deps(deps): Bump the "dependencies" group with 3 updates across multiple ecosystems

[dependabot]

Bumps the dependencies group with 25 updates:

Package	From	To
actions/checkout	4.2.2	7.0.1
actions/setup-python	6.2.0	7.0.0
dtolnay/rust-toolchain	3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9	2c7215f132e9ebf062739d9130488b56d53c060c
actions/setup-node	6.4.0	7.0.0
actions/setup-go	6.4.0	7.0.0
super-linter/super-linter	8.6.0	8.7.0
actions/labeler	6.1.0	7.0.0
actions/attest-build-provenance	4.1.0	4.1.1
actions/cache	5.0.5	6.1.0
actions/create-github-app-token	2.0.6	3.2.0
falkcorp/gha-load-config	1.1.5.pre.rc.1	1.1.5
falkcorp/gha-ci-generate-matrices	1.1.7	1.1.8
dorny/paths-filter	4.0.1	4.0.2
falkcorp/github-common/.github/workflows/reusable-advanced-cache.yml	1.10.6.pre.rc.2	1.10.8
falkcorp/gha-release-protobuf	1.0.3.pre.rc.1	1.0.3
falkcorp/gha-ci-workflow-helpers	1.1.5	1.1.6
vladopajic/go-test-coverage	2.18.8	2.18.9
falkcorp/gha-get-frontend-config	1.1.5.pre.rc.1	1.1.5
actions/stale	10.3.0	10.4.0
falkcorp/gha-detect-languages	1.1.6	1.1.7
softprops/action-gh-release	3.0.0	3.0.2
github/codeql-action/init	4.36.1	4.37.2
github/codeql-action/start-proxy	4.36.1	4.37.2
github/codeql-action/autobuild	4.36.1	4.37.2
github/codeql-action/analyze	4.36.1	4.37.2

Updates actions/checkout from 4.2.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates actions/setup-python from 6.2.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-python#1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in actions/setup-python#1338
• Remove the pip-install input by @​gowridurgad in actions/setup-python#1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in actions/setup-python#1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in actions/setup-python#1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in actions/setup-python#1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in actions/setup-python#1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-python#1337

New Contributors

• @​lmvysakh made their first contribution in actions/setup-python#1335
• @​philip-gai made their first contribution in actions/setup-python#1337

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

• Add RHEL support and include Linux distro in cache keys by @​priyagupta108 in actions/setup-python#1323
• Fix pip cache error handling on Windows by @​priyagupta108 in actions/setup-python#1040

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-python#1281
• Upgrade actions dependencies by @​gowridurgad with @​Copilot in actions/setup-python#1303
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-python#1324
• Upgrade dependency versions and test workflow configuration by @​HarithaVattikuti in actions/setup-python#1322

Documentation

• Update advanced-usage.md by @​Dunky-Z in actions/setup-python#811

New Contributors

• @​gowridurgad with @​Copilot made their first contribution in actions/setup-python#1303
• @​jasongin made their first contribution in actions/setup-python#1324
• @​Dunky-Z made their first contribution in actions/setup-python#811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

Commits

• 5fda3b9 Pin SHA commits and update docs with latest versions (#1338)
• 4ab7e95 Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-0
• 0f3a009 Remove the pip-install input (#1336)
• f8cf429 Migrate to ESM and upgrade dependencies (#1330)
• 54baeea Validate and retry manifest fetch to prevent silent failures (#1332)
• c709277 Annotation code fix (#1335)
• 6849080 remove EOL Python versions and Bumps numpy text fixture (#1333)
• 0903b46 Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)
• ece7cb0 Fix pip cache error handling on Windows. (#1040)
• 1d18d7a Update advanced-usage.md (#811)
• Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 to 2c7215f132e9ebf062739d9130488b56d53c060c

Commits

• 2c7215f Add 1.97.1 patch release
• fa04a14 Add 1.96.1 patch release
• 67ef31d Update actions/checkout@v6 -> v7
• See full diff in compare view

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Updates actions/setup-go from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-go#763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-go#771

New Contributors

• @​philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

Commits

• b7ad1da chore(deps): bump @​actions/cache to 6.2.0 (#771)
• 0778a10 Migrate to ESM and upgrade dependencies (#763)
• 924ae3a chore: bump version to 6.5.0 in package.json and package-lock.json (#762)
• e91cc3b Bump @​actions/cache to 5.1.0, log cache write denied (#758)
• 4a2405e chore: update @​types/node and @​typescript-eslint dependencies to latest versi...
• 78961f6 chore: update @​actions dependencies and refresh license cache (#744)
• See full diff in compare view

Updates super-linter/super-linter from 8.6.0 to 8.7.0

Release notes

Sourced from super-linter/super-linter's releases.

v8.7.0

8.7.0 (2026-06-18)

🚀 Features

• powershell ansi output and dynamic sizing (#7793) (b573256), closes #7445
• update existing pr summary comment (#7848) (85afaee)

🐛 Bugfixes

• docs: don't mention extension in bash-exec (#7708) (56c7c3c)
• enable_github_actions_step_summary ref in debug log (#7853) (8c38f8f)
• ktlint installation (#7883) (6ab7200)
• output: pass comment payload via stdin to jq and curl (#7928) (4dd300c)
• remove debug statement when calling gh api (#7889) (30ed3d5)
• terragrunt version lookup (#7918) (a2eaeb1)

⬆️ Dependency updates

• bundler: bump rubocop (#7923) (0738987)
• bundler: bump rubocop in /dependencies in the rubocop group (#7731) (bf2414c)
• bundler: bump rubocop-capybara (#7781) (35ef3f6)
• bundler: bump the rubocop group across 1 directory with 2 updates (#7816) (5a6de32)
• bundler: bump the rubocop group across 1 directory with 3 updates (#7875) (4d01de2)
• bundler: bump the rubocop group in /dependencies with 2 updates (#7890) (cd79eea)
• docker: bump dart in the docker group (#7755) (86c9c54)
• docker: bump goreleaser/goreleaser in the docker group (#7705) (487d0d8)
• docker: bump mvdan/shfmt in the docker group (#7718) (a1fc30a)
• docker: bump python (#7730) (c5fb918)
• docker: bump the docker group across 1 directory with 10 updates (#7817) (5e3985b)
• docker: bump the docker group across 1 directory with 11 updates (#7876) (9bc8ec9)
• docker: bump the docker group across 1 directory with 3 updates (#7765) (d9f1398)
• docker: bump the docker group across 1 directory with 5 updates (#7786) (b7ba6a5)
• docker: bump the docker group across 1 directory with 6 updates (#7912) (7b70a50)
• docker: bump the docker group across 1 directory with 8 updates (#7753) (3fec5a3)
• java: bump com.puppycrawl.tools:checkstyle (#7788) (4a69c1a)
• java: bump com.puppycrawl.tools:checkstyle (#7914) (65ad252)
• npm: bump @​hono/node-server in /dependencies (#7720) (a8c6363)
• npm: bump @​protobufjs/utf8 from 1.1.0 to 1.1.1 in /dependencies (#7812) (0651d17)
• npm: bump @​stoplight/spectral-cli in /dependencies (#7743) (fd0d01c)
• npm: bump @​stoplight/spectral-cli in /dependencies (#7814) (813e4fb)
• npm: bump brace-expansion (#7840) (f6e64b5)
• npm: bump fast-uri from 3.0.6 to 3.1.2 in /dependencies (#7803) (9253b88)
• npm: bump fast-xml-builder from 1.1.4 to 1.2.0 in /dependencies (#7802) (5b044ae)
• npm: bump hono from 4.12.14 to 4.12.18 in /dependencies (#7801) (b39c4bb)
• npm: bump hono from 4.12.7 to 4.12.12 in /dependencies (#7721) (ab671c2)
• npm: bump next from 16.2.2 to 16.2.3 in /dependencies (#7739) (223d8b2)

... (truncated)

Changelog

Sourced from super-linter/super-linter's changelog.

Changelog

8.7.0 (2026-06-18)

🚀 Features

• powershell ansi output and dynamic sizing (#7793) (b573256), closes #7445
• update existing pr summary comment (#7848) (85afaee)

🐛 Bugfixes

• docs: don't mention extension in bash-exec (#7708) (56c7c3c)
• enable_github_actions_step_summary ref in debug log (#7853) (8c38f8f)
• ktlint installation (#7883) (6ab7200)
• output: pass comment payload via stdin to jq and curl (#7928) (4dd300c)
• remove debug statement when calling gh api (#7889) (30ed3d5)
• terragrunt version lookup (#7918) (a2eaeb1)

⬆️ Dependency updates

• bundler: bump rubocop (#7923) (0738987)
• bundler: bump rubocop in /dependencies in the rubocop group (#7731) (bf2414c)
• bundler: bump rubocop-capybara (#7781) (35ef3f6)
• bundler: bump the rubocop group across 1 directory with 2 updates (#7816) (5a6de32)
• bundler: bump the rubocop group across 1 directory with 3 updates (#7875) (4d01de2)
• bundler: bump the rubocop group in /dependencies with 2 updates (#7890) (cd79eea)
• docker: bump dart in the docker group (#7755) (86c9c54)
• docker: bump goreleaser/goreleaser in the docker group (#7705) (487d0d8)
• docker: bump mvdan/shfmt in the docker group (#7718) (a1fc30a)
• docker: bump python (#7730) (c5fb918)
• docker: bump the docker group across 1 directory with 10 updates (#7817) (5e3985b)
• docker: bump the docker group across 1 directory with 11 updates (#7876) (9bc8ec9)
• docker: bump the docker group across 1 directory with 3 updates (#7765) (d9f1398)
• docker: bump the docker group across 1 directory with 5 updates (#7786) (b7ba6a5)
• docker: bump the docker group across 1 directory with 6 updates (#7912) (7b70a50)
• docker: bump the docker group across 1 directory with 8 updates (#7753) (3fec5a3)
• java: bump com.puppycrawl.tools:checkstyle (#7788) (4a69c1a)
• java: bump com.puppycrawl.tools:checkstyle (#7914) (65ad252)
• npm: bump @​hono/node-server in /dependencies (#7720) (a8c6363)
• npm: bump @​protobufjs/utf8 from 1.1.0 to 1.1.1 in /dependencies (#7812) (0651d17)
• npm: bump @​stoplight/spectral-cli in /dependencies (#7743) (fd0d01c)
• npm: bump @​stoplight/spectral-cli in /dependencies (#7814) (813e4fb)
• npm: bump brace-expansion (#7840) (f6e64b5)
• npm: bump fast-uri from 3.0.6 to 3.1.2 in /dependencies (#7803) (9253b88)
• npm: bump fast-xml-builder from 1.1.4 to 1.2.0 in /dependencies (#7802) (5b044ae)
• npm: bump hono from 4.12.14 to 4.12.18 in /dependencies (#7801) (b39c4bb)
• npm: bump hono from 4.12.7 to 4.12.12 in /dependencies (#7721) (ab671c2)

... (truncated)

Commits

• 4ce2083 chore(main): release 8.7.0 (#7704)
• b2baf83 deps(npm): bump the npm group across 1 directory with 9 updates (#7939)
• 3e6cd30 chore: exempt release prs from stale check (#7934)
• 7b70a50 deps(docker): bump the docker group across 1 directory with 6 updates (#7912)
• c5fb918 deps(docker): bump python (#7730)
• 3833d50 deps(npm): bump protobufjs (#7917)
• 27acb3c deps(python): bump the pip group across 1 directory with 6 updates (#7932)
• 8d41efe ci(dev-docker): bump node (#7846)
• 65ad252 deps(java): bump com.puppycrawl.tools:checkstyle (#7914)
• ef436c3 ci(dev-npm): bump release-please (#7892)
• Additional commits viewable in compare view

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

• Migrate to ESM and update dependencies by @​chiranjib-swain in actions/labeler#949

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

• Improve PR number validation and warning messages in input handling by @​chiranjib-swain in actions/labeler#939

Dependency Updates

• Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by @​dependabot in actions/labeler#943
• Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 by @​dependabot in actions/labeler#942

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits

• bf12e9b feat: migrate to ESM and update dependencies (#949)
• b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
• 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
• f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
• See full diff in compare view

Updates actions/attest-build-provenance from 4.1.0 to 4.1.1

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.1.1

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

Description has been truncated