthropics/claude-code-action@v1.0.242...v1.0.243

v1.0.242

Full Changelog: anthropics/claude-code-action@v1.0.241...v1.0.242

v1.0.241

Full Changelog: anthropics/claude-code-action@v1.0.240...v1.0.241

v1.0.240

Full Changelog: anthropics/claude-code-action@v1.0.239...v1.0.240

v1.0.239

Full Changelog: anthropics/claude-code-action@v1.0.238...v1.0.239

v1.0.238

What's Changed

ci: security hardening for GitHub Actions workflows that call Claude by @qing-ant in anthropics/claude-code-action#1867

New Contributors

@qing-ant made their first contribution in anthropics/claude-code-action#1867

Full Changelog: anthropics/claude-code-action@v1.0.237...v1.0.238

v1.0.237

Full Changelog: anthropics/claude-code-action@v1.0.236...v1.0.237

v1.0.236

Full Changelog: anthropics/claude-code-action@v1.0.235...v1.0.236

v1.0.235

Full Changelog: anthropics/claude-code-action@v1.0.234...v1.0.235

v1.0.234

Full Changelog: anthropics/claude-code-action@v1.0.233...v1.0.234

v1.0.233

Full Changelog: anthropics/claude-code-action@v1.0.232...v1.0.233

... (truncated)

Commits

2dca132 chore: bump Claude Code to 2.1.295 and Agent SDK to 0.3.295
38c80c1 chore: bump Claude Code to 2.1.294 and Agent SDK to 0.3.294
6fed3ca chore: bump Claude Code to 2.1.293 and Agent SDK to 0.3.293
5898584 chore: bump Claude Code to 2.1.292 and Agent SDK to 0.3.292
86d88e6 chore: bump Claude Code to 2.1.291 and Agent SDK to 0.3.291
6c69018 chore: bump Claude Code to 2.1.290 and Agent SDK to 0.3.290
cab360f chore: bump Claude Code to 2.1.289 and Agent SDK to 0.3.289
ed670b4 chore: bump Claude Code to 2.1.288 and Agent SDK to 0.3.288
97c5347 chore: bump Claude Code to 2.1.287 and Agent SDK to 0.3.287
12dd8d7 chore: bump Claude Code to 2.1.286 and Agent SDK to 0.3.286
Additional commits viewable in compare view

Updates github/codeql-action from 4.38.0 to 4.38.3

Release notes

Sourced from github/codeql-action's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Changelog

Sourced from github/codeql-action's changelog.

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates release-plz/action from 0.5.137 to 0.5.140

Release notes

Sourced from release-plz/action's releases.

v0.5.140

What's Changed

fix(deps): update rust crate git_cmd to 0.7.0 by @renovate[bot] in release-plz/action#539

chore(deps): update dependency taiki-e/install-action to v2.87.17 by @renovate[bot] in release-plz/action#541

chore(deps): lock file maintenance by @renovate[bot] in release-plz/action#542

chore(deps): update dependency taiki-e/install-action to v2.87.18 by @renovate[bot] in release-plz/action#543

chore(deps): update dependency taiki-e/install-action to v2.87.19 by @renovate[bot] in release-plz/action#544

chore(deps): update dependency taiki-e/install-action to v2.87.20 by @renovate[bot] in release-plz/action#545

chore(deps): update dependency cargo-bins/cargo-binstall to v1.24.0 by @renovate[bot] in release-plz/action#546

chore(deps): update dependency taiki-e/install-action to v2.87.21 by @renovate[bot] in release-plz/action#547

docs: document the default config search order by @marcoienibot in release-plz/action#548

chore(deps): lock file maintenance by @renovate[bot] in release-plz/action#549

chore(deps): update dependency taiki-e/install-action to v2.87.22 by @renovate[bot] in release-plz/action#550

chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.0 by @renovate[bot] in release-plz/action#551

chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.1 by @renovate[bot] in release-plz/action#552

chore(deps): update dependency taiki-e/install-action to v2.87.23 by @renovate[bot] in release-plz/action#553

chore(deps): update dependency obi1kenobi/cargo-semver-checks to v0.51 by @renovate[bot] in release-plz/action#554

chore(deps): update dependency taiki-e/install-action to v2.87.24 by @renovate[bot] in release-plz/action#555

update github actions weekly by @marcoieni in release-plz/action#556

chore(deps): lock file maintenance by @renovate[bot] in release-plz/action#557

chore(deps): update dependency taiki-e/install-action to v2.87.25 by @renovate[bot] in release-plz/action#558

chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.2 by @renovate[bot] in release-plz/action#559

chore(deps): update dependency taiki-e/install-action to v2.87.26 by @renovate[bot] in release-plz/action#560

Update to 0.3.170 by @marcoieni in release-plz/action#561

Full Changelog: release-plz/action@v0.5.139...v0.5.140

v0.5.139

What's Changed

chore(deps): update dependency taiki-e/install-action to v2.87.14 by @renovate[bot] in release-plz/action#536

chore(deps): update dependency taiki-e/install-action to v2.87.15 by @renovate[bot] in release-plz/action#537

chore(deps): update dependency taiki-e/install-action to v2.87.16 by @renovate[bot] in release-plz/action#538

Update to 0.3.169 by @marcoieni in release-plz/action#540

Full Changelog: release-plz/action@v0.5.138...v0.5.139

v0.5.138

What's Changed

chore(deps): lock file maintenance by @renovate[bot] in release-plz/action#532

chore(deps): update dependency taiki-e/install-action to v2.87.13 by @renovate[bot] in release-plz/action#534

Update to 0.3.168 by @marcoieni in release-plz/action#535

Full Changelog: release-plz/action@v0.5.137...v0.5.138

Commits

18641b6 Update to 0.3.170 (#561)
ff20e36 chore(deps): update dependency taiki-e/install-action to v2.87.26 (#560)
7a48fcf chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.2 (#559)
3491eb1 chore(deps): update dependency taiki-e/install-action to v2.87.25 (#558)
b143bef chore(deps): lock file maintenance (#557)
11586b6 update github actions weekly (#556)
8402dc2 chore(deps): update dependency taiki-e/install-action to v2.87.24 (#555)
f9a4b7e chore(deps): update dependency obi1kenobi/cargo-semver-checks to v0.51 (#554)
eeb8829 chore(deps): update dependency taiki-e/install-action to v2.87.23 (#553)
3999d03 chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.1 (#552)
Additional commits viewable in compare view

changeset-bot · 2026-10-02T18:06:43Z

⚠️ No Changeset found

Latest commit: d79eead

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

freshtonic

Run Tests (Node 22) and Run Tests (Node 24) fail because of this PR. Dependabot cannot fix this on its own, so a person must push one more commit to this branch.

Blocker

scripts/__tests__/claude-review-workflow.test.mjs:6 pins ACTION_SHA = 'bf38e86e58df9ebf3420326d019f955bb3be64dd' (v1.0.225). The test pins the reviewed Claude action release and authenticates only with OIDC compares the workflow against that constant, so the bump to 756cc22… (v1.0.235) fails it:

Expected: "anthropics/claude-code-action@bf38e86e58df9ebf3420326d019f955bb3be64dd"
Received: "anthropics/claude-code-action@756cc22e19660d20e8cc9496b4f242475a7f7790"

The pin is a review gate, not an accident. Before you change the constant, read the claude-code-action changes from v1.0.225 to v1.0.235. Make sure that this job still gets the agent mode and the job github_token that the workflow comments describe. Then set ACTION_SHA to 756cc22e19660d20e8cc9496b4f242475a7f7790 in the same PR.

Verified

anthropics/claude-code-action tag v1.0.235 resolves to 756cc22e19660d20e8cc9496b4f242475a7f7790. The comment on the pin is correct.
release-plz/action tag v0.5 resolves to b8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5. Both release-plz pins are correct.
The CodeQL bump from v4.38.0 to v4.38.2 is a patch release.

Not from this PR (no action needed here)

In .github/workflows/codeql.yml, the step Perform CodeQL Analysis uses github/codeql-action/init, not github/codeql-action/analyze. Thus the job runs init two times and does not analyze or upload results. The job shows green, but it does no scan. This problem was on main before this PR. A separate PR must fix it.

No changeset is necessary. This PR changes only CI workflows, and they are not part of a published package.

freshtonic · 2026-10-02T18:58:01Z

      - name: Review pull request
        id: claude-review
-        uses: anthropics/claude-code-action@bf38e86e58df9ebf3420326d019f955bb3be64dd # v1.0.225
+        uses: anthropics/claude-code-action@756cc22e19660d20e8cc9496b4f242475a7f7790 # v1.0.235


This bump fails scripts/__tests__/claude-review-workflow.test.mjs, because line 6 of that file still pins ACTION_SHA to bf38e86e58df9ebf3420326d019f955bb3be64dd. Read the action changes from v1.0.225 to v1.0.235. Then set ACTION_SHA to 756cc22e19660d20e8cc9496b4f242475a7f7790 in this PR.

freshtonic

Re-review of e8acc6dc. This commit is a Dependabot rebase of 9d944cec. The diff is the same: the three workflow pins and no other change.

The blocker from my previous review is not fixed. On this head, scripts/__tests__/claude-review-workflow.test.mjs:6 still sets ACTION_SHA = 'bf38e86e58df9ebf3420326d019f955bb3be64dd' (v1.0.225). .github/workflows/claude-review.yml:100 now uses 756cc22e19660d20e8cc9496b4f242475a7f7790 (v1.0.235). Thus the test pins the reviewed Claude action release and authenticates only with OIDC fails, and Run Tests (Node 22) is red again.

Dependabot cannot fix this. A person must read the claude-code-action changes from v1.0.225 to v1.0.235, and then push a commit to this branch that sets ACTION_SHA to 756cc22e19660d20e8cc9496b4f242475a7f7790. The open inline thread on claude-review.yml has the same request.

My other notes from the previous review do not change. The release-plz and CodeQL pins are correct, and this PR needs no changeset.

freshtonic

Re-review of 6960b48e. This commit is one more Dependabot rebase. The diff is the same as e8acc6dc: the three workflow pins and no other change.

The blocker is not fixed. On this head, scripts/__tests__/claude-review-workflow.test.mjs:6 still sets ACTION_SHA = 'bf38e86e58df9ebf3420326d019f955bb3be64dd' (v1.0.225), but .github/workflows/claude-review.yml:100 uses 756cc22e19660d20e8cc9496b4f242475a7f7790 (v1.0.235). Run Tests (Node 22) and Run Tests (Node 24) fail again on this head.

A rebase cannot fix this. A person must read the claude-code-action changes from v1.0.225 to v1.0.235, and then push a commit to this branch that sets ACTION_SHA to 756cc22e19660d20e8cc9496b4f242475a7f7790. The open inline thread on claude-review.yml has the same request.

My other notes do not change. The release-plz and CodeQL pins are correct, and this PR needs no changeset.

coderabbitai · 2026-10-07T05:28:36Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 9d35b737-d105-4468-870c-690b35756cfa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

freshtonic

The blocker in the earlier reviews is still not fixed, and the SHA that the test must use has changed.

Head cf6723ae pins anthropics/claude-code-action@6c690188da61cf16ee7debb28383ba67f02abb4c # v1.0.242, not v1.0.235. Run Tests (Node 22/24) fail with the same assertion, and the test receives 6c690188…. Thus the commit that a person pushes must set ACTION_SHA to 6c690188da61cf16ee7debb28383ba67f02abb4c, not to 756cc22….

To help with the v1.0.225 → v1.0.242 review

I verified that tag v1.0.242 points to commit 6c690188….
compare/bf38e86…6c690188 has 19 commits. 17 of them only bump Claude Code and the Agent SDK. The other two change only upstream CI workflows (#1853, #1867).
The runtime change is one line, in two places: CLAUDE_CODE_VERSION 2.1.272 → 2.1.290 in base-action/action.yml and src/entrypoints/run.ts. The top-level action.yml does not change. Thus the inputs, the OIDC token exchange, github_token and the mode selection are the same as in v1.0.225.

Suggested follow-up PR

The release-plz pin b8d6b54b… is v0.5.139, not the v0.5 that the comment says. The floating v0.5 tag now points to v0.5.142 (89212866…). Write the exact tag in the comment, as the other pins do, so that a reviewer can verify it.

…th 3 updates Bumps the actions-minor-patch group with 3 updates in the / directory: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action), [github/codeql-action](https://github.com/github/codeql-action) and [release-plz/action](https://github.com/release-plz/action). Updates `anthropics/claude-code-action` from 1.0.225 to 1.0.247 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@bf38e86...2dca132) Updates `github/codeql-action` from 4.38.0 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.38.0...v4.38.3) Updates `release-plz/action` from 0.5.137 to 0.5.140 - [Release notes](https://github.com/release-plz/action/releases) - [Commits](release-plz/action@8e61445...18641b6) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.235 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: github/codeql-action dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: release-plz/action dependency-version: 0.5.139 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github-actions Pull request modifies GitHub Actions labels Oct 2, 2026

dependabot Bot requested a review from a team as a code owner October 2, 2026 18:06

dependabot Bot added dependencies Pull requests that update a dependency file github-actions Pull request modifies GitHub Actions labels Oct 2, 2026

dependabot Bot changed the title ~~chore(deps): bump the actions-minor-patch group with 3 updates~~ chore(deps): bump the actions-minor-patch group across 1 directory with 3 updates Oct 2, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-0e3d02b15e branch 2 times, most recently from 984bad7 to 9d944ce Compare October 2, 2026 18:50

freshtonic requested changes Oct 2, 2026

View reviewed changes

freshtonic reviewed Oct 2, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-0e3d02b15e branch from 9d944ce to e8acc6d Compare October 2, 2026 21:24

freshtonic requested changes Oct 2, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-0e3d02b15e branch from e8acc6d to 6960b48 Compare October 2, 2026 21:55

freshtonic requested changes Oct 2, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-0e3d02b15e branch 2 times, most recently from 558dac2 to 260e774 Compare October 7, 2026 05:28

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-0e3d02b15e branch 2 times, most recently from 6feea72 to cf6723a Compare October 12, 2026 01:13

freshtonic reviewed Oct 14, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-0e3d02b15e branch from cf6723a to d79eead Compare October 15, 2026 23:06

Navigation Menu

Repository navigation

chore(deps): bump the actions-minor-patch group across 1 directory with 3 updates - #1013

chore(deps): bump the actions-minor-patch group across 1 directory with 3 updates#1013
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-minor-patch-0e3d02b15e

dependabot Bot commented on behalf of github Oct 2, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 2, 2026 •

edited

Loading

Uh oh!

freshtonic left a comment

Uh oh!

freshtonic Oct 2, 2026

Uh oh!

freshtonic left a comment

Uh oh!

freshtonic left a comment

Uh oh!

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

Review skipped

Uh oh!

freshtonic left a comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.0.247

v1.0.246

v1.0.245

v1.0.244

v1.0.243

v1.0.242

v1.0.241

v1.0.240

v1.0.239

v1.0.238

What's Changed

New Contributors

v1.0.237

v1.0.236

v1.0.235

v1.0.234

v1.0.233

v4.38.3

v4.38.2

v4.38.1

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

v0.5.140

What's Changed

v0.5.139

What's Changed

v0.5.138

What's Changed

Uh oh!

changeset-bot Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

freshtonic left a comment

Choose a reason for hiding this comment

Uh oh!

freshtonic Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

freshtonic left a comment

Choose a reason for hiding this comment

Uh oh!

freshtonic left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

freshtonic left a comment

Choose a reason for hiding this comment

Suggested follow-up PR

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 2, 2026 •

edited

Loading

changeset-bot Bot commented Oct 2, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading