Skip to content

chore(deps): bump the actions group with 7 updates - #125

Open
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/actions-fba49e2286
Open

chore(deps): bump the actions group with 7 updates#125
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/actions-fba49e2286

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the actions group with 7 updates:

Package From To
actions/setup-python 5.6.0 7.1.0
taiki-e/install-action 2.88.1 2.90.0
actions/upload-artifact 4.6.2 7.0.2
actions/download-artifact 4.3.0 8.0.2
docker/login-action 4.6.0 4.7.0
actions/attest-build-provenance 3.0.0 4.2.2
actions/attest-sbom 3.0.0 4.1.0

Updates actions/setup-python from 5.6.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

... (truncated)

Commits
  • 6d4fd22 Cache upgrade to 6.3.0 (#1370)
  • ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
  • ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
  • 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
  • 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
  • 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
  • e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
  • 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
  • af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
  • 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
  • Additional commits viewable in compare view

Updates taiki-e/install-action from 2.88.1 to 2.90.0

Release notes

Sourced from taiki-e/install-action's releases.

2.90.0

  • Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

  • Update vacuum@latest to 0.36.2.

  • Update release-plz@latest to 0.4.3.

  • Update bpf-linker@latest to 0.13.0.

2.89.1

  • Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

  • Update parse-dockerfile@latest to 0.1.9.

  • Update parse-changelog@latest to 0.6.18.

  • Update cargo-minimal-versions@latest to 0.1.38.

  • Update cargo-hack@latest to 0.6.46.

2.89.0

  • Support yq. (#2036, thanks @​FirelightFlagboy)

  • Support mold. (#2044, thanks @​FirelightFlagboy)

  • Fix an error when old cargo-binstall had already been installed at non-standard location. (#2048)

  • Update wasm-tools@latest to 1.263.0.

  • Update wasm-pack@latest to 0.15.1.

  • Update wasm-bindgen@latest to 0.2.130.

  • Update vacuum@latest to 0.36.1.

  • Update prek@latest to 0.5.9.

  • Update mise@latest to 2026.10.25.

  • Update kingfisher@latest to 2.16.0.

  • Update cargo-binstall@latest to 1.26.2.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.1] - 2026-11-04

  • Update zizmor@latest to 1.32.0.

  • Update uv@latest to 0.13.7.

  • Update typos@latest to 1.52.0.

  • Update tombi@latest to 1.9.9.

  • Update syft@latest to 1.56.0.

  • Update mise@latest to 2026.11.0.

  • Update kache@latest to 2.0.0.

  • Update cargo-nextest@latest to 0.9.151.

[2.90.0] - 2026-11-03

  • Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

  • Update vacuum@latest to 0.36.2.

  • Update release-plz@latest to 0.4.3.

  • Update bpf-linker@latest to 0.13.0.

[2.89.1] - 2026-11-02

  • Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

  • Update parse-dockerfile@latest to 0.1.9.

  • Update parse-changelog@latest to 0.6.18.

  • Update cargo-minimal-versions@latest to 0.1.38.

... (truncated)

Commits

Updates actions/upload-artifact from 4.6.2 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

... (truncated)

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

... (truncated)

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • Additional commits viewable in compare view

Updates docker/login-action from 4.6.0 to 4.7.0

Release notes

Sourced from docker/login-action's releases.

v4.7.0

Full Changelog: docker/login-action@v4.6.0...v4.7.0

Commits
  • 81c6f93 Merge pull request #1100 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • 1b16c8d Merge pull request #1096 from docker/dependabot/npm_and_yarn/uuid-14.0.3
  • ac86b5e [dependabot skip] chore: update generated content
  • 1476d84 build(deps): bump @​docker/actions-toolkit from 0.94.0 to 0.107.0
  • 503cee6 Merge pull request #1095 from docker/dependabot/github_actions/actions/create...
  • f093535 Merge pull request #1099 from docker/dependabot/github_actions/codecov/codeco...
  • d5ae7f1 Merge pull request #1098 from docker/dependabot/github_actions/docker/bake-ac...
  • 6f97507 Merge pull request #1097 from docker/dependabot/github_actions/docker/bake-ac...
  • 006d61f Merge pull request #1094 from docker/dependabot/github_actions/codeql-actions...
  • 93f5f52 Merge pull request #1093 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
  • Additional commits viewable in compare view

Updates actions/attest-build-provenance from 3.0.0 to 4.2.2

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

v4.1.1

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

v4.1.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.0.0...v4.1.0

v4.0.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

... (truncated)

Commits

Updates actions/attest-sbom from 3.0.0 to 4.1.0

Release notes

Sourced from actions/attest-sbom's releases.

v4.1.0

[!WARNING] As of version 4.0.0 this action is being deprecated in favor of actions/attest. actions/attest-sbom will continue to function as a wrapper on top of actions/attest for some period of time, but applications should make plans to migrate.

All of the existing action inputs are compatible with the actions/attest interface.

What's Changed

Full Changelog: actions/attest-sbom@v4.0.0...v4.1.0

v4.0.0

[!WARNING] As of version 4.0.0 this action is being deprecated in favor of actions/attest. actions/attest-sbom will continue to function as a wrapper on top of actions/attest for some period of time, but applications should make plans to migrate.

All of the existing action inputs are compatible with the actions/attest interface.

What's Changed

Full Changelog: actions/attest-sbom@v3...v4.0.0

Commits
  • c604332 Bump actions/attest from 4.0.0 to 4.1.0 in the actions-minor group (#255)
  • f18f83a update RELEASE.md docs (#254)
  • 07e74fc perpare v4 release (#253)
  • b74e951 Bump the actions-minor group with 2 updates (#247)
  • 7d9b9d6 Bump the npm-development group across 1 directory with 4 updates (#245)
  • 35d5f43 Bump @​actions/core from 2.0.1 to 2.0.2 in the npm-production group (#243)
  • 876bb5f Bump the actions-minor group across 1 directory with 3 updates (#246)
  • 6cf30ca Bump the npm-development group with 2 updates (#241)
  • e395115 Bump the actions-minor group with 2 updates (#239)
  • afc801d Bump the npm-development group with 3 updates (#240)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the actions group with 7 updates
3a3ec9d 
Bumps the actions group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.1.0` |
| [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.88.1` | `2.90.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.2` |
| [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `3.0.0` | `4.2.2` |
| [actions/attest-sbom](https://github.com/actions/attest-sbom) | `3.0.0` | `4.1.0` |


Updates `actions/setup-python` from 5.6.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...6d4fd22)

Updates `taiki-e/install-action` from 2.88.1 to 2.90.0
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@68a389c...b80e2bb)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...cf430e0)

Updates `actions/download-artifact` from 4.3.0 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...9000827)

Updates `docker/login-action` from 4.6.0 to 4.7.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@dbcb813...81c6f93)

Updates `actions/attest-build-provenance` from 3.0.0 to 4.2.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@977bb37...4d10147)

Updates `actions/attest-sbom` from 3.0.0 to 4.1.0
- [Release notes](https://github.com/actions/attest-sbom/releases)
- [Changelog](https://github.com/actions/attest-sbom/blob/main/RELEASE.md)
- [Commits](actions/attest-sbom@4651f80...c604332)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.90.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/login-action
  dependency-version: 4.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/attest-sbom
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from Sannrox as a code owner November 6, 2026 15:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Sannrox Sannrox Awaiting requested review from Sannrox Sannrox is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Sannrox