[dependabot]

Bumps the actions-patches group with 5 updates in the / directory:

Package	From	To
docker/setup-qemu-action	4.2.0	4.4.0
docker/build-push-action	7.3.0	7.4.0
github/codeql-action	4.37.9	4.38.2
actions/upload-code-coverage	1.4.2	1.4.3
aws-actions/configure-aws-credentials	6.2.3	6.3.0

Updates docker/setup-qemu-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

• Use the shared error helper for Docker commands by @​crazy-max in docker/setup-qemu-action#345
• Bump @​docker/actions-toolkit from 0.96.0 to 0.100.0 in docker/setup-qemu-action#344
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-qemu-action#340
• Bump js-yaml from 4.3.1 to 4.3.2 in docker/setup-qemu-action#342
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-qemu-action#337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.96.0 in docker/setup-qemu-action#336
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-qemu-action#316
• Bump brace-expansion from 1.1.15 to 1.1.18 in docker/setup-qemu-action#332
• Bump js-yaml from 4.2.0 to 4.3.1 in docker/setup-qemu-action#334
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-qemu-action#331
• Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-qemu-action#317
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-qemu-action#333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

Commits

• 9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
• 9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
• 95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
• c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
• fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
• f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
• a63df2f chore: update generated content
• 3e4165f use the shared error helper for Docker commands
• 18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 896cbed [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates docker/build-push-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

• Use the shared error helper for Buildx commands by @​crazy-max in docker/build-push-action#1620
• Prevent workflow command injection in metadata logs by @​crazy-max in docker/build-push-action#1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592
• Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613
• Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615
• Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611
• Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606
• Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577
• Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

Commits

• c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 459b674 [dependabot skip] chore: update generated content
• 4dedcb2 chore(deps): Bump @​docker/actions-toolkit from 0.99.0 to 0.100.0
• 379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
• 9877975 chore: update generated content
• 7ed0556 use the shared Buildx error summary helper
• 91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 80dbc86 [dependabot skip] chore: update generated content
• 50cac3a chore(deps): Bump @​docker/actions-toolkit from 0.98.0 to 0.99.0
• 03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
• Additional commits viewable in compare view

Updates github/codeql-action from 4.37.9 to 4.38.2

Release notes

Sourced from github/codeql-action's releases.

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action's changelog.

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Commits

• 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
• 8ad03a3 Trigger workflows
• 98af865 Update changelog for v4.38.2
• a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
• 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
• 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
• f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
• 5e4e255 Rebuild
• b13f5f4 Bump ruby/setup-ruby
• c87fe57 Rebuild
• Additional commits viewable in compare view

Updates actions/upload-code-coverage from 1.4.2 to 1.4.3

Release notes

Sourced from actions/upload-code-coverage's releases.

v1.4.3

Fixed

• Non-default branch pushes without an open pull request now skip successfully instead of attempting an upload that the API rejects. (#30)
• GitHub CLI failures during pull request discovery now produce an actionable error instead of being silently treated as no matching pull request. (#27)

Full Changelog: actions/upload-code-coverage@v1.4.2...v1.4.3

Changelog

Sourced from actions/upload-code-coverage's changelog.

v1.4.3 - 2026-09-28

Fixed

• Non-default branch pushes without an open pull request now skip successfully instead of attempting an upload that the API rejects.
• GitHub CLI failures during pull request discovery now produce an actionable error instead of being silently treated as no matching pull request.

Commits

• bfa741d Merge pull request #31 from actions/cassiomarques/release-v1.4.3
• 12d57db Prepare v1.4.3 release
• 85ee719 Merge pull request #30 from actions/cassiomarques/composite-action-investigation
• ba2250c Test pull request target routing
• 3b9af3b Document push-only coverage timing
• 32ff83e Document coverage workflow strategies
• 293c9eb Skip unsupported branch coverage uploads
• b519b7c Merge pull request #28 from actions/docs/immutable-release-process
• 46ffb21 Merge pull request #27 from actions/fix/report-gh-pr-lookup-errors
• 1f6d0c8 Document immutable release process
• Additional commits viewable in compare view

Updates aws-actions/configure-aws-credentials from 6.2.3 to 6.3.0

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.3.0

6.3.0 (2026-09-11)

Features

• add translate-env-variables option (#1961) (57b8365)

v6.2.4

6.2.4 (2026-08-31)

Bug Fixes

• account-ids handling, mask proxy as secret in logs (#1943) (aa65264)
• skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

6.3.0 (2026-09-11)

Features

• add translate-env-variables option (#1961) (57b8365)

6.2.4 (2026-08-31)

Bug Fixes

• account-ids handling, mask proxy as secret in logs (#1943) (aa65264)
• skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

Commits

• e125382 chore(main): release 6.3.0 (#1963)
• 438100a chore: add link to GH security docs (#1962)
• e92ebcc chore: Update dist
• 57b8365 feat: add translate-env-variables option (#1961)
• cc49fa7 chore(docs): README main branch guidance (#1960)
• 866cb16 chore(deps-dev): bump smol-toml from 1.7.0 to 1.7.2 (#1958)
• 6782cb1 chore(deps-dev): bump generate-license-file from 4.2.4 to 4.2.5 (#1951)
• c20509a chore: Update dist
• 7a41fc6 chore(deps): bump @​aws-sdk/client-sts from 3.1121.0 to 3.1127.0 (#1954)
• 726b713 chore(deps-dev): bump @​biomejs/biome from 2.5.11 to 2.5.12 (#1957)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-code-quality]

Code coverage overview

Languages: TypeScript, Rust

TypeScript / code-coverage/vitest

main 7251502	dependabot/github_ac... e9a7007	+/-
66%	66%	0%

Rust / code-coverage/rust

main 7251502	dependabot/github_ac... e9a7007	+/-
64%	64%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 14, 2026 18:11 UTC}