chore(deps): Bump the github-actions-dependencies group with 4 updates

[dependabot]

Bumps the github-actions-dependencies group with 4 updates: dotnet/nbgv, github/codeql-action, docker/login-action and actions/labeler.

Updates dotnet/nbgv from 293b36ef77470c667752f376b0515d02a92ba66c to 81c13e7567e01fd97c365732606c7d0f84023564

Commits

• 81c13e7 Merge pull request #247 from dotnet/dependabot/npm_and_yarn/brace-expansion-1...
• 2b22ea8 Bump brace-expansion from 1.1.15 to 1.1.16
• ae00266 Merge pull request #243 from dotnet/renovate/typescript-7.x
• bbb60e6 Merge pull request #245 from dotnet/renovate/ts-jest-29.x-lockfile
• 3d3952a Merge pull request #246 from dotnet/dependabot/npm_and_yarn/tar-7.5.22
• 0e7707f Bump tar from 7.5.17 to 7.5.22
• b5237f5 Update dependency ts-jest to v29.4.12
• 3493b3a Update dependency typescript to v7
• See full diff in compare view

Updates github/codeql-action from 4.37.1 to 4.37.3

Release notes

Sourced from github/codeql-action's releases.

v4.37.3

No user facing changes.

v4.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

Changelog

Sourced from github/codeql-action's changelog.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

Commits

• e4fba86 Merge pull request #4031 from github/update-v4.37.3-72f6a9da0
• fb50ab5 Update changelog for v4.37.3
• 72f6a9d Merge pull request #4030 from github/mbg/fix/no-proxy
• 3b5ee58 Use default request options instead of undefined
• bfb6be4 Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621
• 526ab84 Rebuild
• d6217b9 Update changelog and version after v4.37.2
• e064762 Merge pull request #4027 from github/update-v4.37.2-385bcdc5a
• e0faed8 Add a couple of change notes
• 73aad0e Update changelog for v4.37.2
• Additional commits viewable in compare view

Updates docker/login-action from 4.4.0 to 4.5.1

Release notes

Sourced from docker/login-action's releases.

v4.5.1

• Support dhi.io as Docker Hub OIDC registry by @​crazy-max in docker/login-action#1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

• Docker Hub OIDC login support by @​crazy-max in docker/login-action#1048
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1091.0 in docker/login-action#1037
• Bump @​docker/actions-toolkit from 0.92.0 to 0.94.0 in docker/login-action#1044 docker/login-action#1050
• Bump brace-expansion from 1.1.13 to 1.1.16 in docker/login-action#1046
• Bump js-yaml from 5.2.0 to 5.2.1 in docker/login-action#1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

Commits

• abd2ef4 Merge pull request #1055 from crazy-max/test-registry-auth-oidc
• d49d3a9 Merge pull request #1054 from crazy-max/oidc-missing-dhi
• b58b17c test: cover Docker Hub OIDC with registry-auth
• be646c2 chore: update generated content
• d77c059 support dhi.io as Docker Hub OIDC registry
• 06fb636 Merge pull request #1037 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• a8bc953 [dependabot skip] chore: update generated content
• f54b901 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• 77f18f6 Merge pull request #1049 from docker/dependabot/github_actions/codeql-actions...
• ec0bf28 Merge pull request #1050 from docker/dependabot/npm_and_yarn/docker/actions-t...
• Additional commits viewable in compare view

Updates actions/labeler from 6 to 7

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

• Migrate to ESM and update dependencies by @​chiranjib-swain in actions/labeler#949

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

• Improve PR number validation and warning messages in input handling by @​chiranjib-swain in actions/labeler#939

Dependency Updates

• Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by @​dependabot in actions/labeler#943
• Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 by @​dependabot in actions/labeler#942

Full Changelog: actions/labeler@v6.1.0...v6.2.0

v6.1.0

Enhancements

• Add changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by @​bluca in actions/labeler#923

Bug Fixes

• Improve Labeler Action documentation and permission error handling by @​chiranjib-swain in actions/labeler#897
• Preserve manually added labels during workflow runs and refine label synchronization logic by @​chiranjib-swain in actions/labeler#917

Dependency Updates

• Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by @​dependabot in actions/labeler#877
• Upgrade minimatch from 10.0.1 to 10.2.3 by @​dependabot in actions/labeler#926
• Upgrade dependencies (@​actions/core, @​actions/github, js-yaml, minimatch, @​typescript-eslint) by @​Copilot in actions/labeler#934

New Contributors

• @​chiranjib-swain made their first contribution in actions/labeler#897
• @​bluca made their first contribution in actions/labeler#923
• @​Copilot made their first contribution in actions/labeler#934

Full Changelog: actions/labeler@v6...v6.1.0

v6.0.1

What's Changed

• Upgrade publish-action from 0.2.2 to 0.4.0 by @​aparnajyothi-y in actions/labeler#901

New Contributors

• @​aparnajyothi-y made their first contribution in actions/labeler#901

Full Changelog: actions/labeler@v6.0.0...v6.0.1

Commits

• bf12e9b feat: migrate to ESM and update dependencies (#949)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/pr-validation.yml

Package	Version	License	Issue Type
dotnet/nbgv	81c13e7567e01fd97c365732606c7d0f84023564	Null	Unknown License

Denied Licenses:

GPL-2.0, GPL-3.0, AGPL-3.0

OpenSSF Scorecard

Package	Version	Score	Details
actions/dotnet/nbgv	81c13e7567e01fd97c365732606c7d0f84023564	🟢 4.2	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/13 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy ⚠️ 0 security policy file not detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/pr-validation.yml

[github-actions]

Test Results

7 641 tests   7 622 ✅  2m 58s ⏱️
    7 suites     19 💤
    7 files        0 ❌

Results for commit dc3fbbd.

[github-actions]

Code Coverage

Summary
  Generated on: 07/27/2026 - 11:37:50
  Coverage date: 07/27/2026 - 11:35:50 - 07/27/2026 - 11:37:41
  Parser: MultiReport (7x Cobertura)
  Assemblies: 23
  Classes: 1067
  Files: 591
  Line coverage: 74.6%
  Covered lines: 36829
  Uncovered lines: 12485
  Coverable lines: 49314
  Total lines: 97285
  Branch coverage: 61.8% (13931 of 22512)
  Covered branches: 13931
  Total branches: 22512
  Method coverage: 86.4% (6316 of 7308)
  Full method coverage: 74.2% (5426 of 7308)
  Covered methods: 6316
  Fully covered methods: 5426
  Total methods: 7308