Update [Github] Update GHA Dependencies (#176676)

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [EnricoMi/publish-unit-test-result-action](https://redirect.github.com/EnricoMi/publish-unit-test-result-action) | action | minor | `v2.22.0` → `v2.23.0` | | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | patch | `v6.0.1` → `v6.0.2` | | | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | minor | `v6.1.0` → `v6.3.0` | `v6.4.0` | | [actions/setup-python](https://redirect.github.com/actions/setup-python) | action | minor | `v6.1.0` → `v6.2.0` | | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | patch | `v7.0.0` → `v7.0.1` | | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | patch | `7.0.0` → `v7.0.1` | | | [aminya/setup-cpp](https://redirect.github.com/aminya/setup-cpp) | action | minor | `v1.7.2` → `v1.8.0` | | | [docker/login-action](https://redirect.github.com/docker/login-action) | action | minor | `v4.0.0` → `v4.1.0` | | | ghcr.io/llvm/ci-ubuntu-24.04-abi-tests | container | digest | `ef869c1` → `cb3aea3` | | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | minor | `v4.31.9` → `v4.35.2` | | | [hendrikmuhs/ccache-action](https://redirect.github.com/hendrikmuhs/ccache-action) | action | patch | `v1.2.20` → `v1.2.22` | `v1.2.23` | | [maxim-lobanov/setup-xcode](https://redirect.github.com/maxim-lobanov/setup-xcode) | action | minor | `v1.6.0` → `v1.7.0` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | minor | `v1.13.0` → `v1.14.0` | | | [tj-actions/changed-files](https://redirect.github.com/tj-actions/changed-files) | action | patch | `v47.0.1` → `v47.0.6` | | | [tj-actions/changed-files](https://redirect.github.com/tj-actions/changed-files) | action | patch | `v47.0.0` → `v47.0.6` | | | [zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action) | action | patch | `v0.5.2` → `v0.5.3` | | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/160328) for more information. --- ### Release Notes <details> <summary>EnricoMi/publish-unit-test-result-action (EnricoMi/publish-unit-test-result-action)</summary> ### [`v2.23.0`](https://redirect.github.com/EnricoMi/publish-unit-test-result-action/releases/tag/v2.23.0) [Compare Source](https://redirect.github.com/EnricoMi/publish-unit-test-result-action/compare/v2.22.0...v2.23.0) Adds the following improvements: - Lock composite actions' versions by SHA [#719](https://redirect.github.com/EnricoMi/publish-unit-test-result-action/pull/719) - Upgrading Python dependencies [#721](https://redirect.github.com/EnricoMi/publish-unit-test-result-action/pull/721), [#727](https://redirect.github.com/EnricoMi/publish-unit-test-result-action/pull/727) - Upgrade GitHub actions [#720](https://redirect.github.com/EnricoMi/publish-unit-test-result-action/pull/720), [#728](https://redirect.github.com/EnricoMi/publish-unit-test-result-action/pull/728) **Full Changelog**: <https://github.com/EnricoMi/publish-unit-test-result-action/compare/v2.22.0...v2.23.0> </details> <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://redirect.github.com/ericsciple) in [#2356](https://redirect.github.com/actions/checkout/pull/2356) </details> <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v6.3.0`](https://redirect.github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.2.0...v6.3.0) #### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@susnux](https://redirect.github.com/susnux) in [#1283](https://redirect.github.com/actions/setup-node/pull/1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@gowridurgad](https://redirect.github.com/gowridurgad) in [#1491](https://redirect.github.com/actions/setup-node/pull/1491) - Replace uuid with crypto.randomUUID() by [@trivikr](https://redirect.github.com/trivikr) in [#1378](https://redirect.github.com/actions/setup-node/pull/1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@dependabot](https://redirect.github.com/dependabot) in [#1498](https://redirect.github.com/actions/setup-node/pull/1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@marco-ippolito](https://redirect.github.com/marco-ippolito) in [#1467](https://redirect.github.com/actions/setup-node/pull/1467) - Scope test lockfiles by package manager and update cache tests by [@gowridurgad](https://redirect.github.com/gowridurgad) in [#1495](https://redirect.github.com/actions/setup-node/pull/1495) #### New Contributors - [@susnux](https://redirect.github.com/susnux) made their first contribution in [#1283](https://redirect.github.com/actions/setup-node/pull/1283) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.3.0> ### [`v6.2.0`](https://redirect.github.com/actions/setup-node/compare/v6.1.0...v6.2.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.1.0...v6.2.0) </details> <details> <summary>actions/setup-python (actions/setup-python)</summary> ### [`v6.2.0`](https://redirect.github.com/actions/setup-python/compare/v6.1.0...v6.2.0) [Compare Source](https://redirect.github.com/actions/setup-python/compare/v6.1.0...v6.2.0) </details> <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.1) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7...v7.0.1) ##### What's Changed - Update the readme with direct upload details by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#795](https://redirect.github.com/actions/upload-artifact/pull/795) - Readme: bump all the example versions to v7 by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#796](https://redirect.github.com/actions/upload-artifact/pull/796) - Include changes in typespec/ts-http-runtime 0.3.5 by [@yacaovsnc](https://redirect.github.com/yacaovsnc) in [#797](https://redirect.github.com/actions/upload-artifact/pull/797) **Full Changelog**: <https://github.com/actions/upload-artifact/compare/v7...v7.0.1> </details> <details> <summary>aminya/setup-cpp (aminya/setup-cpp)</summary> ### [`v1.8.0`](https://redirect.github.com/aminya/setup-cpp/releases/tag/v1.8.0) [Compare Source](https://redirect.github.com/aminya/setup-cpp/compare/v1.7.2...v1.8.0) #### What's Changed - feat: update default LLVM, Mingw, CMake, Ninja, Task, Meson by [@aminya](https://redirect.github.com/aminya) in [#455](https://redirect.github.com/aminya/setup-cpp/pull/455) - fix: default to LLVM 20.1.8 by [@aminya](https://redirect.github.com/aminya) in [#460](https://redirect.github.com/aminya/setup-cpp/pull/460) - feat: use bun as the package manager by [@aminya](https://redirect.github.com/aminya) in [#454](https://redirect.github.com/aminya/setup-cpp/pull/454) - chore(deps): update fedora docker tag to v44 in [#440](https://redirect.github.com/aminya/setup-cpp/pull/440) **Full Changelog**: <https://github.com/aminya/setup-cpp/compare/v1.7.2...v1.8.0> </details> <details> <summary>docker/login-action (docker/login-action)</summary> ### [`v4.1.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.1.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4...v4.1.0) - Fix scoped Docker Hub cleanup path when registry is omitted by [@crazy-max](https://redirect.github.com/crazy-max) in [#945](https://redirect.github.com/docker/login-action/pull/945) - Bump [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1020.0 in [#930](https://redirect.github.com/docker/login-action/pull/930) - Bump [@docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.77.0 to 0.86.0 in [#932](https://redirect.github.com/docker/login-action/pull/932) [#936](https://redirect.github.com/docker/login-action/pull/936) - Bump brace-expansion from 1.1.12 to 1.1.13 in [#952](https://redirect.github.com/docker/login-action/pull/952) - Bump fast-xml-parser from 5.3.4 to 5.3.6 in [#942](https://redirect.github.com/docker/login-action/pull/942) - Bump flatted from 3.3.3 to 3.4.2 in [#944](https://redirect.github.com/docker/login-action/pull/944) - Bump glob from 10.3.12 to 10.5.0 in [#940](https://redirect.github.com/docker/login-action/pull/940) - Bump handlebars from 4.7.8 to 4.7.9 in [#949](https://redirect.github.com/docker/login-action/pull/949) - Bump http-proxy-agent and https-proxy-agent to 8.0.0 in [#937](https://redirect.github.com/docker/login-action/pull/937) - Bump lodash from 4.17.23 to 4.18.1 in [#958](https://redirect.github.com/docker/login-action/pull/958) - Bump minimatch from 3.1.2 to 3.1.5 in [#941](https://redirect.github.com/docker/login-action/pull/941) - Bump picomatch from 4.0.3 to 4.0.4 in [#948](https://redirect.github.com/docker/login-action/pull/948) - Bump undici from 6.23.0 to 6.24.1 in [#938](https://redirect.github.com/docker/login-action/pull/938) **Full Changelog**: <https://github.com/docker/login-action/compare/v4.0.0...v4.1.0> </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v4.35.2`](https://redirect.github.com/github/codeql-action/releases/tag/v4.35.2) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.35.1...v4.35.2) - The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://redirect.github.com/github/codeql-action/pull/3795) - The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://redirect.github.com/github/codeql-action/pull/3789) - Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. [#3794](https://redirect.github.com/github/codeql-action/pull/3794) - Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://redirect.github.com/github/codeql-action/pull/3807) - Update default CodeQL bundle version to [2.25.2](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://redirect.github.com/github/codeql-action/pull/3823) ### [`v4.35.1`](https://redirect.github.com/github/codeql-action/releases/tag/v4.35.1) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.35.0...v4.35.1) - Fix incorrect minimum required Git version for [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://redirect.github.com/github/codeql-action/pull/3781) ### [`v4.35.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.35.0) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.34.1...v4.35.0) - Reduced the minimum Git version required for [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://redirect.github.com/github/codeql-action/pull/3767) - Update default CodeQL bundle version to [2.25.1](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://redirect.github.com/github/codeql-action/pull/3773) ### [`v4.34.1`](https://redirect.github.com/github/codeql-action/releases/tag/v4.34.1) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.34.0...v4.34.1) - Downgrade default CodeQL bundle version to [2.24.3](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://redirect.github.com/github/codeql-action/pull/3762) ### [`v4.34.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.34.0) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.33.0...v4.34.0) - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://redirect.github.com/github/codeql-action/pull/3569) - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://redirect.github.com/github/codeql-action/pull/3584) - Update default CodeQL bundle version to [2.25.0](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://redirect.github.com/github/codeql-action/pull/3585) ### [`v4.33.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.33.0) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.32.6...v4.33.0) - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://redirect.github.com/github/codeql-action/pull/3562) To opt out of this change: - **Repositories owned by an organization:** Create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). Alternatively, if you are using an advanced setup workflow, you can set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow. - **User-owned repositories using default setup:** Switch to an advanced setup workflow and set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow. - **User-owned repositories using advanced setup:** Set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow. - Fixed [a bug](https://redirect.github.com/github/codeql-action/issues/3555) which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. [#3557](https://redirect.github.com/github/codeql-action/pull/3557) - The CodeQL Action now loads [custom repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) on GitHub Enterprise Server, enabling the customization of features such as `github-codeql-disable-overlay` that was previously only available on GitHub.com. [#3559](https://redirect.github.com/github/codeql-action/pull/3559) - Once [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. [#3563](https://redirect.github.com/github/codeql-action/pull/3563) - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://redirect.github.com/github/codeql-action/pull/3564) - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://redirect.github.com/github/codeql-action/pull/3570) ### [`v4.32.6`](https://redirect.github.com/github/codeql-action/releases/tag/v4.32.6) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.32.5...v4.32.6) - Update default CodeQL bundle version to [2.24.3](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://redirect.github.com/github/codeql-action/pull/3548) ### [`v4.32.5`](https://redirect.github.com/github/codeql-action/releases/tag/v4.32.5) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.32.4...v4.32.5) - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://redirect.github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://redirect.github.com/github/codeql-action/pull/3507) - Added an experimental change so that when [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://redirect.github.com/github/codeql-action/pull/3487) - The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. [#3515](https://redirect.github.com/github/codeql-action/pull/3515) - Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. [#3516](https://redirect.github.com/github/codeql-action/pull/3516) - Added an experimental change which lowers the minimum disk space requirement for [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158), enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. [#3498](https://redirect.github.com/github/codeql-action/pull/3498) - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://redirect.github.com/github/codeql-action/pull/3512) - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://redirect.github.com/github/codeql-action/pull/3503), [#3504](https://redirect.github.com/github/codeql-action/pull/3504) ### [`v4.32.4`](https://redirect.github.com/github/codeql-action/releases/tag/v4.32.4) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.32.3...v4.32.4) - Update default CodeQL bundle version to [2.24.2](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://redirect.github.com/github/codeql-action/pull/3493) - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://redirect.github.com/github/codeql-action/pull/3473) - When the CodeQL Action is run [with debugging enabled in Default Setup](https://docs.github.com/en/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup) and [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries), the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. [#3486](https://redirect.github.com/github/codeql-action/pull/3486) - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://redirect.github.com/github/codeql-action/pull/3485) - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://redirect.github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://redirect.github.com/github/codeql-action/pull/3484) ### [`v4.32.3`](https://redirect.github.com/github/codeql-action/releases/tag/v4.32.3) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.32.2...v4.32.3) - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://redirect.github.com/github/codeql-action/pull/3466) ### [`v4.32.2`](https://redirect.github.com/github/codeql-action/compare/v4.32.1...v4.32.2) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.32.1...v4.32.2) ### [`v4.32.1`](https://redirect.github.com/github/codeql-action/releases/tag/v4.32.1) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.32.0...v4.32.1) - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://redirect.github.com/github/codeql-action/pull/3422) - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://redirect.github.com/github/codeql-action/pull/3421) ### [`v4.32.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.32.0) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.31.11...v4.32.0) - Update default CodeQL bundle version to [2.24.0](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://redirect.github.com/github/codeql-action/pull/3425) ### [`v4.31.11`](https://redirect.github.com/github/codeql-action/releases/tag/v4.31.11) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.31.10...v4.31.11) - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://redirect.github.com/github/codeql-action/pull/3409) - Improved error handling throughout the CodeQL Action. [#3415](https://redirect.github.com/github/codeql-action/pull/3415) - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://redirect.github.com/github/codeql-action/pull/3318) - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://redirect.github.com/github/codeql-action/pull/3403) ### [`v4.31.10`](https://redirect.github.com/github/codeql-action/releases/tag/v4.31.10) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.31.9...v4.31.10) ##### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. ##### 4.31.10 - 12 Jan 2026 - Update default CodeQL bundle version to 2.23.9. [#3393](https://redirect.github.com/github/codeql-action/pull/3393) See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v4.31.10/CHANGELOG.md) for more information. </details> <details> <summary>hendrikmuhs/ccache-action (hendrikmuhs/ccache-action)</summary> ### [`v1.2.22`](https://redirect.github.com/hendrikmuhs/ccache-action/releases/tag/v1.2.22) [Compare Source](https://redirect.github.com/hendrikmuhs/ccache-action/compare/v1.2.21...v1.2.22) #### What's Changed - Bump picomatch by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#435](https://redirect.github.com/hendrikmuhs/ccache-action/pull/435) - Bump fast-xml-parser from 5.4.1 to 5.5.7 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#434](https://redirect.github.com/hendrikmuhs/ccache-action/pull/434) **Full Changelog**: <https://github.com/hendrikmuhs/ccache-action/compare/v1.2.21...v1.2.22> ### [`v1.2.21`](https://redirect.github.com/hendrikmuhs/ccache-action/releases/tag/v1.2.21) [Compare Source](https://redirect.github.com/hendrikmuhs/ccache-action/compare/v1.2.20...v1.2.21) ##### What's Changed - Bump actions/checkout from 5 to 6 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#396](https://redirect.github.com/hendrikmuhs/ccache-action/pull/396) - Bump [@types/node](https://redirect.github.com/types/node) from 24.10.0 to 25.2.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#417](https://redirect.github.com/hendrikmuhs/ccache-action/pull/417) - Bump [@actions/cache](https://redirect.github.com/actions/cache) from 4.1.0 to 6.0.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#412](https://redirect.github.com/hendrikmuhs/ccache-action/pull/412) - Bump [@actions/core](https://redirect.github.com/actions/core) from 1.11.1 to 3.0.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#413](https://redirect.github.com/hendrikmuhs/ccache-action/pull/413) - Bump [@actions/exec](https://redirect.github.com/actions/exec) from 1.1.1 to 3.0.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#414](https://redirect.github.com/hendrikmuhs/ccache-action/pull/414) - Bump [@actions/io](https://redirect.github.com/actions/io) from 2.0.0 to 3.0.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#416](https://redirect.github.com/hendrikmuhs/ccache-action/pull/416) - refactor: add Windows ARM and macOS binaries, use a single Package class, deduplicate some common install code by [@crueter](https://redirect.github.com/crueter) in [#403](https://redirect.github.com/hendrikmuhs/ccache-action/pull/403) - Bump [@types/node](https://redirect.github.com/types/node) from 25.2.2 to 25.3.3 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#421](https://redirect.github.com/hendrikmuhs/ccache-action/pull/421) - Bump jest from 30.2.0 to 30.3.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#431](https://redirect.github.com/hendrikmuhs/ccache-action/pull/431) - Upgrade Node.js version from 20 to 24 by [@janisozaur](https://redirect.github.com/janisozaur) in [#427](https://redirect.github.com/hendrikmuhs/ccache-action/pull/427) - Bump [@types/node](https://redirect.github.com/types/node) from 25.3.3 to 25.5.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#430](https://redirect.github.com/hendrikmuhs/ccache-action/pull/430) - refactor: generate metadata json file by [@crueter](https://redirect.github.com/crueter) in [#422](https://redirect.github.com/hendrikmuhs/ccache-action/pull/422) - tests: add install matrix by [@crueter](https://redirect.github.com/crueter) in [#423](https://redirect.github.com/hendrikmuhs/ccache-action/pull/423) - Bump undici from 6.23.0 to 6.24.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#429](https://redirect.github.com/hendrikmuhs/ccache-action/pull/429) ##### New Contributors - [@crueter](https://redirect.github.com/crueter) made their first contribution in [#403](https://redirect.github.com/hendrikmuhs/ccache-action/pull/403) **Full Changelog**: <https://github.com/hendrikmuhs/ccache-action/compare/v1.2...v1.2.21> </details> <details> <summary>maxim-lobanov/setup-xcode (maxim-lobanov/setup-xcode)</summary> ### [`v1.7.0`](https://redirect.github.com/maxim-lobanov/setup-xcode/releases/tag/v1.7.0): Update Node.js to 24 [Compare Source](https://redirect.github.com/maxim-lobanov/setup-xcode/compare/v1.6.0...v1.7.0) #### What's Changed - Bump self used GHA by [@Goooler](https://redirect.github.com/Goooler) in [#82](https://redirect.github.com/maxim-lobanov/setup-xcode/pull/82) - Update validation matrix on CI by [@Goooler](https://redirect.github.com/Goooler) in [#83](https://redirect.github.com/maxim-lobanov/setup-xcode/pull/83) - Update action runtime to node24 and polish e2e test matrix by [@Goooler](https://redirect.github.com/Goooler) in [#98](https://redirect.github.com/maxim-lobanov/setup-xcode/pull/98) #### New Contributors - [@Goooler](https://redirect.github.com/Goooler) made their first contribution in [#82](https://redirect.github.com/maxim-lobanov/setup-xcode/pull/82) **Full Changelog**: <https://github.com/maxim-lobanov/setup-xcode/compare/v1.6.0...v1.7.0> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.0`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.0) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.13.0...v1.14.0) <p align="right"><i>Audit your supply chain regularly!</i></p> #### ✨ What's Changed The main change in this release is that `verbose` and `print-hash` inputs are now on by default. This was contributed by [@whitequark](https://redirect.github.com/whitequark)[💰](https://redirect.github.com/sponsors/whitequark) in [#397](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/397). #### 📝 Docs [@woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) updated the mentions of PEP 740 to stop implying that it might be experimental (it hasn't been for quite a while!) in [#388](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/388) and [@him2him2](https://redirect.github.com/him2him2)[💰](https://redirect.github.com/sponsors/him2him2) brushed up some grammar in the README and SECURITY docs via [#395](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/395). #### 🛠️ Internal Updates [@woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) bumped `sigstore` and `pypi-attestations` in the lock file ([#391](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/391)) and [@webknjaz](https://redirect.github.com/webknjaz)[💰][GH Sponsors URL] added infra for using type annotations in the project ([#381](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/381)). #### 💪 New Contributors - [@him2him2](https://redirect.github.com/him2him2) made their first contribution in [#395](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/395) - [@whitequark](https://redirect.github.com/whitequark) made their first contribution in [#397](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/397) **🪞 Full Diff**: <https://github.com/pypa/gh-action-pypi-publish/compare/v1.13.0...v1.14.0> **🧔‍♂️ Release Manager:** [@webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) and [@woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) for helping maintain this project when [I][GH Sponsors URL] can't! **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/webknjaz.me/post/3mivwsz3qzk2e), [on Mastodon 🐘](https://mastodon.social/@webknjaz/116363779997051422) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/404 </details> <details> <summary>actions/python-versions (python)</summary> ### [`v3.14.4`](https://redirect.github.com/actions/python-versions/releases/tag/3.14.4-24114161919): 3.14.4 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.14.3-21673711214...3.14.4-24114161919) Python 3.14.4 ### [`v3.14.3`](https://redirect.github.com/actions/python-versions/releases/tag/3.14.3-21673711214): 3.14.3 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.14.2-20014991423...3.14.3-21673711214) Python 3.14.3 ### [`v3.14.2`](https://redirect.github.com/actions/python-versions/releases/tag/3.14.2-20014991423): 3.14.2 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.14.1-19879739908...3.14.2-20014991423) Python 3.14.2 ### [`v3.14.1`](https://redirect.github.com/actions/python-versions/releases/tag/3.14.1-19879739908): 3.14.1 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.14.0-18313368925...3.14.1-19879739908) Python 3.14.1 ### [`v3.14.0`](https://redirect.github.com/actions/python-versions/releases/tag/3.14.0-18313368925): 3.14.0 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.13-24114113768...3.14.0-18313368925) Python 3.14.0 ### [`v3.13.13`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.13-24114113768): 3.13.13 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.12-21673645133...3.13.13-24114113768) Python 3.13.13 ### [`v3.13.12`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.12-21673645133): 3.13.12 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.11-20014977833...3.13.12-21673645133) Python 3.13.12 ### [`v3.13.11`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.11-20014977833): 3.13.11 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.10-19879712315...3.13.11-20014977833) Python 3.13.11 ### [`v3.13.10`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.10-19879712315): 3.13.10 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.9-18515951191...3.13.10-19879712315) Python 3.13.10 ### [`v3.13.9`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.9-18515951191): 3.13.9 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.8-18331000654...3.13.9-18515951191) Python 3.13.9 ### [`v3.13.8`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.8-18331000654): 3.13.8 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.7-16980743123...3.13.8-18331000654) Python 3.13.8 ### [`v3.13.7`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.7-16980743123): 3.13.7 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.6-16792117939...3.13.7-16980743123) Python 3.13.7 ### [`v3.13.6`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.6-16792117939): 3.13.6 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.5-15601068749...3.13.6-16792117939) Python 3.13.6 ### [`v3.13.5`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.5-15601068749): 3.13.5 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.4-15433317575...3.13.5-15601068749) Python 3.13.5 ### [`v3.13.4`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.4-15433317575): 3.13.4 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.3-14344076652...3.13.4-15433317575) Python 3.13.4 ### [`v3.13.3`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.3-14344076652): 3.13.3 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.2-13708744326...3.13.3-14344076652) Python 3.13.3 ### [`v3.13.2`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.2-13708744326): 3.13.2 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.1-13437882550...3.13.2-13708744326) Python 3.13.2 ### [`v3.13.1`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.1-13437882550): 3.13.1 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.13.0-13707372259...3.13.1-13437882550) Python 3.13.1 ### [`v3.13.0`](https://redirect.github.com/actions/python-versions/releases/tag/3.13.0-13707372259): 3.13.0 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.13-22652080177...3.13.0-13707372259) Python 3.13.0 ### [`v3.12.13`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.13-22652080177): 3.12.13 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.12-18393146713...3.12.13-22652080177) Python 3.12.13 ### [`v3.12.12`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.12-18393146713): 3.12.12 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.11-15433310049...3.12.12-18393146713) Python 3.12.12 ### [`v3.12.11`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.11-15433310049): 3.12.11 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.10-14343898437...3.12.11-15433310049) Python 3.12.11 ### [`v3.12.10`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.10-14343898437): 3.12.10 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.9-13149478207...3.12.10-14343898437) Python 3.12.10 ### [`v3.12.9`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.9-13149478207): 3.12.9 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.8-12154062663...3.12.9-13149478207) Python 3.12.9 ### [`v3.12.8`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.8-12154062663): 3.12.8 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.7-11128208086...3.12.8-12154062663) Python 3.12.8 ### [`v3.12.7`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.7-11128208086): 3.12.7 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.6-10765725458...3.12.7-11128208086) Python 3.12.7 ### [`v3.12.6`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.6-10765725458): 3.12.6 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.5-10375840348...3.12.6-10765725458) Python 3.12.6 ### [`v3.12.5`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.5-10375840348): 3.12.5 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.4-9947065640...3.12.5-10375840348) Python 3.12.5 ### [`v3.12.4`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.4-9947065640): 3.12.4 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.3-11057844995...3.12.4-9947065640) Python 3.12.4 ### [`v3.12.3`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.3-11057844995): 3.12.3 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.2-11057786931...3.12.3-11057844995) Python 3.12.3 ### [`v3.12.2`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.2-11057786931): 3.12.2 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.1-11057762749...3.12.2-11057786931) Python 3.12.2 ### [`v3.12.1`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.1-11057762749): 3.12.1 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.12.0-11057302691...3.12.1-11057762749) Python 3.12.1 ### [`v3.12.0`](https://redirect.github.com/actions/python-versions/releases/tag/3.12.0-11057302691): 3.12.0 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.11.15-22631496413...3.12.0-11057302691) Python 3.12.0 ### [`v3.11.15`](https://redirect.github.com/actions/python-versions/releases/tag/3.11.15-22631496413): 3.11.15 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.11.14-18393181605...3.11.15-22631496413) Python 3.11.15 ### [`v3.11.14`](https://redirect.github.com/actions/python-versions/releases/tag/3.11.14-18393181605): 3.11.14 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.11.13-15433298024...3.11.14-18393181605) Python 3.11.14 ### [`v3.11.13`](https://redirect.github.com/actions/python-versions/releases/tag/3.11.13-15433298024): 3.11.13 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.11.12-14343939122...3.11.13-15433298024) Python 3.11.13 ### [`v3.11.12`](https://redirect.github.com/actions/python-versions/releases/tag/3.11.12-14343939122): 3.11.12 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.11.11-12160100664...3.11.12-14343939122) Python 3.11.12 ### [`v3.11.11`](https://redirect.github.com/actions/python-versions/releases/tag/3.11.11-12160100664): 3.11.11 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.11.10-10765870205...3.11.11-12160100664) Python 3.11.11 ### [`v3.11.10`](https://redirect.github.com/actions/python-versions/releases/tag/3.11.10-10765870205): 3.11.10 [Compare Source](https://redirect.github.com/actions/python-versions/compare/3.11.9-9947079978...3.11.10-10765870205) Python 3.11.10 </details> <details> <summary>tj-actions/changed-files (tj-actions/changed-files)</summary> ### [`v47.0.6`](https://redirect.github.com/tj-actions/changed-files/releases/tag/v47.0.6) [Compare Source](https://redirect.github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6) #### What's Changed - Upgraded to v47.0.5 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#2816](https://redirect.github.com/tj-actions/changed-files/pull/2816) - Updated README.md by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#2817](https://redirect.github.com/tj-actions/changed-files/pull/2817) - chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2818](https://redirect.github.com/tj-actions/changed-files/pull/2818) - chore(deps-dev): bump [@types/node](https://redirect.github.com/types/node) from 25.3.3 to 25.3.5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2820](https://redirect.github.com/tj-actions/changed-files/pull/2820) - chore(deps): bump github/codeql-action from 4.32.5 to 4.32.6 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2819](https://redirect.github.com/tj-actions/changed-files/pull/2819) - chore(deps-dev): bump [@types/node](https://redirect.github.com/types/node) from 25.3.5 to 25.5.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2825](https://redirect.github.com/tj-actions/changed-files/pull/2825) - chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2824](https://redirect.github.com/tj-actions/changed-files/pull/2824) - chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2834](https://redirect.github.com/tj-actions/changed-files/pull/2834) - chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2831](https://redirect.github.com/tj-actions/changed-files/pull/2831) - chore(deps): bump yaml from 2.8.2 to 2.8.3 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2830](https://redirect.github.com/tj-actions/changed-files/pull/2830) - chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2829](https://redirect.github.com/tj-actions/changed-files/pull/2829) - chore(deps-dev): bump jest from 30.2.0 to 30.3.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2822](https://redirect.github.com/tj-actions/changed-files/pull/2822) - chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2849](https://redirect.github.com/tj-actions/changed-files/pull/2849) - chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2848](https://redirect.github.com/tj-actions/changed-files/pull/2848) - chore(deps-dev): bump [@types/node](https://redirect.github.com/types/node) from 25.5.0 to 25.6.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2846](https://redirect.github.com/tj-actions/changed-files/pull/2846) - chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2844](https://redirect.github.com/tj-actions/changed-files/pull/2844) - chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2843](https://redirect.github.com/tj-actions/changed-files/pull/2843) - chore(deps): bump lodash from 4.17.23 to 4.18.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2837](https://redirect.github.com/tj-actions/changed-files/pull/2837) **Full Changelog**: <https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6> ### [`v47.0.5`](https://redirect.github.com/tj-actions/changed-files/releases/tag/v47.0.5) [Compare Source](https://redirect.github.com/tj-actions/changed-files/compare/v47.0.4...v47.0.5) #### What's Changed - Upgraded to v47.0.4 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#2802](https://redirect.github.com/tj-actions/changed-files/pull/2802) - Updated README.md by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#2803](https://redirect.github.com/tj-actions/changed-files/pull/2803) - Updated README.md by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#2805](https://redirect.github.com/tj-actions/changed-files/pull/2805) - chore(deps-dev): bump [@types/node](https://redirect.github.com/types/node) from 25.2.2 to 25.3.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2811](https://redirect.github.com/tj-actions/changed-files/pull/2811) - chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2810](https://redirect.github.com/tj-actions/changed-files/pull/2810) - chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2809](https://redirect.github.com/tj-actions/changed-files/pull/2809) - chore(deps-dev): bump eslint-plugin-jest from 29.12.1 to 29.15.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2799](https://redirect.github.com/tj-actions/changed-files/pull/2799) - chore(deps): bump github/codeql-action from 4.32.2 to 4.32.4 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2806](https://redirect.github.com/tj-actions/changed-files/pull/2806) - chore(deps-dev): bump prettier from 3.7.4 to 3.8.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2775](https://redirect.github.com/tj-actions/changed-files/pull/2775) - chore(deps): bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2774](https://redirect.github.com/tj-actions/changed-files/pull/2774) - chore(deps): bump lodash and [@types/lodash](https://redirect.github.com/types/lodash) by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2807](https://redirect.github.com/tj-actions/changed-files/pull/2807) - chore(deps-dev): bump eslint-plugin-prettier from 5.5.4 to 5.5.5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2764](https://redirect.github.com/tj-actions/changed-files/pull/2764) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.5 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2815](https://redirect.github.com/tj-actions/changed-files/pull/2815) - chore(deps-dev): bump [@types/node](https://redirect.github.com/types/node) from 25.3.2 to 25.3.3 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2814](https://redirect.github.com/tj-actions/changed-files/pull/2814) **Full Changelog**: <https://github.com/tj-actions/changed-files/compare/v47.0.4...v47.0.5> ### [`v47.0.4`](https://redirect.github.com/tj-actions/changed-files/releases/tag/v47.0.4) [Compare Source](https://redirect.github.com/tj-actions/changed-files/compare/v47.0.3...v47.0.4) #### What's Changed - update: release-tagger action to version 6.0.6 by [@jackton1](https://redirect.github.com/jackton1) in [#2801](https://redirect.github.com/tj-actions/changed-files/pull/2801) **Full Changelog**: <https://github.com/tj-actions/changed-files/compare/v47.0.3...v47.0.4> ### [`v47.0.3`](https://redirect.github.com/tj-actions/changed-files/releases/tag/v47.0.3) [Compare Source](https://redirect.github.com/tj-actions/changed-files/compare/v47.0.2...v47.0.3) #### What's Changed - chore(deps): bump github/codeql-action from 4.31.10 to 4.32.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2790](https://redirect.github.com/tj-actions/changed-files/pull/2790) - update: release-tagger action to version 6.0.0 by [@jackton1](https://redirect.github.com/jackton1) in [#2800](https://redirect.github.com/tj-actions/changed-files/pull/2800) **Full Changelog**: <https://github.com/tj-actions/changed-files/compare/v47.0.2...v47.0.3> ### [`v47.0.2`](https://redirect.github.com/tj-actions/changed-files/releases/tag/v47.0.2) [Compare Source](https://redirect.github.com/tj-actions/changed-files/compare/v47.0.1...v47.0.2) #### What's Changed - chore(deps-dev): bump eslint-plugin-jest from 29.2.1 to 29.11.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2751](https://redirect.github.com/tj-actions/changed-files/pull/2751) - chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2741](https://redirect.github.com/tj-actions/changed-files/pull/2741) - chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2743](https://redirect.github.com/tj-actions/changed-files/pull/2743) - chore(deps): bump [@actions/core](https://redirect.github.com/actions/core) from 2.0.0 to 2.0.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2757](https://redirect.github.com/tj-actions/changed-files/pull/2757) - Updated README.md by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#2768](https://redirect.github.com/tj-actions/changed-files/pull/2768) - chore: update dist by [@jackton1](https://redirect.github.com/jackton1) in [#2769](https://redirect.github.com/tj-actions/changed-files/pull/2769) - chore: update matrix-example.yml by [@jackton1](https://redirect.github.com/jackton1) in [#2752](https://redirect.github.com/tj-actions/changed-files/pull/2752) - feat: add support for excluding symlinks and fix bug with commit not found by [@jackton1](https://redirect.github.com/jackton1) in [#2770](https://redirect.github.com/tj-actions/changed-files/pull/2770) - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.10 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2761](https://redirect.github.com/tj-actions/changed-files/pull/2761) - Updated README.md by [@github-actions]( </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 12:59 AM, only on Monday (`* 0 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/llvm/llvm-project).  --------- Co-authored-by: Aiden Grossman <agrossman154@yahoo.com>
2026-04-21 19:52:58 +01:00
parent 99457c3685
commit d4e2850a84
53 changed files with 144 additions and 144 deletions
--- a/.github/actions/build-container/action.yml
+++ b/.github/actions/build-container/action.yml
@@ -78,7 +78,7 @@ runs:
        echo "container-full-name=$container_name" >> $GITHUB_OUTPUT

    - name: Create container artifact
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: ${{ inputs.container-name }}-${{ runner.arch }}
        path: "*.tar"
--- a/.github/workflows/bazel-checks.yml
+++ b/.github/workflows/bazel-checks.yml
@@ -22,7 +22,7 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Buildifier
@@ -52,7 +52,7 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
        # TODO(boomanaiden154): We should use a purpose built container for this. Move
--- a/.github/workflows/build-ci-container-tooling.yml
+++ b/.github/workflows/build-ci-container-tooling.yml
@@ -41,7 +41,7 @@ jobs:
            target: abi-tests
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -68,7 +68,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/build-ci-container-windows.yml
+++ b/.github/workflows/build-ci-container-windows.yml
@@ -25,7 +25,7 @@ jobs:
      container-filename: ${{ steps.vars.outputs.container-filename }}
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: .github/workflows/containers/github-action-ci-windows
@@ -45,7 +45,7 @@ jobs:
        run: |
          docker save  ${{ steps.vars.outputs.container-name-tag }} >  ${{ steps.vars.outputs.container-filename }}
      - name: Upload container image
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: container
          path: ${{ steps.vars.outputs.container-filename }}
--- a/.github/workflows/build-ci-container.yml
+++ b/.github/workflows/build-ci-container.yml
@@ -36,7 +36,7 @@ jobs:
          - cd $HOME && printf '#include <iostream>\nint main(int argc, char **argv) { std::cout << "Hello\\n"; }' | clang++ -x c++ - && ./a.out | grep Hello
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -63,7 +63,7 @@ jobs:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/build-libc-container.yml
+++ b/.github/workflows/build-libc-container.yml
@@ -27,7 +27,7 @@ jobs:
          - ubuntu-24.04-arm
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -49,7 +49,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/build-metrics-container.yml
+++ b/.github/workflows/build-metrics-container.yml
@@ -23,7 +23,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -47,7 +47,7 @@ jobs:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/check-ci.yml
+++ b/.github/workflows/check-ci.yml
@@ -22,12 +22,12 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: .ci
      - name: Setup Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.14
          cache: 'pip'
--- a/.github/workflows/ci-post-commit-analyzer.yml
+++ b/.github/workflows/ci-post-commit-analyzer.yml
@@ -41,12 +41,12 @@ jobs:
      LLVM_VERSION: 18
    steps:
      - name: Checkout Source
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup ccache
-        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+        uses: hendrikmuhs/ccache-action@33522472633dbd32578e909b315f5ee43ba878ce # v1.2.22
        with:
          # A full build of llvm, clang, lld, and lldb takes about 250MB
          # of ccache space. There's not much reason to have more than this,
@@ -89,7 +89,7 @@ jobs:
          scan-build --generate-index-only build/analyzer-results

      - name: Upload Results
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: analyzer-results
--- a/.github/workflows/commit-access-greeter.yml
+++ b/.github/workflows/commit-access-greeter.yml
@@ -18,7 +18,7 @@ jobs:
      github.event.label.name == 'infra:commit-access-request'
    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: llvm/utils/git/
--- a/.github/workflows/commit-access-review.yml
+++ b/.github/workflows/commit-access-review.yml
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      
@@ -41,7 +41,7 @@ jobs:
          python3 .github/workflows/commit-access-review.py $GITHUB_TOKEN

      - name: Upload Triage List
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: triagers
          path: triagers.log
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -55,13 +55,13 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 2
      - name: Get subprojects that have doc changes
        id: docs-changed-subprojects
-        uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          skip_initial_fetch: true
          base_sha: 'HEAD~1'
@@ -96,7 +96,7 @@ jobs:
            workflow:
              - '.github/workflows/docs.yml'
      - name: Setup Python env
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.14'
          cache: 'pip'
@@ -210,7 +210,7 @@ jobs:
          mkdir built-docs/flang
          cp -r flang-build/docs/* built-docs/flang/
      - name: Upload docs
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: docs-output
          path: built-docs/
--- a/.github/workflows/email-check.yaml
+++ b/.github/workflows/email-check.yaml
@@ -14,7 +14,7 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha }}
@@ -40,7 +40,7 @@ jobs:
          [{"body" : "$COMMENT"}]
          EOF

-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: workflow-args
--- a/.github/workflows/gha-codeql.yml
+++ b/.github/workflows/gha-codeql.yml
@@ -24,15 +24,15 @@ jobs:
      security-events: write
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
            .github/
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
        with:
          languages: actions
          queries: security-extended
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
--- a/.github/workflows/hlsl-test-all.yaml
+++ b/.github/workflows/hlsl-test-all.yaml
@@ -29,7 +29,7 @@ jobs:
    runs-on: ${{ inputs.SKU }}
    steps:
      - name: Checkout DXC
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          repository: Microsoft/DirectXShaderCompiler
@@ -37,20 +37,20 @@ jobs:
          path: DXC
          submodules: true
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ inputs.LLVM-branch }}
          path: llvm-project
      - name: Checkout OffloadTest
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          repository: llvm/offload-test-suite
          ref: main
          path: OffloadTest
      - name: Checkout Golden Images
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          repository: llvm/offload-golden-images
@@ -79,7 +79,7 @@ jobs:
            ninja check-hlsl-unit
            ninja ${{ inputs.TestTarget }}
      - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action/macos@27d65e188ec43221b20d26de30f4892fad91df2f # v2.22.0
+        uses: EnricoMi/publish-unit-test-result-action/macos@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0
        if: always() && runner.os == 'macOS'
        with:
          comment_mode: off
--- a/.github/workflows/ids-check.yml
+++ b/.github/workflows/ids-check.yml
@@ -21,14 +21,14 @@ jobs:
    timeout-minutes: 10

    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          repository: compnerd/ids
          path: ${{ github.workspace }}/ids
          ref: b3bf35dd13d7ff244a6a6d106fe58d0eedb5743e # main

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: ${{ github.workspace }}/llvm-project
@@ -36,7 +36,7 @@ jobs:

      - name: Get changed files
        id: changed-files
-        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          path: "./llvm-project"
          separator: ","
@@ -99,7 +99,7 @@ jobs:
            --changed-files "$CHANGED_FILES"

      - name: Upload results
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: workflow-args
--- a/.github/workflows/issue-release-workflow.yml
+++ b/.github/workflows/issue-release-workflow.yml
@@ -43,7 +43,7 @@ jobs:
      contains(github.event.action == 'opened' && github.event.issue.body || github.event.comment.body, '/cherry-pick')
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: llvm/llvm-project
          # GitHub stores the token used for checkout and uses it for pushes
--- a/.github/workflows/issue-subscriber.yml
+++ b/.github/workflows/issue-subscriber.yml
@@ -14,7 +14,7 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Checkout Automation Script
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: llvm/utils/git/
--- a/.github/workflows/issue-write.yml
+++ b/.github/workflows/issue-write.yml
@@ -29,7 +29,7 @@ jobs:
      )
    steps:
      - name: Fetch Sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/libc-fullbuild-tests.yml
+++ b/.github/workflows/libc-fullbuild-tests.yml
@@ -106,7 +106,7 @@ jobs:
          # - c_compiler: gcc
          #   cpp_compiler: g++
    steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false

@@ -117,7 +117,7 @@ jobs:
    # Do not use direct GHAC access even though it is supported by sccache. GHAC rejects
    # frequent small object writes.
    - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+      uses: hendrikmuhs/ccache-action@33522472633dbd32578e909b315f5ee43ba878ce # v1.2.22
      with:
        max-size: 1G
        key: libc_fullbuild_${{ matrix.c_compiler }}
--- a/.github/workflows/libc-overlay-tests.yml
+++ b/.github/workflows/libc-overlay-tests.yml
@@ -41,7 +41,7 @@ jobs:
              cpp_compiler: clang++
    
    steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    
@@ -53,7 +53,7 @@ jobs:
    # Do not use direct GHAC access even though it is supported by sccache. GHAC rejects
    # frequent small object writes.
    - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+      uses: hendrikmuhs/ccache-action@33522472633dbd32578e909b315f5ee43ba878ce # v1.2.22
      with:
        max-size: 1G
        key: libc_overlay_build_${{ matrix.os }}_${{ matrix.compiler.c_compiler }}
--- a/.github/workflows/libc-shared-tests.yml
+++ b/.github/workflows/libc-shared-tests.yml
@@ -25,7 +25,7 @@ jobs:

    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

@@ -70,7 +70,7 @@ jobs:

    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

--- a/.github/workflows/libclang-abi-tests.yml
+++ b/.github/workflows/libclang-abi-tests.yml
@@ -38,7 +38,7 @@ jobs:
      LLVM_VERSION_PATCH: ${{ steps.version.outputs.patch }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 250
@@ -86,7 +86,7 @@ jobs:
    needs: abi-dump-setup
    runs-on: ubuntu-24.04
    container:
-      image: "ghcr.io/llvm/ci-ubuntu-24.04-abi-tests@sha256:ef869c1d087258db22c2b19b93f585d53c0d0e70952aaf02d45866ad26a200a0" #ghcr.io/llvm/ci-ubuntu-24.04-abi-tests:9524b37c503f
+      image: "ghcr.io/llvm/ci-ubuntu-24.04-abi-tests@sha256:cb3aea3ecdd521194ca12cfa239ab5a53f9e160a13a55ae3abdc1dfbf134476e" #ghcr.io/llvm/ci-ubuntu-24.04-abi-tests:9524b37c503f
    strategy:
      matrix:
        name:
@@ -103,7 +103,7 @@ jobs:
            repo: ${{ github.repository }}
    steps:
      - name: Download source code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ matrix.ref }}
@@ -122,7 +122,7 @@ jobs:
            sed -i 's/LLVM_[0-9]\+/LLVM_NOVERSION/' $lib-${{ matrix.ref }}.abi
          done
      - name: Upload ABI file
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.name }}
          path: '*${{ matrix.ref }}.abi'
@@ -131,7 +131,7 @@ jobs:
    if: github.repository_owner == 'llvm'
    runs-on: ubuntu-24.04
    container:
-      image: "ghcr.io/llvm/ci-ubuntu-24.04-abi-tests@sha256:ef869c1d087258db22c2b19b93f585d53c0d0e70952aaf02d45866ad26a200a0" #ghcr.io/llvm/ci-ubuntu-24.04-abi-tests:9524b37c503f
+      image: "ghcr.io/llvm/ci-ubuntu-24.04-abi-tests@sha256:cb3aea3ecdd521194ca12cfa239ab5a53f9e160a13a55ae3abdc1dfbf134476e" #ghcr.io/llvm/ci-ubuntu-24.04-abi-tests:9524b37c503f
    needs:
      - abi-dump-setup
      - abi-dump
@@ -154,7 +154,7 @@ jobs:
          done
      - name: Upload ABI Comparison
        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: compat-report-${{ github.sha }}
          path: compat_reports/
--- a/.github/workflows/libclang-python-tests.yml
+++ b/.github/workflows/libclang-python-tests.yml
@@ -32,16 +32,16 @@ jobs:
      matrix:
        python-version: ["3.8", "3.13"]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          persist-credentials: false
          python-version: ${{ matrix.python-version }}
      - name: Setup ccache
-        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+        uses: hendrikmuhs/ccache-action@33522472633dbd32578e909b315f5ee43ba878ce # v1.2.22
        with:
          max-size: 2G
          key: spirv-ubuntu-24.04
--- a/.github/workflows/libcxx-build-and-test.yaml
+++ b/.github/workflows/libcxx-build-and-test.yaml
@@ -54,7 +54,7 @@ jobs:
            cc: 'gcc-15'
            cxx: 'g++-15'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: ${{ matrix.config }}.${{ matrix.cxx }}
@@ -66,7 +66,7 @@ jobs:
        env:
          CC: ${{ matrix.cc }}
          CXX: ${{ matrix.cxx }}
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: ${{ matrix.config }}-${{ matrix.cxx }}-results
@@ -105,7 +105,7 @@ jobs:
            cc: 'clang-21'
            cxx: 'clang++-21'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: ${{ matrix.config }}
@@ -117,7 +117,7 @@ jobs:
        env:
          CC: ${{ matrix.cc }}
          CXX: ${{ matrix.cxx }}
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()  # Upload artifacts even if the build or test suite fails
        with:
          name: ${{ matrix.config }}-${{ matrix.cxx }}-results
@@ -166,7 +166,7 @@ jobs:
          'bootstrapping-build'
        ]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: ${{ matrix.config }}
@@ -178,7 +178,7 @@ jobs:
        env:
          CC: clang-23
          CXX: clang++-23
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: ${{ matrix.config }}-results
@@ -220,10 +220,10 @@ jobs:
          os: macos-15
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
-      - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
        with:
          # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md
          xcode-version: '26.0'
@@ -237,7 +237,7 @@ jobs:
        env:
          CC: clang
          CXX: clang++
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()  # Upload artifacts even if the build or test suite fails
        with:
          name: macos-${{ matrix.config }}-results
@@ -267,7 +267,7 @@ jobs:
        - { config: mingw-static,             mingw: true,  cc: cc,       cxx: c++, runner: windows-11-arm }
    runs-on: ${{ matrix.runner != '' && matrix.runner || 'windows-2022' }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install dependencies
--- a/.github/workflows/libcxx-build-containers.yml
+++ b/.github/workflows/libcxx-build-containers.yml
@@ -30,7 +30,7 @@ jobs:
      packages: write

    steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false

@@ -58,7 +58,7 @@ jobs:
        TAG: ${{ github.sha }}

    - name: Log in to GitHub Container Registry
-      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
--- a/.github/workflows/libcxx-check-generated-files.yml
+++ b/.github/workflows/libcxx-check-generated-files.yml
@@ -13,12 +13,12 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install dependencies
-        uses: aminya/setup-cpp@9bc9b8cd8a8d678f920e4e1e73f29da8010ced51 # v1.7.2
+        uses: aminya/setup-cpp@1f17f92d6a52bfcb1a25348e2c526c2e5cbb1134 # v1.8.0
        with:
          clangformat: 17.0.1
          ninja: true
--- a/.github/workflows/libcxx-run-benchmarks.yml
+++ b/.github/workflows/libcxx-run-benchmarks.yml
@@ -33,7 +33,7 @@ jobs:

    runs-on: llvm-premerge-libcxx-next-runners # TODO: This should run on a dedicated set of machines
    steps:
-      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.14'

@@ -71,7 +71,7 @@ jobs:
          comment.edit('\n\n'.join([comment.body, add_text]))
          EOF

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ steps.vars.outputs.pr_head }}
--- a/.github/workflows/lldb-pylint-action.yml
+++ b/.github/workflows/lldb-pylint-action.yml
@@ -19,13 +19,13 @@ jobs:
      cancel-in-progress: true
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 2

      - name: Setup python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.14'

@@ -35,7 +35,7 @@ jobs:

      - name: Get changed files
        id: changed-files
-        uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          separator: " "
          skip_initial_fetch: true
--- a/.github/workflows/llvm-abi-tests.yml
+++ b/.github/workflows/llvm-abi-tests.yml
@@ -38,7 +38,7 @@ jobs:
      LLVM_VERSION_PATCH: ${{ steps.version.outputs.patch }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 250
@@ -74,7 +74,7 @@ jobs:
    needs: abi-dump-setup
    runs-on: ubuntu-24.04
    container:
-      image: "ghcr.io/llvm/ci-ubuntu-24.04-abi-tests@sha256:ef869c1d087258db22c2b19b93f585d53c0d0e70952aaf02d45866ad26a200a0" #ghcr.io/llvm/ci-ubuntu-24.04-abi-tests:bb0bd382ab2b"
+      image: "ghcr.io/llvm/ci-ubuntu-24.04-abi-tests@sha256:cb3aea3ecdd521194ca12cfa239ab5a53f9e160a13a55ae3abdc1dfbf134476e" #ghcr.io/llvm/ci-ubuntu-24.04-abi-tests:bb0bd382ab2b"
    strategy:
      matrix:
        name:
@@ -91,7 +91,7 @@ jobs:
            repo: ${{ github.repository }}
    steps:
      - name: Download source code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ matrix.ref }}
@@ -119,14 +119,14 @@ jobs:
          # Remove symbol versioning from dumps, so we can compare across major versions.
          sed -i 's/LLVM_${{ matrix.llvm_version_major }}/LLVM_NOVERSION/' ${{ matrix.ref }}.abi
      - name: Upload ABI file
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.name }}
          path: ${{ matrix.ref }}.abi

      - name: Upload symbol list file
        if: matrix.name == 'build-baseline'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: symbol-list
          path: llvm.symbols
@@ -135,7 +135,7 @@ jobs:
    if: github.repository_owner == 'llvm'
    runs-on: ubuntu-24.04
    container:
-      image: "ghcr.io/llvm/ci-ubuntu-24.04-abi-tests@sha256:ef869c1d087258db22c2b19b93f585d53c0d0e70952aaf02d45866ad26a200a0" #ghcr.io/llvm/ci-ubuntu-24.04-abi-tests:bb0bd382ab2b
+      image: "ghcr.io/llvm/ci-ubuntu-24.04-abi-tests@sha256:cb3aea3ecdd521194ca12cfa239ab5a53f9e160a13a55ae3abdc1dfbf134476e" #ghcr.io/llvm/ci-ubuntu-24.04-abi-tests:bb0bd382ab2b
    needs:
      - abi-dump-setup
      - abi-dump
@@ -168,7 +168,7 @@ jobs:
          abi-compliance-checker $EXTRA_ARGS -l libLLVM.so -old build-baseline/*.abi -new build-latest/*.abi || test "${{ needs.abi-dump-setup.outputs.ABI_HEADERS }}" = "llvm-c"
      - name: Upload ABI Comparison
        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: compat-report-${{ github.sha }}
          path: compat_reports/
--- a/.github/workflows/llvm-bugs.yml
+++ b/.github/workflows/llvm-bugs.yml
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-24.04
    if: github.repository == 'llvm/llvm-project'
    steps:
-      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 24
          check-latest: true
--- a/.github/workflows/merged-prs.yml
+++ b/.github/workflows/merged-prs.yml
@@ -21,7 +21,7 @@ jobs:
      (github.event.pull_request.merged == true)
    steps:
      - name: Checkout Automation Script
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: llvm/utils/git/
--- a/.github/workflows/mlir-spirv-tests.yml
+++ b/.github/workflows/mlir-spirv-tests.yml
@@ -28,11 +28,11 @@ jobs:
    container:
      image: ghcr.io/llvm/ci-ubuntu-24.04:latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup ccache
-        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+        uses: hendrikmuhs/ccache-action@33522472633dbd32578e909b315f5ee43ba878ce # v1.2.22
        with:
          max-size: 2G
          key: spirv-mlir-ubuntu-24.04
--- a/.github/workflows/new-prs.yml
+++ b/.github/workflows/new-prs.yml
@@ -34,7 +34,7 @@ jobs:
      (github.event.pull_request.author_association != 'OWNER')
    steps:
      - name: Checkout Automation Script
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: llvm/utils/git/
--- a/.github/workflows/pr-code-format.yml
+++ b/.github/workflows/pr-code-format.yml
@@ -21,14 +21,14 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 2

      - name: Get changed files
        id: changed-files
-        uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          separator: ","
          skip_initial_fetch: true
@@ -57,7 +57,7 @@ jobs:
            --end-rev HEAD \
            --changed-files "$CHANGED_FILES"

-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: workflow-args
--- a/.github/workflows/pr-code-lint.yml
+++ b/.github/workflows/pr-code-lint.yml
@@ -28,14 +28,14 @@ jobs:
      cancel-in-progress: true
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 2
      
      - name: Get changed files
        id: changed-files
-        uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          separator: ","
          skip_initial_fetch: true
@@ -93,7 +93,7 @@ jobs:
            --changed-files "$CHANGED_FILES"
      
      - name: Upload results
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: workflow-args
--- a/.github/workflows/pr-subscriber.yml
+++ b/.github/workflows/pr-subscriber.yml
@@ -14,7 +14,7 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Checkout Automation Script
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: llvm/utils/git/
--- a/.github/workflows/premerge.yaml
+++ b/.github/workflows/premerge.yaml
@@ -58,7 +58,7 @@ jobs:
        shell: bash
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 2
@@ -113,14 +113,14 @@ jobs:
        # https://github.com/actions/upload-artifact/issues/569
        continue-on-error: true
        if: '!cancelled()'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Premerge Artifacts (Linux ${{ runner.arch }})
          path: artifacts/
          retention-days: 5
          include-hidden-files: 'true'
      - name: Upload Comment
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ always() && !startsWith(matrix.runs-on, 'depot-ubuntu-24.04-arm') }}
        continue-on-error: true
        with:
@@ -139,7 +139,7 @@ jobs:
        shell: bash
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 2
@@ -180,14 +180,14 @@ jobs:
        # https://github.com/actions/upload-artifact/issues/569
        continue-on-error: true
        if: '!cancelled()'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Premerge Artifacts (Windows)
          path: artifacts/
          retention-days: 5
          include-hidden-files: 'true'
      - name: Upload Comment
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        continue-on-error: true
        with:
@@ -205,12 +205,12 @@ jobs:
      (github.event_name != 'pull_request' || github.event.action != 'closed')
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 2
      - name: Setup ccache
-        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+        uses: hendrikmuhs/ccache-action@33522472633dbd32578e909b315f5ee43ba878ce # v1.2.22
        with:
          max-size: "2000M"
      - name: Install Ninja
--- a/.github/workflows/prune-branches.yml
+++ b/.github/workflows/prune-branches.yml
@@ -20,7 +20,7 @@ jobs:
      contents: write
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: true # Relies on persisted credentials to delete unused remote branches
          fetch-depth: 0
@@ -34,13 +34,13 @@ jobs:
          mkdir patches
          python3 .github/workflows/prune-unused-branches.py .
      - name: Upload Patches
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: BranchDiffs
          retention-days: 90
          path: patches/*.patch
      - name: Upload Branch List
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: BranchList
          retention-days: 90
--- a/.github/workflows/release-asset-audit.yml
+++ b/.github/workflows/release-asset-audit.yml
@@ -23,7 +23,7 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -38,7 +38,7 @@ jobs:

      - name: Upload comment file
        if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: comment
          path: |
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -67,7 +67,7 @@ jobs:
    steps:
    # It's good practice to use setup-python, but this is also required on macos-14
    # due to https://github.com/actions/runner-images/issues/10385
-    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.14'

@@ -79,7 +79,7 @@ jobs:
        echo "OPENSSL_DIR=$env:VCPKG_INSTALLATION_ROOT\installed\arm64-windows-static-md" >> $env:GITHUB_ENV

    - name: Checkout LLVM
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
          persist-credentials: false

@@ -232,7 +232,7 @@ jobs:
    # to do that we need to specify a specific python version.  It's also
    # good practice to do this on other OSes so the version of python doesn't
    # get changed unexpectedly.
-    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.11.9'

@@ -248,7 +248,7 @@ jobs:
        git config --global core.autocrlf false

    - name: Checkout LLVM
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
        ref: ${{ needs.prepare.outputs.ref }}
@@ -315,7 +315,7 @@ jobs:
          fi
          echo "digest=$(cat $WINDOWS_INSTALLER_FILENAME $RELEASE_BINARY_FILENAME | $sha256sum | cut -d ' ' -f 1)" >> $GITHUB_OUTPUT

-    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      id: artifact-upload
      with:
        name: ${{ runner.os }}-${{ runner.arch }}-release-binary
@@ -348,7 +348,7 @@ jobs:

    steps:
      - name: Checkout Release Scripts
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/release-documentation.yml
+++ b/.github/workflows/release-documentation.yml
@@ -42,12 +42,12 @@ jobs:
      upload: ${{ inputs.upload && !contains(inputs.release-version, 'rc') }}
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Python env
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          cache: 'pip'
          cache-dependency-path: './llvm/docs/requirements.txt'
@@ -69,14 +69,14 @@ jobs:
          ./llvm/utils/release/build-docs.sh -release "${{ inputs.release-version }}" -no-doxygen

      - name: Create Release Notes Artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-notes
          path: docs-build/html-export/

      - name: Clone www-releases
        if: env.upload
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ github.repository_owner }}/www-releases
          ref: main
--- a/.github/workflows/release-doxygen.yml
+++ b/.github/workflows/release-doxygen.yml
@@ -40,12 +40,12 @@ jobs:
      upload: ${{ inputs.upload && !contains(inputs.release-version, 'rc') }}
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Python env
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          cache: 'pip'
          cache-dependency-path: './llvm/docs/requirements.txt'
--- a/.github/workflows/release-llvm-testing-tools.yml
+++ b/.github/workflows/release-llvm-testing-tools.yml
@@ -16,7 +16,7 @@ jobs:
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Build Binaries
@@ -37,7 +37,7 @@ jobs:
          cp ../../../build/bin/split-file ./src/llvm_testing_tools/binaries/split-file
          python3 -m build
      - name: Upload Packages
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: packages
          path: ./llvm/utils/llvm-testing-tools/dist/*
--- a/.github/workflows/release-sources.yml
+++ b/.github/workflows/release-sources.yml
@@ -72,7 +72,7 @@ jobs:
      - inputs
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ needs.inputs.outputs.ref }}
@@ -92,7 +92,7 @@ jobs:
    
      - name: Release Sources Artifact
        id: artifact-upload
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ needs.inputs.outputs.ref }}-sources
          path: |
@@ -110,7 +110,7 @@ jobs:
      attestations: write
    steps:
      - name: Checkout Release Scripts
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/release-tasks.yml
+++ b/.github/workflows/release-tasks.yml
@@ -38,7 +38,7 @@ jobs:
          sudo apt-get install python3-github

      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

@@ -84,7 +84,7 @@ jobs:
    environment: pypi
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: "llvmorg-${{ needs.validate-tag.outputs.release-version }}"
@@ -115,20 +115,20 @@ jobs:
          sed -i 's/ + "dev"//g' lit/__init__.py
          python3 -m build

-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: lit-${{ inputs.release-version }}-release-binary
          path: |
            llvm/utils/lit/dist

      - name: Upload lit to test.pypi.org
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          repository-url: https://test.pypi.org/legacy/
          packages-dir: llvm/utils/lit/dist/

      - name: Upload lit to pypi.org
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          packages-dir: llvm/utils/lit/dist/

@@ -181,7 +181,7 @@ jobs:
          sudo apt-get install python3-github

      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: llvm/utils/release/github-upload-release.py
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,7 +31,7 @@ jobs:

    steps:
      - name: "Checkout code"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

@@ -49,7 +49,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: SARIF file
          path: results.sarif
@@ -57,6 +57,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
        with:
          sarif_file: results.sarif
--- a/.github/workflows/spirv-tests.yml
+++ b/.github/workflows/spirv-tests.yml
@@ -24,11 +24,11 @@ jobs:
    container:
      image: ghcr.io/llvm/ci-ubuntu-24.04:latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup ccache
-        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+        uses: hendrikmuhs/ccache-action@33522472633dbd32578e909b315f5ee43ba878ce # v1.2.22
        with:
          max-size: 2G
          key: spirv-ubuntu-24.04
--- a/.github/workflows/sycl-tests.yml
+++ b/.github/workflows/sycl-tests.yml
@@ -23,11 +23,11 @@ jobs:
    container:
      image: ghcr.io/llvm/ci-ubuntu-24.04:latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup ccache
-        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+        uses: hendrikmuhs/ccache-action@33522472633dbd32578e909b315f5ee43ba878ce # v1.2.22
        with:
          max-size: 2G
          key: sycl-ubuntu-24.04
--- a/.github/workflows/test-unprivileged-download-artifact.yml
+++ b/.github/workflows/test-unprivileged-download-artifact.yml
@@ -26,13 +26,13 @@ jobs:
          echo "foo" > comment1
          echo "bar" > comment2
      - name: Upload Test File 1
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: artifact-name-1
          path: |
            comment1
      - name: Upload Test File 2
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: artifact-name-2
          path: |
@@ -46,7 +46,7 @@ jobs:
    needs: [ upload-test-artifact ]
    steps:
      - name: Checkout LLVM
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/upload-release-artifact/action.yml
+++ b/.github/workflows/upload-release-artifact/action.yml
@@ -78,7 +78,7 @@ runs:
        done

    - name: Upload Build Provenance
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: ${{ inputs.attestation-name }}
        path: |
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Fetch LLVM sources
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -26,4 +26,4 @@ jobs:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3