Skip to content

chore(deps): bump the actions group with 21 updates - #164

Merged
hyperpolymath merged 2 commits into
mainfrom
dependabot/github_actions/actions-300112a1e8
Oct 23, 2026
Merged

chore(deps): bump the actions group with 21 updates#164
hyperpolymath merged 2 commits into
mainfrom
dependabot/github_actions/actions-300112a1e8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 21 updates:

Package From To
actions/checkout 4.1.1 7.0.1
haskell-actions/setup 2.7.5 2.12.1
actions/cache 4.3.0 6.1.0
actions/configure-pages 5.0.0 6.0.0
actions/upload-pages-artifact 3.0.1 5.0.0
actions/deploy-pages 4.0.5 5.0.1
github/codeql-action/init 4.37.9 4.39.0
github/codeql-action/analyze 4.37.9 4.39.0
dependabot/fetch-metadata 2.2.0 3.1.0
slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml 1.4.0 2.1.0
peter-evans/repository-dispatch 3.0.0 4.0.1
KSXGitHub/github-actions-deploy-aur 3.0.1 4.2.0
docker/login-action 3.3.0 4.6.0
docker/metadata-action 5.5.1 6.2.0
docker/build-push-action 6.9.0 7.4.0
actions/attest-build-provenance 2.4.0 4.2.2
actions/upload-artifact 4.6.2 7.0.2
actions/download-artifact 4.1.8 8.0.2
softprops/action-gh-release 2.2.1 3.0.3
actions/setup-node 4.0.2 7.1.0
denoland/setup-deno 1.5.2 2.0.5

Updates actions/checkout from 4.1.1 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Commits

Updates haskell-actions/setup from 2.7.5 to 2.12.1

Release notes

Sourced from haskell-actions/setup's releases.

v2.12.1

Add Cabal 3.18.1.0 and Stack 3.11.1

What's Changed

Full Changelog: haskell-actions/setup@v2.12.0...v2.12.1

v2.11.0

GHC: try ghcup first, choco only as fallback

What's Changed

Full Changelog: haskell-actions/setup@v2.10.3...v2.11.0

v2.10.4

Add GHC 9.12.4 and Stack 3.9.3

What's Changed

Full Changelog: haskell-actions/setup@v2.10.3...v2.10.4

v2.10.3

Add Stack 3.9.1

What's Changed

Full Changelog: haskell-actions/setup@v2.10.2...v2.10.3

... (truncated)

Commits
  • 0f8e8c9 Add Cabal 3.18.1.0 and Stack 3.11.1
  • 6037f33 fix: parseYAMLBoolean for enable-stack/stack-no-global/stack-setup-ghc/disabl...
  • d07e232 fix: bump bundled ghcup from 0.1.50.2 to 0.2.6.2
  • 5873697 Bump actions/setup-node from 6 to 7
  • 482af4f Bump actions/checkout from 6 to 7
  • cd0d9bd GHC: try ghcup first, choco only as fallback
  • 4568e64 Bump softprops/action-gh-release from 2 to 3
  • de26526 Add GHC 9.12.4 and Stack 3.9.3
  • f9150cb Add Stack 3.9.1
  • dc63c94 Remove GHCup vanilla channel from defaults
  • Additional commits viewable in compare view

Updates actions/cache from 4.3.0 to 6.1.0

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/configure-pages from 5.0.0 to 6.0.0

Release notes

Sourced from actions/configure-pages's releases.

v6.0.0

Changelog

See details of all code changes since previous release.

Commits
  • 45bfe01 Merge pull request #186 from salmanmkc/node24
  • d8770c2 Update Node version from 20 to 24 in action.yml
  • cb8a1a3 upgrade to node 24
  • d560657 Merge pull request #165 from actions/Jcambass-patch-1
  • 35e0ac4 Upgrade IA Publish
  • 1dfbcbf Merge pull request #163 from actions/Jcambass-patch-1
  • 2f4f988 Add workflow file for publishing releases to immutable action package
  • 0d7570c Merge pull request #162 from actions/pin-draft-release-verssion
  • 3ea1966 pin draft release version
  • aabcbc4 Merge pull request #160 from actions/dependabot/npm_and_yarn/espree-10.1.0
  • Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 3.0.1 to 5.0.0

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

See details of all code changes since previous release.

v4.0.0

What's Changed

Full Changelog: actions/upload-pages-artifact@v3.0.1...v4.0.0

Commits
  • fc324d3 Merge pull request #139 from Tom-van-Woudenberg/patch-1
  • fe9d4b7 Merge branch 'main' into patch-1
  • 0ca1617 Merge pull request #137 from jonchurch/include-hidden-files
  • 57f0e84 Update action.yml
  • 4a90348 v7 --> hash
  • 56f665a Update upload-artifact action to version 7
  • f7615f5 Add include-hidden-files input
  • 7b1f4a7 Merge pull request #127 from heavymachinery/pin-sha
  • 4cc19c7 Pin actions/upload-artifact to SHA
  • 2d163be Merge pull request #107 from KittyChiu/main
  • Additional commits viewable in compare view

Updates actions/deploy-pages from 4.0.5 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

v5.0.0

Changelog

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits
  • 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
  • 7e97763 Validate deployment polling intervals
  • 0143e11 Add backoff and jitter to deployment polling
  • 5e98f10 Merge pull request #440 from actions/user/adwitiya
  • 8b0625a Improve deployment request test coverage
  • cd2ce8f Merge pull request #404 from salmanmkc/node24
  • bbe2a95 Update Node.js version to 24.x
  • 854d7aa Merge pull request #374 from actions/Jcambass-patch-1
  • 306bb81 Add workflow file for publishing releases to immutable action package
  • b742728 Merge pull request #360 from actions/dependabot/npm_and_yarn/npm_and_yarn-513...
  • Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.9 to 4.39.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

  • Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits
  • 6f2ac81 Merge pull request #4239 from github/update-v4.39.0-d63383a73
  • eb1c428 Trigger workflows
  • 4443333 Update changelog for v4.39.0
  • d63383a Merge pull request #4233 from github/mbg/start-proxy/report-version
  • 8dec0b9 Rename path to result in tests
  • 4eabea6 Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version
  • 57938b8 Merge pull request #4201 from github/mario-campos/automate-changenotes-assemble
  • ee07b50 Merge pull request #4236 from github/mbg/add-missing-changenotes
  • a897ed5 Add change note for #4206
  • c8bd019 Add change note for #4198
  • Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.39.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

  • Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits
  • 6f2ac81 Merge pull request #4239 from github/update-v4.39.0-d63383a73
  • eb1c428 Trigger workflows
  • 4443333 Update changelog for v4.39.0
  • d63383a Merge pull request #4233 from github/mbg/start-proxy/report-version
  • 8dec0b9 Rename path to result in tests
  • 4eabea6 Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version
  • 57938b8 Merge pull request #4201 from github/mario-campos/automate-changenotes-assemble
  • ee07b50 Merge pull request #4236 from github/mbg/add-missing-changenotes
  • a897ed5 Add change note for #4206
  • c8bd019 Add change note for #4198
  • Additional commits viewable in compare view

Updates dependabot/fetch-metadata from 2.2.0 to 3.1.0

Release notes

Sourced from dependabot/fetch-metadata's releases.

v3.1.0

What's Changed

@dependabot
chore(deps): bump the actions group with 21 updates
80a1fad 
Bumps the actions group with 21 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.1.1` | `7.0.1` |
| [haskell-actions/setup](https://github.com/haskell-actions/setup) | `2.7.5` | `2.12.1` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` |
| [actions/configure-pages](https://github.com/actions/configure-pages) | `5.0.0` | `6.0.0` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3.0.1` | `5.0.0` |
| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4.0.5` | `5.0.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.39.0` |
| [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `2.2.0` | `3.1.0` |
| [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator) | `1.4.0` | `2.1.0` |
| [peter-evans/repository-dispatch](https://github.com/peter-evans/repository-dispatch) | `3.0.0` | `4.0.1` |
| [KSXGitHub/github-actions-deploy-aur](https://github.com/ksxgithub/github-actions-deploy-aur) | `3.0.1` | `4.2.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.3.0` | `4.6.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.5.1` | `6.2.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.9.0` | `7.4.0` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.4.0` | `4.2.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.8` | `8.0.2` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.2.1` | `3.0.3` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4.0.2` | `7.1.0` |
| [denoland/setup-deno](https://github.com/denoland/setup-deno) | `1.5.2` | `2.0.5` |


Updates `actions/checkout` from 4.1.1 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4.1.1...v7.0.1)

Updates `haskell-actions/setup` from 2.7.5 to 2.12.1
- [Release notes](https://github.com/haskell-actions/setup/releases)
- [Commits](haskell-actions/setup@v2.7.5...v2.12.1)

Updates `actions/cache` from 4.3.0 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4.3.0...v6.1.0)

Updates `actions/configure-pages` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/actions/configure-pages/releases)
- [Commits](actions/configure-pages@v5.0.0...v6.0.0)

Updates `actions/upload-pages-artifact` from 3.0.1 to 5.0.0
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@v3.0.1...v5.0.0)

Updates `actions/deploy-pages` from 4.0.5 to 5.0.1
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@v4.0.5...v5.0.1)

Updates `github/codeql-action/init` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `dependabot/fetch-metadata` from 2.2.0 to 3.1.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@v2.2.0...v3.1.0)

Updates `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml` from 1.4.0 to 2.1.0
- [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases)
- [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md)
- [Commits](slsa-framework/slsa-github-generator@68bad40...f7dd8c5)

Updates `peter-evans/repository-dispatch` from 3.0.0 to 4.0.1
- [Release notes](https://github.com/peter-evans/repository-dispatch/releases)
- [Commits](peter-evans/repository-dispatch@v3.0.0...v4.0.1)

Updates `KSXGitHub/github-actions-deploy-aur` from 3.0.1 to 4.2.0
- [Release notes](https://github.com/ksxgithub/github-actions-deploy-aur/releases)
- [Commits](KSXGitHub/github-actions-deploy-aur@v3.0.1...v4.2.0)

Updates `docker/login-action` from 3.3.0 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3.3.0...v4.6.0)

Updates `docker/metadata-action` from 5.5.1 to 6.2.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@v5.5.1...v6.2.0)

Updates `docker/build-push-action` from 6.9.0 to 7.4.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v6.9.0...v7.4.0)

Updates `actions/attest-build-provenance` from 2.4.0 to 4.2.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@v2.4.0...v4.2.2)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4.6.2...v7.0.2)

Updates `actions/download-artifact` from 4.1.8 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4.1.8...v8.0.2)

Updates `softprops/action-gh-release` from 2.2.1 to 3.0.3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2.2.1...v3.0.3)

Updates `actions/setup-node` from 4.0.2 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4.0.2...v7.1.0)

Updates `denoland/setup-deno` from 1.5.2 to 2.0.5
- [Release notes](https://github.com/denoland/setup-deno/releases)
- [Commits](denoland/setup-deno@v1.5.2...v2.0.5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: haskell-actions/setup
  dependency-version: 2.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/configure-pages
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/deploy-pages
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: peter-evans/repository-dispatch
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: KSXGitHub/github-actions-deploy-aur
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/login-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/metadata-action
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/build-push-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: denoland/setup-deno
  dependency-version: 2.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 23, 2026
@dependabot
dependabot Bot requested a review from hyperpolymath as a code owner October 23, 2026 17:51
@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 074f2925-4e83-4ede-8c84-7906dfe161f4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-23T17:54:09.694933Z 80a1fad PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@hyperpolymath
hyperpolymath merged commit 11bed2d into main Oct 23, 2026
16 of 38 checks passed
@hyperpolymath
hyperpolymath deleted the dependabot/github_actions/actions-300112a1e8 branch October 23, 2026 17:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hyperpolymath hyperpolymath hyperpolymath approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath