[dependabot]

Bumps the gh-actions-packages group with 8 updates in the / directory:

Package	From	To
docker/setup-buildx-action	4.2.0	4.4.1
docker/login-action	4.5.1	4.6.0
jlumbroso/free-disk-space	1.3.1	2.0.0
actions/upload-artifact	7.0.1	7.0.2
actions/download-artifact	8.0.1	8.0.2
github/codeql-action/upload-sarif	4.37.3	4.38.3
DataDog/dd-octo-sts-action	1.0.4	1.0.5
DataDog/commit-headless	3.3.1	3.4.0

Updates docker/setup-buildx-action from 4.2.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

• Skip BuildKit image pre-pulls for explicit endpoints by @​crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

• Use official Buildx releases for cloud driver by @​crazy-max in docker/setup-buildx-action#606
• Pull BuildKit image before builder creation by @​crazy-max in docker/setup-buildx-action#609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in docker/setup-buildx-action#620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614
• Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600
• Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

Commits

• f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
• e700274 chore: update generated content
• 3061c91 skip BuildKit image pre-pulls for explicit endpoints
• 594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
• bd6e702 chore: update generated content
• 6268c9d pull BuildKit image before builder creation
• e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
• 533ed8e build(deps): bump the codeql-actions group with 2 updates
• bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
• d5079fb chore: update generated content
• Additional commits viewable in compare view

Updates docker/login-action from 4.5.1 to 4.6.0

Release notes

Sourced from docker/login-action's releases.

v4.6.0

• Harden buildx scoped config path handling by @​crazy-max in docker/login-action#1059
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1095.0 in docker/login-action#1051
• Bump js-yaml from 5.2.1 to 5.2.2 in docker/login-action#1057
• Bump postcss from 8.5.10 to 8.5.22 in docker/login-action#1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

• Surface Docker Hub OIDC error responses by @​crazy-max in docker/login-action#1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

Commits

• dbcb813 Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• 5bcb015 [dependabot skip] chore: update generated content
• b30b2f2 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• 9087f1e Merge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.2
• 0009830 [dependabot skip] chore: update generated content
• 2325523 build(deps): bump js-yaml from 5.2.1 to 5.2.2
• 4ec1d4a Merge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.22
• 5fc99ba Merge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...
• e512bd5 Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...
• a146c91 Merge pull request #1059 from crazy-max/harden-buildx-scope-paths
• Additional commits viewable in compare view

Updates jlumbroso/free-disk-space from 1.3.1 to 2.0.0

Release notes

Sourced from jlumbroso/free-disk-space's releases.

v2.0.0 — three breaking changes, each with its reason

Breaking changes

1. swap-storage now defaults to false. Closes #12 — reported and diagnosed by @​zaikunzhang, whose proposed documentation fallback became the new FAQ. Removing swap can kill a job under memory pressure with no error pointing back at the cleanup step; a default should not break something that elementary.
2. tool-cache is renamed preinstalled-runtimes. The old name still works until v3.0.0 and prints a deprecation warning. (Its default is unchanged: false, as it has been since 2022.) The new name says what actually breaks when you enable it: the runtimes that actions/setup-node, setup-python, setup-go, and setup-ruby rely on.
3. Specific options now override general ones. dotnet: false exempts .NET from every removal path, including large-packages. Fixes #33 — reported by @​ashleney; the overlap was first reported by @​gmij in #6, and @​ax3l explained the overlapping removal paths and a workaround. The policy is explicit, and this release applies it to .NET; future subject options add and test their own exemptions.

Upgrading from v1 to v2

Most workflows need no change.

• If you set tool-cache:, rename it to preinstalled-runtimes:. The old name still works until v3.0.0 and prints a warning.
• If you relied on swap being removed by default, add swap-storage: true. It now defaults to false, because removing swap can kill a job under memory pressure with no error pointing back here (#12).
• If you set dotnet: false and were surprised that .NET was still removed, that is fixed — a specific option now overrides a general one (#33).

Also in this release

A README FAQ ("what are the possible side-effects of these settings?"), CONTRIBUTING.md, and a workflow example for running cleanup conditionally (#22). The reasons behind every design decision live in docs/adr/ — including ADR-0007, the record of this release's default change, written the day it was decided.

v1.3.2 — security fix and the decision records

Fixes the template-injection pattern in input handling (#51, by @​nbuckwalt).

Also adds docs/adr/ — the reasoning behind this action: why it exists, what it inherited from apache/flink and ShubhamTatvamasi, what it deliberately does not do, and what is still open.

No behaviour changes. The swap-storage default change ships in the next release.

Commits

• ceedf09 docs: credit the contributors who reported the .NET overlap first, and narrow...
• afeb5ad docs: state the deprecation horizon and add the v1→v2 migration note
• a614499 docs: remove references to unreleased versions
• 9881e8b fix: specific options override general ones — dotnet: false now keeps .NET ...
• 654d8aa feat!: swap-storage defaults to false; tool-cache renamed to preinstalled-run...
• 3f13fea docs: backfill the deliberative record (ADR-0001..0007)
• a855e00 Merge pull request #51 from nbuckwalt/fix/cmd-exec-inputs-env-indirection
• bcffc68 fix: use env var indirection for all boolean inputs to prevent CMD_EXEC
• See full diff in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Updates github/codeql-action/upload-sarif from 4.37.3 to 4.38.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.3

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

• 24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
• 69e87c5 Add changelog note for #4184
• 23b6828 Update changelog for v4.38.3
• e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
• 6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
• 63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
• 7377a10 Add changelog note
• c1a30cd Update default bundle to codeql-bundle-v2.27.2
• d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
• a71b0c6 Replace __dirname in sync.ts
• Additional commits viewable in compare view

Updates DataDog/dd-octo-sts-action from 1.0.4 to 1.0.5

Release notes

Sourced from DataDog/dd-octo-sts-action's releases.

v1.0.5

• Bump actions/checkout from 6.0.2 to 7.0.0 in /.github/workflows in the gh-actions-packages group across 1 directory in DataDog/dd-octo-sts-action#21
• fix(deps): vuln minor upgrades — 4 packages (minor: 1 · patch: 3) by in DataDog/dd-octo-sts-action#22
• Bump brace-expansion from 1.1.15 to 1.1.18 in the npm_and_yarn group across 1 directory by in DataDog/dd-octo-sts-action#25
• Add built-in OIDC claims debugging to replace actions-oidc-debugger in DataDog/dd-octo-sts-action#17
• Add client name/version headers to STS exchange requests in DataDog/dd-octo-sts-action#26

Commits

• c85802a Merge pull request #26 from DataDog/qiwen.chen/add-client-version-headers
• 48b1149 update readme example
• 31e598e Add client name/version headers to STS exchange requests
• d557589 Merge pull request #17 from DataDog/feature/oidc-claims-debug
• 8641d85 Fix token hash encoding
• 10bd475 deduplicate JWT parsing
• e5d6667 Merge remote-tracking branch 'origin/main' into feature/oidc-claims-debug
• 19f21ae Merge pull request #25 from DataDog/dependabot/npm_and_yarn/npm_and_yarn-8455...
• 95aa0f7 Bump brace-expansion in the npm_and_yarn group across 1 directory
• f62c2a0 Merge pull request #22 from DataDog/engraver-auto-version-upgrade/minorpatch/...
• Additional commits viewable in compare view

Updates DataDog/commit-headless from 3.3.1 to 3.4.0

Commits

• 79367f8 action: Merge pull request #61 from DataDog/fix-submodule-cat-file
• adbd7b5 action: chore: remove unused service catalog entry as this isn't a service (#60)
• b39c8b3 action: chore: remove unused sts policy file (#59)
• See full diff in compare view

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T17:53:05.796518Z	a37d4f9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a37d4f9e32

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve swap cleanup when upgrading the disk-space action

Version 2 changes swap-storage from true to false by default, so this invocation—and the equivalent arm64 and vulnerability-scan invocations—now reclaim roughly 4 GiB less disk than before. These cleanup steps were added specifically because the image build and Trivy scan exhausted runner storage, so disk-sensitive runs can regress to no space left on device; set swap-storage: true explicitly at all three call sites to preserve the previous behavior.

Useful? React with 👍 / 👎.

[datadog-prod-us1-6]

More details

The upgraded actions appear compatible with existing workflow inputs. GitHub Actions execution remains unverified because CI status access was denied.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit a37d4f9}