Bump the "all" group with 2 updates across multiple ecosystems

[dependabot]

Bumps the all group with 3 updates: actions/checkout, github/codeql-action and ruby/setup-ruby.

Updates actions/checkout from 5.0.0 to 6.0.0

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248
• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• v6-beta by @​ericsciple in actions/checkout#2298
• update readme/changelog for v6 by @​ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

V6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

V5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

V5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

V4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

V4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

v4.2.0

• Add Ref and Commit outputs by @​lucacome in actions/checkout#1180
• Dependency updates by @​dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

v4.1.6

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732

v4.1.5

• Update NPM dependencies by @​cory-miller in actions/checkout#1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in actions/checkout#1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in actions/checkout#1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in actions/checkout#1695

... (truncated)

Commits

• 1af3b93 update readme/changelog for v6 (#2311)
• 71cf226 v6-beta (#2298)
• 069c695 Persist creds to a separate file (#2286)
• ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
• See full diff in compare view

Updates github/codeql-action from 4.31.3 to 4.31.4

Release notes

Sourced from github/codeql-action's releases.

v4.31.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.4 - 18 Nov 2025

No user facing changes.

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

• CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.
• Update default CodeQL bundle version to 2.23.5. #3288

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

• The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

• Bump minimum CodeQL bundle version to 2.17.6. #3223
• When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

4.30.9 - 17 Oct 2025

• Update default CodeQL bundle version to 2.23.3. #3205
• Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

• [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

• Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

• We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

... (truncated)

Commits

• e12f017 Merge pull request #3312 from github/update-v4.31.4-70434f6dd
• c9cb6f9 Update changelog for v4.31.4
• 70434f6 Merge pull request #3311 from github/mbg/deps/bump-glob
• 528362a Bump glob to at least 11.1.0
• de12435 Merge pull request #3308 from github/mbg/pr-template/nov25
• ffa63f0 Merge pull request #3307 from github/dependabot/github_actions/dot-github/wor...
• 7bcdb4b Add additional options to PR template and clarify some
• 07eae64 Merge pull request #3303 from github/mario-campos/v3-core-warning
• e546fff Rebuild
• c418a0f Bump ruby/setup-ruby
• Additional commits viewable in compare view

Updates ruby/setup-ruby from 1.267.0 to 1.268.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.268.0

What's Changed

• Add ruby-4.0.0-preview2 by @​ruby-builder-bot in ruby/setup-ruby#825

Full Changelog: ruby/setup-ruby@v1.267.0...v1.268.0

Commits

• 8aeb6ff Test Ruby 4.0 previews
• 09e84e3 Add ruby-4.0.0-preview2
• See full diff in compare view

Bumps the all group with 3 updates in the /Library/Homebrew directory: minitest, sorbet-static-and-runtime and ruby-lsp.

Updates minitest from 5.26.1 to 5.26.2

Changelog

Sourced from minitest's changelog.

=== 5.26.2 / 2025-11-17

• 5 bug fixes:

  • Bumped minimum ruby to 3.1.
  • Alias Spec#name to #inspect for cleaner output in repls.
  • Fix pathing for Hoe::Minitest initialization to be more generic.
  • Fixed refute_in_epsilon to use min of abs values. (wtn)
  • Improved options processing and usage output to be more clear.

Commits

• 25f78c0 prepped for release
• 1284a3f Dropped extra 2.7 compatibility code.
• adfb01d Dropped extra 2.7 compatibility code.
• aa1c3fa - Fix pathing for Hoe::Minitest initialization to be more generic.
• cb3a345 - Bumped minimum ruby to 3.1.
• 1f47bc6 - Fixed refute_in_epsilon to use min of abs values. (wtn)
• a52e727 Fuuuuck I am SO tired of ruby 2.7!
• 33259e4 - Alias Spec#name to #inspect for cleaner output in repls.
• e2bc84c - Improved options processing and usage output to be more clear.
• See full diff in compare view

Updates sorbet-static-and-runtime from 0.6.12765 to 0.6.12783

Release notes

Sourced from sorbet-static-and-runtime's releases.

sorbet 0.6.12782.20251120114804-4b9e99ee9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12782', :group => :development
gem 'sorbet-runtime', '0.6.12782'

sorbet 0.6.12781.20251120114623-ecf459fa9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12781', :group => :development
gem 'sorbet-runtime', '0.6.12781'

sorbet 0.6.12780.20251119094043-748358de2

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12780', :group => :development
gem 'sorbet-runtime', '0.6.12780'

sorbet 0.6.12779.20251118153111-36c74af58

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12779', :group => :development
gem 'sorbet-runtime', '0.6.12779'

sorbet 0.6.12778.20251117162106-0758aa11e

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12778', :group => :development
gem 'sorbet-runtime', '0.6.12778'

sorbet 0.6.12777.20251117151913-a939cc718

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12777', :group => :development
gem 'sorbet-runtime', '0.6.12777'

sorbet 0.6.12776.20251117151655-ef92f1d7c

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12776', :group => :development
gem 'sorbet-runtime', '0.6.12776'

sorbet 0.6.12775.20251117141854-4452364a6

... (truncated)

Commits

• See full diff in compare view

Updates ruby-lsp from 0.26.3 to 0.26.4

Release notes

Sourced from ruby-lsp's releases.

v0.26.4

🐛 Bug Fixes

• Revert "Reuse the prism result again" (Shopify/ruby-lsp#3826) by @​vinistock

Commits

• 5be134e Revert "Reuse the prism result again" (#3826)
• 1debe52 Merge pull request #3825 from Shopify/dependabot/npm_and_yarn/vscode/glob-11.1.0
• ecb9885 Bump glob from 11.0.3 to 11.1.0 in /vscode
• abd88c8 Avoid failing if the git extension is disabled (#3822)
• 975619f Bump version to v0.26.4 (#3821)
• See full diff in compare view

Updates sorbet-runtime from 0.6.12765 to 0.6.12783

Release notes

Sourced from sorbet-runtime's releases.

sorbet 0.6.12782.20251120114804-4b9e99ee9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12782', :group => :development
gem 'sorbet-runtime', '0.6.12782'

sorbet 0.6.12781.20251120114623-ecf459fa9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12781', :group => :development
gem 'sorbet-runtime', '0.6.12781'

sorbet 0.6.12780.20251119094043-748358de2

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12780', :group => :development
gem 'sorbet-runtime', '0.6.12780'

sorbet 0.6.12779.20251118153111-36c74af58

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12779', :group => :development
gem 'sorbet-runtime', '0.6.12779'

sorbet 0.6.12778.20251117162106-0758aa11e

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12778', :group => :development
gem 'sorbet-runtime', '0.6.12778'

sorbet 0.6.12777.20251117151913-a939cc718

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12777', :group => :development
gem 'sorbet-runtime', '0.6.12777'

sorbet 0.6.12776.20251117151655-ef92f1d7c

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12776', :group => :development
gem 'sorbet-runtime', '0.6.12776'

sorbet 0.6.12775.20251117141854-4452364a6

... (truncated)

Commits

• See full diff in compare view

Updates sorbet from 0.6.12765 to 0.6.12783

Release notes

Sourced from sorbet's releases.

sorbet 0.6.12782.20251120114804-4b9e99ee9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12782', :group => :development
gem 'sorbet-runtime', '0.6.12782'

sorbet 0.6.12781.20251120114623-ecf459fa9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12781', :group => :development
gem 'sorbet-runtime', '0.6.12781'

sorbet 0.6.12780.20251119094043-748358de2

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12780', :group => :development
gem 'sorbet-runtime', '0.6.12780'

sorbet 0.6.12779.20251118153111-36c74af58

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12779', :group => :development
gem 'sorbet-runtime', '0.6.12779'

sorbet 0.6.12778.20251117162106-0758aa11e

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12778', :group => :development
gem 'sorbet-runtime', '0.6.12778'

sorbet 0.6.12777.20251117151913-a939cc718

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12777', :group => :development
gem 'sorbet-runtime', '0.6.12777'

sorbet 0.6.12776.20251117151655-ef92f1d7c

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12776', :group => :development
gem 'sorbet-runtime', '0.6.12776'

sorbet 0.6.12775.20251117141854-4452364a6

... (truncated)

Commits

• See full diff in compare view

Updates sorbet-static from 0.6.12765 to 0.6.12783

Release notes

Sourced from sorbet-static's releases.

sorbet 0.6.12782.20251120114804-4b9e99ee9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12782', :group => :development
gem 'sorbet-runtime', '0.6.12782'

sorbet 0.6.12781.20251120114623-ecf459fa9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12781', :group => :development
gem 'sorbet-runtime', '0.6.12781'

sorbet 0.6.12780.20251119094043-748358de2

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12780', :group => :development
gem 'sorbet-runtime', '0.6.12780'

sorbet 0.6.12779.20251118153111-36c74af58

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12779', :group => :development
gem 'sorbet-runtime', '0.6.12779'

sorbet 0.6.12778.20251117162106-0758aa11e

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12778', :group => :development
gem 'sorbet-runtime', '0.6.12778'

sorbet 0.6.12777.20251117151913-a939cc718

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12777', :group => :development
gem 'sorbet-runtime', '0.6.12777'

sorbet 0.6.12776.20251117151655-ef92f1d7c

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.12776', :group => :development
gem 'sorbet-runtime', '0.6.12776'

sorbet 0.6.12775.20251117141854-4452364a6

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[MikeMcQuaid]

@cho-m Looks like the right bundler isn't found again. This was working last week so I suspect due to the PATH changes.

[cho-m]

@cho-m Looks like the right bundler isn't found again. This was working last week so I suspect due to the PATH changes.

vendor-gems also used to run Homebrew.install_bundler! so it may need the environment set up (Homebrew.setup_gem_environment!)

Can try restoring behavior in #21121

[cho-m]

Vendor Gems works now - https://github.com/Homebrew/brew/actions/runs/19577023970/job/56064991911?pr=21120

Not sure on why newer Sorbet isn't getting found:

Fetching sorbet-runtime 0.6.12783
Installing sorbet-runtime 0.6.12783
...
Bundle complete! 44 Gemfile dependencies, 33 gems now installed.
Bundled gems are installed into `../../../../linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/vendor/bundle`
Removing sorbet-runtime (0.6.12765)
1 installed gem you directly depend on is looking for funding.
  Run `bundle fund` for details
<internal:/home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/vendor/portable-ruby/3.4.7/lib/ruby/3.4.0/rubygems/core_ext/kernel_require.rb>:37:in 'Kernel#require': cannot load such file -- sorbet-runtime (LoadError)

I do see vendor/bundle/bundler/setup.rb still references old version if the gem install is triggered via another brew command other than brew vendor-gems

[MikeMcQuaid]

@cho-m Think the vendor-gems workflow dispatch just needed run. Seems to be working now it's committed those changes.

[cho-m]

  Warning: Some installed casks are deprecated or disabled.
  You should find replacements for the following casks:
    session-manager-plugin

Looks like we just deprecated this (Homebrew/homebrew-cask@8fb478e) but GitHub installs it on their runners: https://github.com/actions/runner-images/blob/main/images/macos/scripts/build/install-aws-tools.sh#L17-L18

---

Stack trace for other failure:

/opt/homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/simplecov-0.22.0/lib/simplecov/lines_classifier.rb:36:in 'IO.foreach': No such file or directory @ rb_sysopen - /opt/homebrew/Library/Homebrew/cmd/rbcmd.rb (Errno::ENOENT)
        from /opt/homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/simplecov-0.22.0/lib/simplecov/lines_classifier.rb:36:in 'Enumerator#each'
        from /opt/homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/simplecov-0.22.0/lib/simplecov/lines_classifier.rb:36:in 'Enumerable#map'
        from /opt/homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/simplecov-0.22.0/lib/simplecov/lines_classifier.rb:36:in 'SimpleCov::LinesClassifier#classify'
        from /opt/homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/simplecov-0.22.0/lib/simplecov/simulate_coverage.rb:22:in 'SimpleCov::SimulateCoverage.call'
        from /opt/homebrew/Library/Homebrew/.simplecov:49:in 'block (3 levels) in <top (required)>'
        from /opt/homebrew/Library/Homebrew/.simplecov:47:in 'Array#each'
        from /opt/homebrew/Library/Homebrew/.simplecov:47:in 'block (2 levels) in <top (required)>'
        from /opt/homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/simplecov-0.22.0/lib/simplecov.rb:189:in 'SimpleCov.run_exit_tasks!'
        from /opt/homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/simplecov-0.22.0/lib/simplecov.rb:179:in 'SimpleCov.at_exit_behavior'
        from /opt/homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/simplecov-0.22.0/lib/simplecov/defaults.rb:30:in 'block in <top (required)>'

Looks like a parallel test issue where timing of commands_spec.rb can cause extra temporary Ruby files to be detected.

[cho-m]

• test_bot: remove session-manager-plugin #21127
• test/commands_spec: write files to tmpdir #21128