chore(deps): bump the gh-actions-packages group across 1 directory with 6 updates

[dependabot]

Bumps the gh-actions-packages group with 6 updates in the / directory:

Package	From	To
docker/setup-buildx-action	4.2.0	4.4.1
docker/login-action	4.5.1	4.6.0
jlumbroso/free-disk-space	1.3.1	2.0.0
github/codeql-action/upload-sarif	4.37.3	4.38.1
DataDog/dd-octo-sts-action	1.0.4	1.0.5
DataDog/commit-headless	3.3.1	3.4.0

Updates docker/setup-buildx-action from 4.2.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

• Skip BuildKit image pre-pulls for explicit endpoints by @​crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

• Use official Buildx releases for cloud driver by @​crazy-max in docker/setup-buildx-action#606
• Pull BuildKit image before builder creation by @​crazy-max in docker/setup-buildx-action#609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in docker/setup-buildx-action#620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614
• Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600
• Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

Commits

• f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
• e700274 chore: update generated content
• 3061c91 skip BuildKit image pre-pulls for explicit endpoints
• 594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
• bd6e702 chore: update generated content
• 6268c9d pull BuildKit image before builder creation
• e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
• 533ed8e build(deps): bump the codeql-actions group with 2 updates
• bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
• d5079fb chore: update generated content
• Additional commits viewable in compare view

Updates docker/login-action from 4.5.1 to 4.6.0

Release notes

Sourced from docker/login-action's releases.

v4.6.0

• Harden buildx scoped config path handling by @​crazy-max in docker/login-action#1059
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1095.0 in docker/login-action#1051
• Bump js-yaml from 5.2.1 to 5.2.2 in docker/login-action#1057
• Bump postcss from 8.5.10 to 8.5.22 in docker/login-action#1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

• Surface Docker Hub OIDC error responses by @​crazy-max in docker/login-action#1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

Commits

• dbcb813 Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• 5bcb015 [dependabot skip] chore: update generated content
• b30b2f2 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• 9087f1e Merge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.2
• 0009830 [dependabot skip] chore: update generated content
• 2325523 build(deps): bump js-yaml from 5.2.1 to 5.2.2
• 4ec1d4a Merge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.22
• 5fc99ba Merge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...
• e512bd5 Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...
• a146c91 Merge pull request #1059 from crazy-max/harden-buildx-scope-paths
• Additional commits viewable in compare view

Updates jlumbroso/free-disk-space from 1.3.1 to 2.0.0

Release notes

Sourced from jlumbroso/free-disk-space's releases.

v2.0.0 — three breaking changes, each with its reason

Breaking changes

1. swap-storage now defaults to false. Closes #12 — reported and diagnosed by @​zaikunzhang, whose proposed documentation fallback became the new FAQ. Removing swap can kill a job under memory pressure with no error pointing back at the cleanup step; a default should not break something that elementary.
2. tool-cache is renamed preinstalled-runtimes. The old name still works until v3.0.0 and prints a deprecation warning. (Its default is unchanged: false, as it has been since 2022.) The new name says what actually breaks when you enable it: the runtimes that actions/setup-node, setup-python, setup-go, and setup-ruby rely on.
3. Specific options now override general ones. dotnet: false exempts .NET from every removal path, including large-packages. Fixes #33 — reported by @​ashleney; the overlap was first reported by @​gmij in #6, and @​ax3l explained the overlapping removal paths and a workaround. The policy is explicit, and this release applies it to .NET; future subject options add and test their own exemptions.

Upgrading from v1 to v2

Most workflows need no change.

• If you set tool-cache:, rename it to preinstalled-runtimes:. The old name still works until v3.0.0 and prints a warning.
• If you relied on swap being removed by default, add swap-storage: true. It now defaults to false, because removing swap can kill a job under memory pressure with no error pointing back here (#12).
• If you set dotnet: false and were surprised that .NET was still removed, that is fixed — a specific option now overrides a general one (#33).

Also in this release

A README FAQ ("what are the possible side-effects of these settings?"), CONTRIBUTING.md, and a workflow example for running cleanup conditionally (#22). The reasons behind every design decision live in docs/adr/ — including ADR-0007, the record of this release's default change, written the day it was decided.

v1.3.2 — security fix and the decision records

Fixes the template-injection pattern in input handling (#51, by @​nbuckwalt).

Also adds docs/adr/ — the reasoning behind this action: why it exists, what it inherited from apache/flink and ShubhamTatvamasi, what it deliberately does not do, and what is still open.

No behaviour changes. The swap-storage default change ships in the next release.

Commits

• ceedf09 docs: credit the contributors who reported the .NET overlap first, and narrow...
• afeb5ad docs: state the deprecation horizon and add the v1→v2 migration note
• a614499 docs: remove references to unreleased versions
• 9881e8b fix: specific options override general ones — dotnet: false now keeps .NET ...
• 654d8aa feat!: swap-storage defaults to false; tool-cache renamed to preinstalled-run...
• 3f13fea docs: backfill the deliberative record (ADR-0001..0007)
• a855e00 Merge pull request #51 from nbuckwalt/fix/cmd-exec-inputs-env-indirection
• bcffc68 fix: use env var indirection for all boolean inputs to prevent CMD_EXEC
• See full diff in compare view

Updates github/codeql-action/upload-sarif from 4.37.3 to 4.38.1

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates DataDog/dd-octo-sts-action from 1.0.4 to 1.0.5

Release notes

Sourced from DataDog/dd-octo-sts-action's releases.

v1.0.5

• Bump actions/checkout from 6.0.2 to 7.0.0 in /.github/workflows in the gh-actions-packages group across 1 directory in DataDog/dd-octo-sts-action#21
• fix(deps): vuln minor upgrades — 4 packages (minor: 1 · patch: 3) by in DataDog/dd-octo-sts-action#22
• Bump brace-expansion from 1.1.15 to 1.1.18 in the npm_and_yarn group across 1 directory by in DataDog/dd-octo-sts-action#25
• Add built-in OIDC claims debugging to replace actions-oidc-debugger in DataDog/dd-octo-sts-action#17
• Add client name/version headers to STS exchange requests in DataDog/dd-octo-sts-action#26

Commits

• c85802a Merge pull request #26 from DataDog/qiwen.chen/add-client-version-headers
• 48b1149 update readme example
• 31e598e Add client name/version headers to STS exchange requests
• d557589 Merge pull request #17 from DataDog/feature/oidc-claims-debug
• 8641d85 Fix token hash encoding
• 10bd475 deduplicate JWT parsing
• e5d6667 Merge remote-tracking branch 'origin/main' into feature/oidc-claims-debug
• 19f21ae Merge pull request #25 from DataDog/dependabot/npm_and_yarn/npm_and_yarn-8455...
• 95aa0f7 Bump brace-expansion in the npm_and_yarn group across 1 directory
• f62c2a0 Merge pull request #22 from DataDog/engraver-auto-version-upgrade/minorpatch/...
• Additional commits viewable in compare view

Updates DataDog/commit-headless from 3.3.1 to 3.4.0

Commits

• 79367f8 action: Merge pull request #61 from DataDog/fix-submodule-cat-file
• adbd7b5 action: chore: remove unused service catalog entry as this isn't a service (#60)
• b39c8b3 action: chore: remove unused sts policy file (#59)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions