Bump the github-actions group with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates: SonarSource/sonarqube-scan-action, actions/cache, Azure/setup-helm and sigstore/cosign-installer.

Updates SonarSource/sonarqube-scan-action from 7.0.0 to 7.1.0

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v7.1.0

What's Changed

• SQSCANGHA-128 NO-JIRA Bump actions/cache from 4 to 5 by @​dependabot[bot] in SonarSource/sonarqube-scan-action#219
• SQSCANGHA-130 Bump rollup from 4.50.1 to 4.59.0 by @​dependabot[bot] in SonarSource/sonarqube-scan-action#221
• SQSCANGHA-131 Bump picomatch from 4.0.3 to 4.0.4 by @​dependabot[bot] in SonarSource/sonarqube-scan-action#223
• SQSCANGHA-132 Upgrade Node to 24 by @​claire-villard-sonarsource in SonarSource/sonarqube-scan-action#224

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.1.0

Commits

• 299e4b7 SQSCANGHA-132 Upgrade Node to 24 (#224)
• 3988e54 SQSCANGHA-131 Bump picomatch from 4.0.3 to 4.0.4 (#223)
• 9598b8a SQSCANGHA-130 Bump rollup from 4.50.1 to 4.59.0 (#221)
• dcc5211 SQSCANGHA-128 NO-JIRA Bump actions/cache from 4 to 5 (#219)
• b9f37f9 SQSCANGHA-129 Fix the Analysis Processing team name in CODEOWNERS (#220)
• See full diff in compare view

Updates actions/cache from 5.0.3 to 5.0.4

Release notes

Sourced from actions/cache's releases.

v5.0.4

What's Changed

• Add release instructions and update maintainer docs by @​Link- in actions/cache#1696
• Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @​Link- in actions/cache#1697
• Fix workflow permissions and cleanup workflow names / formatting by @​Link- in actions/cache#1699
• docs: Update examples to use the latest version by @​XZTDean in actions/cache#1690
• Fix proxy integration tests by @​Link- in actions/cache#1701
• Fix cache key in examples.md for bun.lock by @​RyPeck in actions/cache#1722
• Update dependencies & patch security vulnerabilities by @​Link- in actions/cache#1738

New Contributors

• @​XZTDean made their first contribution in actions/cache#1690
• @​RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

• Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
• Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
• Bump fast-xml-parser to v5.5.6

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

• Bump @actions/cache to v5.0.3 #1692

5.0.1

• Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

• 6682284 Merge pull request #1738 from actions/prepare-v5.0.4
• e340396 Update RELEASES
• 8a67110 Add licenses
• 1865903 Update dependencies & patch security vulnerabilities
• 5656298 Merge pull request #1722 from RyPeck/patch-1
• 4e380d1 Fix cache key in examples.md for bun.lock
• b7e8d49 Merge pull request #1701 from actions/Link-/fix-proxy-integration-tests
• 984a21b Add traffic sanity check step
• acf2f1f Fix resolution
• 95a07c5 Add wait for proxy
• Additional commits viewable in compare view

Updates Azure/setup-helm from 4.3.1 to 5.0.0

Release notes

Sourced from Azure/setup-helm's releases.

v5.0.0

Changed

• #259 Update Node.js runtime from node20 to node24
• #263 Bump undici
• #257 Bump undici and @​actions/http-client
• #256 Bump minimatch
• #248 Bump the actions group with 2 updates
• #247 Bump the actions group with 3 updates
• #246 Bump @​types/node from 25.0.2 to 25.0.3 in the actions group
• #245 Bump the actions group with 3 updates
• #243 Bump the actions group with 2 updates
• #240 Bump prettier from 3.6.2 to 3.7.3 in the actions group
• #229 Bump the actions group across 1 directory with 3 updates
• #231 Bump js-yaml from 3.14.1 to 3.14.2
• #234 Bump glob from 10.4.5 to 10.5.0
• #225 Fix build error
• #222 Bump @​types/node from 24.7.2 to 24.8.1 in the actions group
• #220 Bump the actions group across 1 directory with 4 updates
• #216 Bump the actions group across 1 directory with 4 updates
• #213 Bump the actions group with 2 updates
• #211 Bump undici
• #212 Bump jest from 30.0.5 to 30.1.2 in the actions group
• #210 Bump @​types/node from 24.2.1 to 24.3.0 in the actions group

Changelog

Sourced from Azure/setup-helm's changelog.

Change Log

[5.0.0] - 2026-03-23

Changed

• #259 Update Node.js runtime from node20 to node24
• #263 Bump undici
• #257 Bump undici and @​actions/http-client
• #256 Bump minimatch
• #248 Bump the actions group with 2 updates
• #247 Bump the actions group with 3 updates
• #246 Bump @​types/node from 25.0.2 to 25.0.3 in the actions group
• #245 Bump the actions group with 3 updates
• #243 Bump the actions group with 2 updates
• #240 Bump prettier from 3.6.2 to 3.7.3 in the actions group
• #229 Bump the actions group across 1 directory with 3 updates
• #231 Bump js-yaml from 3.14.1 to 3.14.2
• #234 Bump glob from 10.4.5 to 10.5.0
• #225 Fix build error
• #222 Bump @​types/node from 24.7.2 to 24.8.1 in the actions group
• #220 Bump the actions group across 1 directory with 4 updates
• #216 Bump the actions group across 1 directory with 4 updates
• #213 Bump the actions group with 2 updates
• #211 Bump undici
• #212 Bump jest from 30.0.5 to 30.1.2 in the actions group
• #210 Bump @​types/node from 24.2.1 to 24.3.0 in the actions group

[4.3.1] - 2025-08-12

Changed

• #167 Pinning Action Dependencies for Security and Reliability
• #181 Fix types, and update node version.
• #191 chore(tests): Mock arch to make tests pass on arm host
• #192 chore: remove unnecessary prebuild script
• #203 Update helm version retrieval to use JSON output for latest version
• #207 ci(workflows): update helm version to v3.18.4 and add matrix for tests

Added

• #197 Add pre-commit hook

[4.3.0] - 2025-02-15

• #152 feat: log when restoring from cache
• #157 Dependencies Update
• #137 Add dependabot

[4.2.0] - 2024-04-15

... (truncated)

Commits

• dda3372 build
• 3894c84 chore(release): v5.0.0 (#265)
• ca66f38 Update Node.js runtime from node20 to node24 (#259)
• 316ed5a Bump undici (#263)
• bc9bc0c Bump undici and @​actions/http-client (#257)
• 16e3094 Bump minimatch (#256)
• 6e42753 Bump actions/stale in /.github/workflows in the actions group (#255)
• 9651d9d Bump actions/checkout in /.github/workflows in the actions group (#251)
• 658bff9 Bump the actions group with 2 updates (#248)
• 331c814 Bump the actions group with 3 updates (#247)
• Additional commits viewable in compare view

Updates sigstore/cosign-installer from 4.0.0 to 4.1.1

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.1

What's Changed

• chore: update default cosign-release to v3.0.5 in sigstore/cosign-installer#223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

• Bump cosign to 3.0.5 in sigstore/cosign-installer#220
• fix: add retry to curl downloads for transient network failures in sigstore/cosign-installer#210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

Commits

• cad07c2 chore: update default cosign-release to v3.0.5 (#223)
• ba7bc0a fix: add retry to curl downloads for transient network failures (#210)
• 5a292e1 Bump cosign to 3.0.5 (#220)
• 351ea76 Bump actions/checkout from 6.0.1 to 6.0.2 (#217)
• c17565f test with go 1.26 too (#221)
• a6fdd19 Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)
• 430b6a7 docs: fix registry from gcr.io to ghcr.io (#213)
• 4d14d7f feat: update to v3.0.3 (#212)
• f148005 fix: use env vars for template expansions; show curl errors (#207)
• c3f2d79 Bump actions/checkout from 6.0.0 to 6.0.1 (#208)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.