ci: bump the github-actions group with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates: dorny/paths-filter, github/codeql-action/init, github/codeql-action/analyze and errata-ai/vale-action.

Updates dorny/paths-filter from 4.0.2 to 4.0.3

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.3

What's Changed

• Update Outputs in readme to account for the 'every' predicate-quantifier by @​hintron in dorny/paths-filter#247
• fix: scope base-ignored warning to API path by @​saschabratton in dorny/paths-filter#319
• docs: add contents permission to PR example by @​134130 in dorny/paths-filter#248
• feat: add 'some-with-excludes' predicate quantifier by @​arxeiss in dorny/paths-filter#322
• Document safe handling of file list outputs in workflows by @​dorny in dorny/paths-filter#326

Security

• Escape multi-line filenames in list-files shell and csv output] by @​ken-matsui and @​tjswlsgg in https://github.com/advisories/GHSA-7hc6-8hq5-9q2m

New Contributors

• @​hintron made their first contribution in dorny/paths-filter#247
• @​134130 made their first contribution in dorny/paths-filter#248
• @​arxeiss made their first contribution in dorny/paths-filter#322

Full Changelog: dorny/paths-filter@v4...v4.0.3

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.3

• Document safe handling of file list outputs in workflows
• Escape multi-line filenames in list-files shell and csv output
• Add 'some-with-excludes' predicate quantifier
• Add contents permission to PR example
• Scope base-ignored warning to API path
• Update outputs in readme to account for the 'every' predicate-quantifier

v4.0.2

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

v4.0.1

• Support merge queue

v4.0.0

• Update action runtime to node24

v3.0.4

• Escape multi-line filenames in list-files shell and csv output

v3.0.3

• Add missing predicate-quantifier

v3.0.2

• Add config parameter for predicate quantifier

v3.0.1

• Compare base and ref when token is empty

v3.0.0

• Update to Node.js 20
• Update all dependencies

v2.11.1

• Update @​actions/core to v1.10.0 - Fixes warning about deprecated set-output
• Document need for pull-requests: read permission
• Updating to actions/checkout@v3

v2.11.0

• Set list-files input parameter as not required
• Update Node.js
• Fix incorrect handling of Unicode characters in exec()
• Use Octokit pagination
• Updates real world links

v2.10.2

... (truncated)

Commits

• ceb8a2b Update CHANGELOG.md for v4.0.3 and v3.0.4 (#327)
• ef09b88 Document safe handling of file list outputs in workflows (#326)
• 44adc5b Merge commit from fork
• 4711b7a feat: add 'some-with-excludes' predicate quantifier (#322)
• 93c889f fix: escape multi-line filenames in list-files shell and csv output
• b41dfa9 docs: add contents permission to PR example (#248)
• 9af6e5a fix: scope base-ignored warning to API path (#319)
• cae9006 docs: update outputs in readme to account for the 'every' predicate-quantifie...
• See full diff in compare view

Updates github/codeql-action/init from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

Updates errata-ai/vale-action from 2.1.2 to 3.0.0

Release notes

Sourced from errata-ai/vale-action's releases.

v3.0.0

Breaking

Nothing was renamed or removed, but several behaviors changed. Each has a way back.

• reviewdog 0.17.0 → 0.21.0. Workflows triggered on push using a github-pr-* reporter previously reported nothing (this is not PullRequest build, exit 0). They now lint, and can fail. Pin reviewdog_version: 0.17.0 to keep the old behavior.
• The level input is honored. It was read from action.yml and never used. Checks that concluded neutral can now conclude failure. Leave level unset for the previous behavior.
• fail_on_error: true fails on errors only. It previously failed on a finding of any severity for every reporter except the check ones, so a lone suggestion ended the run. Use fail_level: any to restore that.
• GitHub's 10-annotation limit no longer fails the job when fail_on_error: false. You get a warning naming how many alerts went unshown.
• Pinning @reviewdog tracks the branch, which is now v3. Pin @v3, or @v2 to stay put.

Added

• Suggested fixes. Alerts that Vale knows how to resolve are posted as suggested changes you can commit from the pull request — the same replacements the language server offers. Requires reporter: github-pr-review.
• macOS, Windows, and ARM runners. The action previously only ran on Linux x86-64.
• New inputs: config, filter, glob, min_alert_level, fail_level, sync, reviewdog_version. workdir is now declared and documented.
• Caching. Binaries go in the runner's tool cache, and sync: false lets you restore a cached StylesPath instead of re-downloading every package each run.
• Downloads are verified against each release's published checksums.

Fixed

• Crash on large output — write EPIPE when reviewdog exited before reading it all (#122)
• An empty files list failing with lstat : no such file or directory (#141)
• Pull requests whose diff exceeds 20,000 lines (#153)
• The annotation limit failing runs regardless of fail_on_error (#89, #150)
• A warning failing the workflow under fail_on_error: true (#84)
• Nothing reported on push events (#103)
• The level input being ignored (#106)
• Wildcards in files — use the glob input; the warning now says so (#123)
• Scheduled runs on runners that write a thin event payload (#69)
• vale_flags splitting on whitespace, which broke --filter='.Level == "error"'
• Vale's own error is reported when it exits with a runtime error, instead of an exit code

Internal

The action now ships as a single bundled dist/index.js; node_modules is no longer committed, taking the repository from 1,035 tracked files to 23. CI fails if the bundle is out of date with the source.

Full Changelog: vale-cli/vale-action@2.1.2...v3.0.0

Commits

• 518a913 Point the README at v3
• dca64de Backtick reviewdog in the README
• 4063152 Add a fail_level input
• 1ef5a5f Move the major tag ourselves, whatever the release is called
• 00a15b5 Treat an empty file list as nothing to lint
• 40967b1 Point wildcard paths at the glob input
• d4af982 Survive reviewdog closing its input early
• febea0f Fail on errors, not on any finding
• b1d1c1f Give reviewdog a repository when the event payload omits one
• 6b637c5 Note what a fork's read-only token can't do
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions