chore(deps): bump the github-actions group across 1 directory with 12 updates - #4383
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): bump the github-actions group across 1 directory with 12 updates#4383dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
… updates Bumps the github-actions group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.157` | `1.0.179` | | [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `3.0.3` | `4.0.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.4.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.0` | `4.1.1` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.2` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | | [mitchellh/vouch/action/check-pr](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [mitchellh/vouch/action/manage-by-issue](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.0` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) Updates `anthropics/claude-code-action` from 1.0.157 to 1.0.179 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@428971d...b76a077) Updates `slackapi/slack-github-action` from 3.0.3 to 4.0.0 - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md) - [Commits](slackapi/slack-github-action@45a88b9...dcb1066) Updates `docker/login-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...af1e73f) Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@fbd0ab8...7b450ff) Updates `actions/attest-build-provenance` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@a2bbfa2...0f67c3f) Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 - [Release notes](https://github.com/denoland/setup-deno/releases) - [Commits](denoland/setup-deno@667a34c...22d081f) Updates `mitchellh/vouch/action/check-pr` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `mitchellh/vouch/action/manage-by-issue` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.0 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@192e21d...6599ee8) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.179 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: slackapi/slack-github-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: denoland/setup-deno dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: mitchellh/vouch/action/check-pr dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: mitchellh/vouch/action/manage-by-issue dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Create GitHub Release | ||
| id: release | ||
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 | ||
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| steps: | ||
| - name: Checkout repo | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path |
Contributor
There was a problem hiding this comment.
🟡 Checkout action version note in the release workflow disagrees with the actual pinned version
The version note is left as v7.0.0 (actions/checkout@3d3c42e...5ba90b1 # v7.0.0 at .github/workflows/release.yml:70) even though that commit is v7.0.1, so the human-readable label no longer matches the version that actually runs.
Impact: Anyone reading the workflow sees the wrong checkout version, which is misleading during audits or debugging; the running version is unaffected.
Why the note is stale
Every other occurrence of the SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 in the repo is labeled # v7.0.1 (e.g. .github/workflows/check-review-md.yml:30). Only .github/workflows/release.yml:70 and .github/workflows/changesets-pr.yml:29 still say # v7.0.0. Both of these are the lines that carry a trailing # zizmor: ignore[artipacked] ... comment after the version note, which appears to have prevented dependabot from rewriting the version portion of the comment during the bump.
Suggested change
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path |
Was this helpful? React with 👍 or 👎 to provide feedback.
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path |
Contributor
There was a problem hiding this comment.
🟡 Checkout action version note in the changesets workflow disagrees with the actual pinned version
The version note is left as v7.0.0 (actions/checkout@3d3c42e...5ba90b1 # v7.0.0 at .github/workflows/changesets-pr.yml:29) even though that commit is v7.0.1, so the human-readable label no longer matches the version that actually runs.
Impact: Anyone reading the workflow sees the wrong checkout version, which is misleading during audits or debugging; the running version is unaffected.
Why the note is stale
Every other occurrence of the SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 in the repo is labeled # v7.0.1. Only this line and .github/workflows/release.yml:70 still say # v7.0.0 — both are the lines that carry a trailing # zizmor: ignore[...] comment after the version note, which appears to have prevented the version portion of the comment from being rewritten during the dependabot bump.
Suggested change
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path |
Was this helpful? React with 👍 or 👎 to provide feedback.
@trigger.dev/build
trigger.dev
@trigger.dev/core
@trigger.dev/python
@trigger.dev/react-hooks
@trigger.dev/redis-worker
@trigger.dev/rsc
@trigger.dev/schema-to-json
@trigger.dev/sdk
commit: |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/github-actions-6b93ce488b
branch
July 27, 2026 09:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 12 updates in the / directory:
7.0.07.0.16.4.07.0.01.0.1571.0.1793.0.34.0.04.2.04.4.04.0.14.0.24.1.04.1.13.0.13.0.22.0.42.0.51.4.21.5.01.4.21.5.00.5.70.6.0Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-nodefrom 6.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
anthropics/claude-code-actionfrom 1.0.157 to 1.0.179Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
b76a077chore: bump Claude Code to 2.1.216 and Agent SDK to 0.3.216af0559echore: bump Claude Code to 2.1.215 and Agent SDK to 0.3.2153553f84chore: bump Claude Code to 2.1.214 and Agent SDK to 0.3.214700e7f8chore: bump Claude Code to 2.1.212 and Agent SDK to 0.3.2123e807ecfix: handle null comment/review author from deleted accounts (#1490)2988cbedocs: map custom_instructions to --append-system-prompt (#1480) (#1484)a1c0599fix(format): filter out thinking_tokens system messages from step summary (#1...5bfa96afix: allow leading underscore in branch names (valid per git-check-ref-format...214a706fix: map claude_args model to SDK options (#1474)5f509a1fix(sanitizer): strip alt text from reference-style markdown images (#1488)Updates
slackapi/slack-github-actionfrom 3.0.3 to 4.0.0Release notes
Sourced from slackapi/slack-github-action's releases.
Changelog
Sourced from slackapi/slack-github-action's changelog.
Commits
dcb1066chore: release53861e0chore: release (#645)b1974f0build!: parse yaml with more strict multiline indentation rules (#640)947ed06build(deps): bump undici from 7.28.0 to 8.7.0 (#653)03922a9chore: track undici-types to the resolved undici version (#652)31d473ebuild(deps-dev): bump typescript from 6.0.3 to 7.0.2 (#651)3ca6997build(deps-dev): bump sinon and@types/sinon(#649)26a5ad3build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#647)5092efbbuild(deps-dev): bump@biomejs/biomefrom 2.5.3 to 2.5.4 (#650)3548c3ebuild(deps): bump slackapi/slack-github-action from 3.0.3 to 3.0.5 (#646)Updates
docker/login-actionfrom 4.2.0 to 4.4.0Release notes
Sourced from docker/login-action's releases.
Commits
af1e73fMerge pull request #1034 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...da722bd[dependabot skip] chore: update generated content2916ad6build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...ca0a662Merge pull request #1035 from crazy-max/fix-registry-auth-empty-maskc455755chore: update generated content4835190skip empty registry-auth secret mask992421cMerge pull request #1033 from docker/dependabot/github_actions/docker/bake-ac...b249b43Merge pull request #1032 from docker/dependabot/github_actions/docker/bake-ac...1b67977build(deps): bump docker/bake-action from 7.2.0 to 7.3.09d49d6abuild(deps): bump docker/bake-action/subaction/matrixUpdates
dorny/paths-filterfrom 4.0.1 to 4.0.2Release notes
Sourced from dorny/paths-filter's releases.
Changelog
Sourced from dorny/paths-filter's changelog.
... (truncated)
Commits
7b450ffdocs: update changelog for v4.0.2 (#318)9280377fix: work around git dubious ownership errors in container jobs (#317)f3ceefdfix: use rev-parse instead of branch --show-current for older git compat (#303)61f87a1chore: fix GitHub spelling in logs (#278)b82ff81fix warning message (#282)Updates
actions/attest-build-provenancefrom 4.1.0 to 4.1.1Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)Updates
softprops/action-gh-releasefrom 3.0.1 to 3.0.2Release notes
Sourced from softprops/action-gh-release's releases.
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
3d0d988release 3.0.2 (#818)7e13ed4fix: clarify release creation 404 errors (#817)e6c70a5fix: replace existing release assets on Gitea (#816)f345337fix: publish existing draft releases as prereleases (#801)d8a89a2fix: upload small checksum assets reliably (#815)45ece40chore(deps): remove unused TypeScript tooling (#814)f6b913cfeat: improve release error reporting and test coverage (#813)15f193dchore(deps): upgrade TypeScript to 7 (#812)cc8268dchore(deps): bump actions/checkout in the github-actions group (#810)fd0ed1echore(deps): bump the npm group with 3 updates (#811)Updates
denoland/setup-denofrom 2.0.4 to 2.0.5Release notes
Sourced from denoland/setup-deno's releases.
Commits
22d081f2.0.5 (#131)28c677fchore: use versions.json from dl.deno.land (#130)ff4860f2.0.4 (#125)6a293fcfeat: upgrade Node.js runtime from node20 to node24 (#123)390061adocs: fix identifier for lat...Description has been truncated