chore(deps): bump the actions group with 7 updates

[dependabot]

Bumps the actions group with 7 updates:

Package	From	To
ocaml/setup-ocaml	3.6.1	3.7.0
github/codeql-action/init	4.37.0	4.37.1
github/codeql-action/analyze	4.37.0	4.37.1
hyperpolymath/a2ml-validate-action	59145c7d1039fa3059b3ecacdb50ee23d7505898	55e8c28bab4e7f2399fdbd57a6da1051369f3847
hyperpolymath/k9-validate-action	2d96f43c538964b097d159ed3a56ba5b5ceca227	7c3c0e9fa5165626e74ecce78109b3295b798b92
actions/setup-node	6.4.0	7.0.0
softprops/action-gh-release	3.0.1	3.0.2

Updates ocaml/setup-ocaml from 3.6.1 to 3.7.0

Release notes

Sourced from ocaml/setup-ocaml's releases.

v3.7.0

What's Changed

• Bump jdx/mise-action from 4.0.1 to 4.1.0 by @​dependabot[bot] in ocaml/setup-ocaml#1105
• Bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in ocaml/setup-ocaml#1104
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in ocaml/setup-ocaml#1107
• Bump jdx/mise-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in ocaml/setup-ocaml#1106
• Resolve compiler versions from opam-repository-archive as well by @​dra27 in ocaml/setup-ocaml#1109
• Verify downloaded opam release signatures by @​smorimoto in ocaml/setup-ocaml#1110
• Avoid redundant opam repository fetches by @​smorimoto in ocaml/setup-ocaml#1111
• Batch package manager operations by @​smorimoto in ocaml/setup-ocaml#1112
• Prepare 3.7.0 by @​smorimoto in ocaml/setup-ocaml#1113

Full Changelog: ocaml/setup-ocaml@v3.6.1...v3.7.0

Commits

• 15d6600 Merge pull request #1113 from ocaml/prepare-3.7.0
• 9e81ade Prepare 3.7.0
• 119163b Merge pull request #1112 from ocaml/batch-package-manager-operations
• e917ba0 Batch package manager operations
• 133da54 Merge pull request #1111 from ocaml/avoid-redundant-opam-repository-fetches
• 355a73b Avoid redundant opam repository fetches
• e0771d9 Merge pull request #1110 from ocaml/feature/verify-opam-signatures
• c76fa89 Verify downloaded opam release signatures
• ed2f026 Update npm deps
• 70617ae Merge pull request #1109 from dra27/parse-version-correctly
• Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Updates hyperpolymath/a2ml-validate-action from 59145c7d1039fa3059b3ecacdb50ee23d7505898 to 55e8c28bab4e7f2399fdbd57a6da1051369f3847

Changelog

Sourced from hyperpolymath/a2ml-validate-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.0.0] - 2026-05-29

Added

• Initial Marketplace-ready composite action for validating .a2ml manifests.
• Configurable path, strict, and paths-ignore inputs.
• GitHub Actions outputs for scanned files, validation errors, and warnings.

Fixed

• Allow local smoke runs outside GitHub Actions by defaulting missing GITHUB_OUTPUT to /dev/null.

Commits

• 55e8c28 chore(deps): bump the actions group with 4 updates (#57)
• 05bcb78 ci: Secret Scanner caller must grant the reusable's job permissions (#56)
• e558e79 fix(ci): clear OSSF Scorecard startup_failure (#55)
• a1898b7 Revert #53: TOML is not canonical A2ML (spec is S-expr/Djot-like) (#54)
• db22cd5 feat: canonical A2ML dialect = TOML (warn-by-default, enforce flag) (#53)
• 7e1cd7e chore(deps): bump the actions group with 3 updates (#52)
• c14a51a chore(deps): bump the actions group with 2 updates (#51)
• abcc1a0 fix(clade): correct CLADE uuid (deterministic v5, was template residue) (#50)
• 4ae6b48 docs: post-canon reference + factual fixes (#49)
• ac1392a chore(hooks): version-controlled pre-commit + SPDX split by file-type (#48)
• Additional commits viewable in compare view

Updates hyperpolymath/k9-validate-action from 2d96f43c538964b097d159ed3a56ba5b5ceca227 to 7c3c0e9fa5165626e74ecce78109b3295b798b92

Changelog

Sourced from hyperpolymath/k9-validate-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.0.0] - 2026-05-29

Added

• Initial Marketplace-ready composite action for validating .k9 and .k9.ncl files.
• Configurable path, strict, and paths-ignore inputs.
• GitHub Actions outputs for scanned files, validation errors, and warnings.

Fixed

• Allow local smoke runs outside GitHub Actions by defaulting missing GITHUB_OUTPUT to /dev/null.

Commits

• 7c3c0e9 chore(deps): bump the actions group with 5 updates (#36)
• bddcd91 ci: Secret Scanner caller must grant the reusable's job permissions (#35)
• 3e091a3 chore(deps): bump the actions group with 4 updates (#34)
• 91e2b6b fix(clade): correct identity uuid (deterministic v5) (#33)
• b9acd2a chore(deps): bump the actions group with 2 updates (#32)
• eea3a84 docs(readme): convert README.adoc -> Markdown (renders on Glama/profile/commu...
• 9f95614 chore(ci): add dormant push-email notification workflow (#30)
• 90ac96b chore(clade): backfill [status] lifecycle block (#29)
• 8149729 chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair) (#28)
• 4a64df7 chore(ci): bump standards reusable workflow pins (#27)
• Additional commits viewable in compare view

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Updates softprops/action-gh-release from 3.0.1 to 3.0.2

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in softprops/action-gh-release#801
• fix: upload small checksum assets reliably by @​chenrui333 in softprops/action-gh-release#815
• fix: replace existing release assets on Gitea by @​chenrui333 in softprops/action-gh-release#816
• fix: clarify release creation 404 errors by @​chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in softprops/action-gh-release#812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in softprops/action-gh-release#814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in softprops/action-gh-release#801
• fix: upload small checksum assets reliably by @​chenrui333 in softprops/action-gh-release#815
• fix: replace existing release assets on Gitea by @​chenrui333 in softprops/action-gh-release#816
• fix: clarify release creation 404 errors by @​chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in softprops/action-gh-release#812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in softprops/action-gh-release#814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

3.0.1

• maintenance release with updated dependencies

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. v2.6.2 was the final Node 20-compatible release and is no longer maintained or supported.

What's Changed

Other Changes 🔄

• Move the action runtime and bundle target to Node 24
• Update @types/node to the Node 24 line and allow future Dependabot updates
• Keep the floating major tag on v3; freeze v2 at the final v2.6.2 release

... (truncated)

Commits

• 3d0d988 release 3.0.2 (#818)
• 7e13ed4 fix: clarify release creation 404 errors (#817)
• e6c70a5 fix: replace existing release assets on Gitea (#816)
• f345337 fix: publish existing draft releases as prereleases (#801)
• d8a89a2 fix: upload small checksum assets reliably (#815)
• 45ece40 chore(deps): remove unused TypeScript tooling (#814)
• f6b913c feat: improve release error reporting and test coverage (#813)
• 15f193d chore(deps): upgrade TypeScript to 7 (#812)
• cc8268d chore(deps): bump actions/checkout in the github-actions group (#810)
• fd0ed1e chore(deps): bump the npm group with 3 updates (#811)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud