Bump the external-dependencies group across 3 directories with 7 updates by dependabot[bot] · Pull Request #2412 · microsoft/AL-Go

dependabot · 2026-10-20T13:12:30Z

Bumps the external-dependencies group with 3 updates in the /.github/workflows directory: actions/create-github-app-token, github/codeql-action/upload-sarif and ossf/scorecard-action.
Bumps the external-dependencies group with 5 updates in the /Templates/AppSource App/.github/workflows directory:

Package	From	To
actions/checkout	`7.0.0`	`7.0.1`
actions/setup-node	`6.4.0`	`7.1.0`
github/codeql-action/upload-sarif	`4.38.2`	`4.38.3`
actions/download-artifact	`8.0.1`	`8.0.2`
actions/upload-artifact	`7.0.1`	`7.0.2`

Bumps the external-dependencies group with 5 updates in the /Templates/Per Tenant Extension/.github/workflows directory:

Package	From	To
actions/checkout	`7.0.0`	`7.0.1`
actions/setup-node	`6.4.0`	`7.1.0`
github/codeql-action/upload-sarif	`4.38.2`	`4.38.3`
actions/download-artifact	`8.0.1`	`8.0.2`
actions/upload-artifact	`7.0.1`	`7.0.2`

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)

deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)

deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

add support for enterprise-level GitHub Apps (#263) (952a2a7)

support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)

validate private-key input (#376) (f24bbd8)

Commits

64ab729 chore(main): release 3.3.0 (#402)
f3a828e ci: create signed dist commits in release workflow (#404)
655017f docs: clarify when owner grants access to all repositories (#378)
12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
a47236f feat: update permission inputs (#399)
a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
e85f677 test: omit stack traces from snapshots (#401)
9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

... (truncated)

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.4.4 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @justaugustus in ossf/scorecard-action#1716

The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @justaugustus in ossf/scorecard-action#1716

The Scorecard version in results now always matches the Scorecard release the action is built with. by @justaugustus in ossf/scorecard-action#1718

The action no longer prints the GitHub token variable while validating its options. by @arpitjain099 in ossf/scorecard-action#1709

results_format accepts intoto, which wraps the JSON results in an in-toto attestation statement. by @puerco in ossf/scorecard-action#1702

Other

Add a daily canary against Scorecard main by @justaugustus in ossf/scorecard-action#1711

Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @justaugustus in ossf/scorecard-action#1714

Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by @justaugustus in ossf/scorecard-action#1716

Bump Scorecard to v5.6.0 by @justaugustus in ossf/scorecard-action#1719

New Contributors

@arpitjain099 made their first contribution in ossf/scorecard-action#1709

@puerco made their first contribution in ossf/scorecard-action#1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits

fa7117d Bump action tag for v2.5.0 release (#1720)
cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
bedb16e ✨ Add intoto results format (#1702)
de70347 Remove the leftover debug print of the auth token (#1709)
950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
4e9f2a2 📖 RELEASE.md: Document drafting release notes
f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
Additional commits viewable in compare view

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

See full diff in compare view

Updates actions/setup-node from 6.4.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in actions/setup-node#1421

Support absolute paths in node-version-file by @v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in actions/setup-node#1578

docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in actions/setup-node#1593

Fixed cache recommendation syntax by @SubJunk in actions/setup-node#1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in actions/setup-node#1583

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-node#1584

Pin @types/node to v24 by @v-priyagupta108 in actions/setup-node#1585

Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in actions/setup-node#1599

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-node#1598

Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in actions/setup-node#1590

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-node#1610

Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in actions/setup-node#1602

Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in actions/setup-node#1629

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-node#1616

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-node#1615

Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in actions/setup-node#1631

Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in actions/setup-node#1636

Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in actions/setup-node#1638

Update dependencies and add license files by @v-HarithaVattikuti in actions/setup-node#1642

Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-node#1635

New Contributors

@v-jitenderpalsingh made their first contribution in actions/setup-node#1580

@philip-gai made their first contribution in actions/setup-node#1584

@gperdomor made their first contribution in actions/setup-node#1421

@SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

v7.0.0

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in actions/setup-node#1577

Migrate to ESM and upgrade dependencies by @gowridurgad in actions/setup-node#1574

... (truncated)

Commits

949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
7207c4f chore: update dependencies and add license files (#1642)
54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
0c54c7b Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
a829419 Bump @types/semver from 7.7.1 to 7.8.0 (#1616)
680d1e4 Support absolute paths in node-version-file (#1633)
db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

... (truncated)

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

Update the readme by @danwkennedy in actions/download-artifact#473

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Update @actions/artifact to 6.3.1 by @tunc-d in actions/download-artifact#492

Prepare download-artifact v8.0.2 by @tunc-d in actions/download-artifact#493

New Contributors

@tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
e455989 Prepare download-artifact v8.0.2
a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
29bb7ce Update @actions/artifact to 6.3.1
484a0b5 Update the readme (#473)
See full diff in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
c2acded chore: prepare v7.0.2 release
4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
8cbe1be Bump @actions/artifact to 6.3.1
See full diff in compare view

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

See full diff in compare view

Updates actions/setup-node from 6.4.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in actions/setup-node#1421

Support absolute paths in node-version-file by @v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in actions/setup-node#1578

docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in actions/setup-node#1593

Fixed cache recommendation syntax by @SubJunk in actions/setup-node#1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in

Bumps the external-dependencies group with 3 updates in the /.github/workflows directory: [actions/create-github-app-token](https://github.com/actions/create-github-app-token), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Bumps the external-dependencies group with 5 updates in the /Templates/AppSource App/.github/workflows directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.1.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | Bumps the external-dependencies group with 5 updates in the /Templates/Per Tenant Extension/.github/workflows directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.1.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@bcd2ba4...64ab729) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@2d11466...fa7117d) Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v7...3d3c42e) Updates `actions/setup-node` from 6.4.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...949feb2) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v8.0.1...9000827) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v7.0.1...cf430e0) Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v7...3d3c42e) Updates `actions/setup-node` from 6.4.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...949feb2) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v8.0.1...9000827) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v7.0.1...cf430e0) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: external-dependencies - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: external-dependencies - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: external-dependencies - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: external-dependencies - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

🔵 Needs a closer look

No concrete defects were identified, but the setup-node major upgrade still needs workflow compatibility validation and human confirmation.

No open issues 🎉

What changed in this PR

Updates seven pinned external actions across AL-Go’s repository workflows and both Business Central extension templates.

Changes:

Refreshes GitHub App token creation, Scorecard, and SARIF upload actions.
Updates checkout and artifact actions in both templates.
Upgrades setup-node from 6.4.0 to 7.1.0 for Copilot review runners.

File	Description
Templates/Per Tenant Extension/.github/workflows/PullRequestHandler.yaml	Updates SARIF upload action.
Templates/Per Tenant Extension/.github/workflows/CopilotPRReviewRunner.yaml	Updates checkout, Node setup, and artifact actions.
Templates/Per Tenant Extension/.github/workflows/CopilotPRReview.yaml	Updates metadata upload action.
Templates/Per Tenant Extension/.github/workflows/CICD.yaml	Updates SARIF upload action.
Templates/AppSource App/.github/workflows/PullRequestHandler.yaml	Updates SARIF upload action.
Templates/AppSource App/.github/workflows/CopilotPRReviewRunner.yaml	Updates checkout, Node setup, and artifact actions.
Templates/AppSource App/.github/workflows/CopilotPRReview.yaml	Updates metadata upload action.
Templates/AppSource App/.github/workflows/CICD.yaml	Updates SARIF upload action.
.github/workflows/scorecard-analysis.yml	Updates Scorecard and SARIF upload actions.
.github/workflows/powershell.yaml	Updates SARIF upload action.
.github/workflows/E2E.yaml	Updates GitHub App token action.
.github/workflows/Deploy.yaml	Updates GitHub App token action.
.github/workflows/CleanupTempRepos.yaml	Updates GitHub App token action.

_{Review effort: Balanced}

Copilot AI balanced review requested due to automatic review settings October 20, 2026 13:12

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 20, 2026

dependabot Bot requested a review from a team as a code owner October 20, 2026 13:12

Copilot started reviewing October 20, 2026 13:13

View session

Copilot AI reviewed Oct 20, 2026

View reviewed changes

Maria Zhelezova (mazhelez) approved these changes Oct 20, 2026

View reviewed changes

Alexander Holstrup (aholstrup1) approved these changes Oct 20, 2026

View reviewed changes

Alexander Holstrup (aholstrup1) merged commit 5ba7094 into main Oct 20, 2026
8 checks passed

dependabot Bot deleted the dependabot/github_actions/dot-github/workflows/external-dependencies-a349f87739 branch October 20, 2026 14:03

Navigation Menu

Repository navigation

Bump the external-dependencies group across 3 directories with 7 updates - #2412

Bump the external-dependencies group across 3 directories with 7 updates#2412
Alexander Holstrup (aholstrup1) merged 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/external-dependencies-a349f87739

dependabot Bot commented on behalf of github Oct 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Oct 20, 2026

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

3.2.0 (2026-05-12)

Features

Bug Fixes

v4.38.3

CodeQL Action Changelog

[UNRELEASED]

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

v2.5.0

What's Changed

Other

New Contributors

v7.0.1

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

v7.0.0

What's Changed

Enhancements:

v4.38.3

CodeQL Action Changelog

[UNRELEASED]

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

v8.0.2

What's Changed

New Contributors

v7.0.2

What's Changed

New Contributors

v7.0.1

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1