Repository navigation
ci: bump step-security/harden-runner from 2.22.2 to 2.22.3 in the actions group - #2276
Conversation
Bumps the actions group with 1 update: [step-security/harden-runner](https://github.com/step-security/harden-runner). Updates `step-security/harden-runner` from 2.22.2 to 2.22.3 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@dc2769a...46b06ce) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approve. ci group pin of step-security/harden-runner 2.22.2 (dc2769ab) → 2.22.3 (46b06cea). Diff is workflow SHA comments only (ci.yml ×4, codeql.yml, dependency-review.yml, pr-title.yml). egress-policy: audit is unchanged; action.yml inputs are unchanged.
Lightweight tag v2.22.3 is commit 46b06cea07f9e64621fdf066ba77ac6915163d43 (matches the pin). Published 2026-10-27, past the 7-day Actions cooldown. Changelog: Avrea-hosted runners (enterprise, unused); fix for GitHub-hosted Linux DNS/proxy experiment false-blocks (relevant here, still audit-mode); enterprise flag to disable implicit AWS allowances on self-hosted Linux (unused — GitHub-hosted only). v2.22.4 exists (2026-11-06) but is inside the cooldown window, so this PR is the correct step.
Plugin runtime is untouched. Frozen install + lint/svelte-check/build/test on Node 22.23.4: 6986 passed, 28 skipped; pnpm audit --prod 0. GitHub CI (Test, Build + Lint, Docs) + CodeQL Analyze (both languages actually ran 46b06cea, CLI 2.27.4) + Dependency Review + PR Title green. ci: title will not cut a release.
Squash-merging.
Sent by Cursor Automation: Dependabot PRs
Bumps the actions group with 1 update: step-security/harden-runner.
Updates
step-security/harden-runnerfrom 2.22.2 to 2.22.3Release notes
Sourced from step-security/harden-runner's releases.
Commits
46b06ceMerge pull request #711 from step-security/rc-46f82eb4bMerge pull request #710 from h0x0er/jatin/tp-avrea665b85aupdate agent-self-hosted, agent-bravo to v1.9.5 and agent to v0.18.080fffe1detect avrea runnersDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions