chore(deps): bump the actions group across 1 directory with 5 updates by dependabot[bot] · Pull Request #16 · Horizon-Digital-Engineering/flashback

dependabot · 2026-06-08T01:10:06Z

Bumps the actions group with 5 updates in the / directory:

Package	From	To
actions/checkout	`6.0.2`	`6.0.3`
taiki-e/install-action	`2.79.5`	`2.81.7`
sigstore/cosign-installer	`3.10.0`	`4.1.2`
trufflesecurity/trufflehog	`3.95.3`	`3.95.5`
EmbarkStudios/cargo-deny-action	`2.0.19`	`2.0.20`

Updates actions/checkout from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

... (truncated)

Commits

df4cb1c Update changelog for v6.0.3 (#2446)
1cce339 Fix checkout init for SHA-256 repositories (#2439)
900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
0c366fd Update changelog (#2357)
See full diff in compare view

Updates taiki-e/install-action from 2.79.5 to 2.81.7

Release notes

Sourced from taiki-e/install-action's releases.

2.81.7

Update wasmtime@latest to 45.0.1.

Update vacuum@latest to 0.29.1.

Update syft@latest to 1.45.1.

Update rclone@latest to 1.74.3.

Update cargo-audit@latest to 0.22.2.

2.81.6

Update prek@latest to 0.4.4.

Update cargo-shear@latest to 1.13.0.

2.81.5

Update vacuum@latest to 0.29.0.

Update uv@latest to 0.11.19.

Update typos@latest to 1.47.2.

Update mise@latest to 2026.6.0.

2.81.4

Update vacuum@latest to 0.28.4.

Update typos@latest to 1.47.1.

Update syft@latest to 1.45.0.

Update cargo-neat@latest to 0.4.0.

Update cargo-mutants@latest to 27.1.0.

2.81.3

Update vacuum@latest to 0.28.3.

Update uv@latest to 0.11.18.

Update trivy@latest to 0.71.0.

2.81.2

Update mise@latest to 2026.5.18.

Update cargo-semver-checks@latest to 0.48.0.

2.81.1

Update cargo-no-dev-deps@latest to 0.2.24.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.81.7] - 2026-06-06

Update wasmtime@latest to 45.0.1.

Update vacuum@latest to 0.29.1.

Update syft@latest to 1.45.1.

Update rclone@latest to 1.74.3.

Update cargo-audit@latest to 0.22.2.

[2.81.6] - 2026-06-05

Update prek@latest to 0.4.4.

Update cargo-shear@latest to 1.13.0.

[2.81.5] - 2026-06-05

Update vacuum@latest to 0.29.0.

Update uv@latest to 0.11.19.

Update typos@latest to 1.47.2.

Update mise@latest to 2026.6.0.

[2.81.4] - 2026-06-04

Update vacuum@latest to 0.28.4.

Update typos@latest to 1.47.1.

Update syft@latest to 1.45.0.

Update cargo-neat@latest to 0.4.0.

... (truncated)

Commits

56545b3 Release 2.81.7
c8d5571 Update wasmtime@latest to 45.0.1
982454f Update vacuum@latest to 0.29.1
d70d95a Update syft@latest to 1.45.1
accae66 Update rclone@latest to 1.74.3
78aab23 Update parse-dockerfile manifest
16ef3a9 Update cargo-shear manifest
36524ad Update cargo-audit@latest to 0.22.2
59012be Release 2.81.6
52d2b07 Update prek@latest to 0.4.4
Additional commits viewable in compare view

Updates sigstore/cosign-installer from 3.10.0 to 4.1.2

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.2

What's Changed

Bump cosign to 3.0.6 in sigstore/cosign-installer#232

v4.1.1

What's Changed

chore: update default cosign-release to v3.0.5 in sigstore/cosign-installer#223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

Bump cosign to 3.0.5 in sigstore/cosign-installer#220

fix: add retry to curl downloads for transient network failures in sigstore/cosign-installer#210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

v4.0.0

What's Changed?

Note: You must upgrade to cosign-installer v4 if you want to install Cosign v3+. You may still install Cosign v2.x with cosign-installer v4.

In version v3+, using cosign sign-blob requires adding the --bundle flag which may require you to update your signing command.

Add support for Cosign v3 releases (#201)

v3.10.1

What's Changed?

Note: cosign-installer v3.x cannot be used to install Cosign v3.x. You must upgrade to cosign-installer v4 in order to use Cosign v3.

Note: This is planned to be the final release of Cosign v2, though we will cut new releases for any critical security or bug fixes. We recommend transitioning to Cosign v3.

Bump default Cosign to v2.6.1 (#203)

Commits

6f9f177 Bump cosign to 3.0.6 (#232)
b5e753a Bump actions/github-script from 8.0.0 to 9.0.0 (#230)
115e4ce Bump actions/setup-go from 6.3.0 to 6.4.0 (#226)
cad07c2 chore: update default cosign-release to v3.0.5 (#223)
ba7bc0a fix: add retry to curl downloads for transient network failures (#210)
5a292e1 Bump cosign to 3.0.5 (#220)
351ea76 Bump actions/checkout from 6.0.1 to 6.0.2 (#217)
c17565f test with go 1.26 too (#221)
a6fdd19 Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)
430b6a7 docs: fix registry from gcr.io to ghcr.io (#213)
Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.95.3 to 3.95.5

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.5

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in trufflesecurity/trufflehog#4915

[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in trufflesecurity/trufflehog#4907

fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in trufflesecurity/trufflehog#4958

Added GitLab OAuth Detector by @shahzadhaider1 in trufflesecurity/trufflehog#4729

Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in trufflesecurity/trufflehog#4761

[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4770

[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4803

fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in trufflesecurity/trufflehog#4954

Automate corpora testing in CI by @mustansir14 in trufflesecurity/trufflehog#4927

Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in trufflesecurity/trufflehog#4924

feat: add host, db and username to ExtraData for database detectors by @mariocj89 in trufflesecurity/trufflehog#4849

Remove over speculation from Corpora CI workflow by @mustansir14 in trufflesecurity/trufflehog#4974

Fix line numbers for duplicate secrets within a chunk by @amanfcp in trufflesecurity/trufflehog#4910

Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in trufflesecurity/trufflehog#4961

Update Go security dependencies by @cursor[bot] in trufflesecurity/trufflehog#4986

Pin GitHub Actions to SHA digests by @bryanbeverly in trufflesecurity/trufflehog#4985

Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in trufflesecurity/trufflehog#4983

Added source config flags to sharepoint proto by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4972

[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in trufflesecurity/trufflehog#4981

adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in trufflesecurity/trufflehog#4991

New Contributors

@mariocj89 made their first contribution in trufflesecurity/trufflehog#4849

@cursor[bot] made their first contribution in trufflesecurity/trufflehog#4986

@johannestaas-trufflesec made their first contribution in trufflesecurity/trufflehog#4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in trufflesecurity/trufflehog#4915

[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in trufflesecurity/trufflehog#4907

fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in trufflesecurity/trufflehog#4958

Added GitLab OAuth Detector by @shahzadhaider1 in trufflesecurity/trufflehog#4729

Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in trufflesecurity/trufflehog#4761

[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4770

[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4803

fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in trufflesecurity/trufflehog#4954

Automate corpora testing in CI by @mustansir14 in trufflesecurity/trufflehog#4927

Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in trufflesecurity/trufflehog#4924

feat: add host, db and username to ExtraData for database detectors by @mariocj89 in trufflesecurity/trufflehog#4849

Remove over speculation from Corpora CI workflow by @mustansir14 in trufflesecurity/trufflehog#4974

Fix line numbers for duplicate secrets within a chunk by @amanfcp in trufflesecurity/trufflehog#4910

Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in trufflesecurity/trufflehog#4961

Update Go security dependencies by @cursor[bot] in trufflesecurity/trufflehog#4986

Pin GitHub Actions to SHA digests by @bryanbeverly in trufflesecurity/trufflehog#4985

Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in trufflesecurity/trufflehog#4983

Added source config flags to sharepoint proto by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4972

... (truncated)

Commits

d411fff feat(apk): adds some debugging info for APKs and fixes issues parsing obfusca...
26eae1f [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support (#4981)
6c8f640 Added source config flags to sharepoint proto (#4972)
9f0b97f Update CODEOWNERS: replace 5 slugs with scanning + integrations (#4983)
36f6f69 Pin GitHub Actions to SHA digests (#4985)
52ebebb Update Go security dependencies (#4986)
ec67ff2 Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors (#4961)
0ec3634 Fix line numbers for duplicate secrets within a chunk (#4910)
79acbf4 Remove over speculation from Corpora CI workflow (#4974)
d86254e feat: add host, db and username to ExtraData for database detectors (#4849)
Additional commits viewable in compare view

Updates EmbarkStudios/cargo-deny-action from 2.0.19 to 2.0.20

Commits

bb137d7 Bump to 0.19.8
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.79.5` | `2.81.7` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.10.0` | `4.1.2` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.95.3` | `3.95.5` | | [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) | `2.0.19` | `2.0.20` | Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) Updates `taiki-e/install-action` from 2.79.5 to 2.81.7 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@6c1f7cf...56545b3) Updates `sigstore/cosign-installer` from 3.10.0 to 4.1.2 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@d7543c9...6f9f177) Updates `trufflesecurity/trufflehog` from 3.95.3 to 3.95.5 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) Updates `EmbarkStudios/cargo-deny-action` from 2.0.19 to 2.0.20 - [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases) - [Commits](EmbarkStudios/cargo-deny-action@a531616...bb137d7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.81.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: EmbarkStudios/cargo-deny-action dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-08T01:10:07Z

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot · 2026-06-15T01:09:29Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot requested a review from lgutschow as a code owner June 8, 2026 01:10

dependabot Bot closed this Jun 15, 2026

dependabot Bot deleted the dependabot/github_actions/actions-dcfc6cfdde branch June 15, 2026 01:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the actions group across 1 directory with 5 updates#16

chore(deps): bump the actions group across 1 directory with 5 updates#16
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-dcfc6cfdde

dependabot Bot commented on behalf of github Jun 8, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.3

What's Changed

New Contributors

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

2.81.7

2.81.6

2.81.5

2.81.4

2.81.3

2.81.2

2.81.1

Changelog

[Unreleased]

[2.81.7] - 2026-06-06

[2.81.6] - 2026-06-05

[2.81.5] - 2026-06-05

[2.81.4] - 2026-06-04

v4.1.2

What's Changed

v4.1.1

What's Changed

v4.1.0

What's Changed

v4.0.0

What's Changed?

v3.10.1

What's Changed?

v3.95.5

What's Changed

New Contributors

v3.95.4

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Labels

Uh oh!

dependabot Bot commented on behalf of github Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 8, 2026 •

edited

Loading