Skip to content

Bump the github-actions group across 1 directory with 5 updates - #53

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-521b172f40
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-521b172f40

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 5 updates in the / directory:

Package From To
actions/checkout 7.0.0 7.0.1
actions/setup-node 6.4.0 7.0.0
oven-sh/setup-bun 2.1.2 2.2.0
astral-sh/setup-uv 8.2.0 10.0.0
leynos/shared-actions/.github/workflows/dependabot-automerge.yml e0d9b652b137eb15314fff188f09e1ba18d3cc5b 57a33fa65e329db7edc81ece661f1a2e1d39868f

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates oven-sh/setup-bun from 2.1.2 to 2.2.0

Release notes

Sourced from oven-sh/setup-bun's releases.

v2.2.0

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

New Contributors

Full Changelog: oven-sh/setup-bun@v2...v2.2.0

v2.1.3

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

New Contributors

Full Changelog: oven-sh/setup-bun@v2...v2.1.3

Commits
  • 0c5077e release: v2.2.0 (#177)
  • 1255e43 ci: update actions for the Release new action version workflow (#175)
  • 61861d1 ci: update actions for the autofix.ci workflow (#174)
  • 6f5bd06 ci: use actions/checkout@v6.0.2 in the test workflow (#173)
  • e391475 build: update action runtime to Node.js 24 (#176)
  • ecf28dd release: v2.1.3 (#170)
  • 95edc15 fix: validate cached binary version matches requested version (#146) (#169)
  • 4c32875 feat: add AVX2 support detection for x64 Linux systems (#167)
  • 0ff83bf fix: use native Windows ARM64 binary for Bun >= 1.3.10 (#165)
  • ab8cb4e feat: add bun- prefix to cache keys (#160)
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 8.2.0 to 10.0.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

🐛 Bug fixes

🚀 Enhancements

... (truncated)

Commits

Updates leynos/shared-actions/.github/workflows/dependabot-automerge.yml from e0d9b652b137eb15314fff188f09e1ba18d3cc5b to 57a33fa65e329db7edc81ece661f1a2e1d39868f

Commits
  • 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
  • 7576833 chore: ignore agent tool and editor artefacts
  • 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
  • 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
  • 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
  • 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
  • 19a7f5d Group github-actions Dependabot updates into a single PR
  • 36eb051 Document Python docstring conventions (#392)
  • dca6131 Teach PEP 735 development dependency groups
  • 6b9dc1b Format Markdown sources
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @dependabot[bot], you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

Bumps the github-actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` |
| [oven-sh/setup-bun](https://github.com/oven-sh/setup-bun) | `2.1.2` | `2.2.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.2.0` | `10.0.0` |
| [leynos/shared-actions/.github/workflows/dependabot-automerge.yml](https://github.com/leynos/shared-actions) | `e0d9b652b137eb15314fff188f09e1ba18d3cc5b` | `57a33fa65e329db7edc81ece661f1a2e1d39868f` |



Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@48b55a0...8207627)

Updates `oven-sh/setup-bun` from 2.1.2 to 2.2.0
- [Release notes](https://github.com/oven-sh/setup-bun/releases)
- [Commits](oven-sh/setup-bun@3d26778...0c5077e)

Updates `astral-sh/setup-uv` from 8.2.0 to 10.0.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@fac544c...ae62891)

Updates `leynos/shared-actions/.github/workflows/dependabot-automerge.yml` from e0d9b652b137eb15314fff188f09e1ba18d3cc5b to 57a33fa65e329db7edc81ece661f1a2e1d39868f
- [Release notes](https://github.com/leynos/shared-actions/releases)
- [Commits](leynos/shared-actions@e0d9b65...57a33fa)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: leynos/shared-actions/.github/workflows/dependabot-automerge.yml
  dependency-version: 19a7f5d1b8d5c1b2236c39720a5744492b3fc129
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: oven-sh/setup-bun
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the github-actions group with 5 updates Bump the github-actions group across 1 directory with 5 updates Aug 20, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-521b172f40 branch from 1b3053b to cbde4af Compare August 20, 2026 09:44
@leynos

leynos commented Sep 8, 2026

Copy link
Copy Markdown
Owner

Superseded by #58, which moves every shared-actions pin to 6b5cdc2d4c0bb72cafd5a66d24d248ac25827db9; this bump targets an older SHA and would revert it. Dependabot will re-raise if anything newer exists.

@leynos leynos closed this Sep 8, 2026
auto-merge was automatically disabled September 8, 2026 10:19

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-521b172f40 branch September 8, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant