ci(deps): update github actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v4 → v6
actions/checkout	action	major	v4.2.2 → v6.0.1
actions/create-github-app-token	action	major	v1 → v2
actions/delete-package-versions	action	major	v4 → v5
actions/download-artifact	action	major	v4.2.1 → v7.0.0
actions/setup-python	action	major	v5.2.0 → v6.1.0
actions/setup-python	action	major	v4 → v6
actions/upload-artifact	action	major	v4.6.2 → v6.0.0
google-github-actions/release-please-action	action	major	v3 → v4
stefanzweifel/git-auto-commit-action	action	major	v5 → v7

---

Release Notes

actions/checkout (actions/checkout)

v6

Compare Source

v5

Compare Source

actions/create-github-app-token (actions/create-github-app-token)

v2

Compare Source

actions/delete-package-versions (actions/delete-package-versions)

v5

Compare Source

actions/download-artifact (actions/download-artifact)

v7.0.0

Compare Source

v7 - What's new

[!IMPORTANT]
actions/download-artifact@​v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in #​440
• Download Artifact Node24 support by @​salmanmkc in #​415
• fix: update @​actions/artifact to fix Node.js 24 punycode deprecation by @​salmanmkc in #​451
• prepare release v7.0.0 for Node.js 24 support by @​salmanmkc in #​452

New Contributors

• @​patrikpolyak made their first contribution in #​440
• @​salmanmkc made their first contribution in #​415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

• Update README for download-artifact v5 changes by @​yacaovsnc in #​417
• Update README with artifact extraction details by @​yacaovsnc in #​424
• Readme: spell out the first use of GHES by @​danwkennedy in #​431
• Bump @actions/artifact to v4.0.0
• Prepare v6.0.0 by @​danwkennedy in #​438

New Contributors

• @​danwkennedy made their first contribution in #​431

Full Changelog: actions/download-artifact@v5...v6.0.0

v5.0.0

Compare Source

What's Changed

• Update README.md by @​nebuk89 in #​407
• BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @​GrantBirki in #​416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

• By name: name: my-artifact → extracted to path/ (direct)
• By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

• By name: name: my-artifact → extracted to path/ (unchanged)
• By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

• You download artifacts by name
• You download multiple artifacts by ID
• You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist

### Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

- uses: actions/download-artifact@v5
  with:
    artifact-ids: 12345
    path: dist/my-artifact  # Explicitly specify the nested path

New Contributors

• @​nebuk89 made their first contribution in #​407

Full Changelog: actions/download-artifact@v4...v5.0.0

v4.3.0

Compare Source

What's Changed

• feat: implement new artifact-ids input by @​GrantBirki in #​401
• Fix workflow example for downloading by artifact ID by @​joshmgross in #​402
• Prep for v4.3.0 release by @​robherley in #​404

New Contributors

• @​GrantBirki made their first contribution in #​401

Full Changelog: actions/download-artifact@v4.2.1...v4.3.0

actions/setup-python (actions/setup-python)

v6.1.0

Compare Source

What's Changed

Enhancements:

• Add support for pip-install input by @​gowridurgad in #​1201
• Add graalpy early-access and windows builds by @​timfel in #​880

Dependency and Documentation updates:

• Enhanced wording and updated example usage for allow-prereleases by @​yarikoptic in #​979
• Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by @​dependabot in #​1139
• Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by @​dependabot in #​1094
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by @​dependabot in #​1199
• Upgrade requests from 2.32.2 to 2.32.4 by @​dependabot in #​1130
• Upgrade prettier from 3.5.3 to 3.6.2 by @​dependabot in #​1234
• Upgrade @​types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by @​dependabot in #​1235

New Contributors

• @​yarikoptic made their first contribution in #​979

Full Changelog: actions/setup-python@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in #​1164

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

• Add support for pip-version by @​priyagupta108 in #​1129
• Enhance reading from .python-version by @​krystof-k in #​787
• Add version parsing from Pipfile by @​aradkdj in #​1067

Bug fixes:

• Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by @​aparnajyothi-y in #​1183
• Change missing cache directory error to warning by @​aparnajyothi-y in #​1182
• Add Architecture-Specific PATH Management for Python with --user Flag on Windows by @​aparnajyothi-y in #​1122
• Include python version in PyPy python-version output by @​cdce8p in #​1110
• Update docs: clarification on pip authentication with setup-python by @​priya-kinthali in #​1156

Dependency updates:

• Upgrade idna from 2.9 to 3.7 in /tests/data by @​dependabot[bot] in #​843
• Upgrade form-data to fix critical vulnerabilities #​182 & #​183 by @​aparnajyothi-y in #​1163
• Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by @​aparnajyothi-y in #​1165
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​1181
• Upgrade @​actions/tool-cache from 2.0.1 to 2.0.2 by @​dependabot[bot] in #​1095

New Contributors

• @​krystof-k made their first contribution in #​787
• @​cdce8p made their first contribution in #​1110
• @​aradkdj made their first contribution in #​1067

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

Compare Source

What's Changed

• Workflow updates related to Ubuntu 20.04 by @​aparnajyothi-y in #​1065
• Fix for Candidate Not Iterable Error by @​aparnajyothi-y in #​1082
• Upgrade semver and @​types/semver by @​dependabot in #​1091
• Upgrade prettier from 2.8.8 to 3.5.3 by @​dependabot in #​1046
• Upgrade ts-jest from 29.1.2 to 29.3.2 by @​dependabot in #​1081

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

Compare Source

What's Changed

Enhancements:

• Support free threaded Python versions like '3.13t' by @​colesbury in #​973
• Enhance Workflows: Include ubuntu-arm runners, Add e2e Testing for free threaded and Upgrade @​action/cache from 4.0.0 to 4.0.3 by @​priya-kinthali in #​1056
• Add support for .tool-versions file in setup-python by @​mahabaleshwars in #​1043

Bug fixes:

• Fix architecture for pypy on Linux ARM64 by @​mayeut in #​1011
  This update maps arm64 to aarch64 for Linux ARM64 PyPy installations.

Dependency updates:

• Upgrade @​vercel/ncc from 0.38.1 to 0.38.3 by @​dependabot in #​1016
• Upgrade @​actions/glob from 0.4.0 to 0.5.0 by @​dependabot in #​1015

New Contributors

• @​colesbury made their first contribution in #​973
• @​mahabaleshwars made their first contribution in #​1043

Full Changelog: actions/setup-python@v5...v5.5.0

v5.4.0

Compare Source

What's Changed

Enhancements:

• Update cache error message by @​aparnajyothi-y in #​968
• Enhance Workflows: Add Ubuntu-24, Remove Python 3.8 by @​priya-kinthali in #​985
• Configure Dependabot settings by @​HarithaVattikuti in #​1008

Documentation changes:

• Readme update - recommended permissions by @​benwells in #​1009
• Improve Advanced Usage examples by @​lrq3000 in #​645

Dependency updates:

• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot in #​1012
• Upgrade urllib3 from 1.25.9 to 1.26.19 in /tests/data by @​dependabot in #​895
• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot in #​1014
• Upgrade @actions/http-client from 2.2.1 to 2.2.3 by @​dependabot in #​1020
• Upgrade requests from 2.24.0 to 2.32.2 in /tests/data by @​dependabot in #​1019
• Upgrade @actions/cache to ^4.0.0 by @​priyagupta108 in #​1007

New Contributors

• @​benwells made their first contribution in #​1009
• @​HarithaVattikuti made their first contribution in #​1008
• @​lrq3000 made their first contribution in #​645

Full Changelog: actions/setup-python@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​Jcambass in #​941
• Upgrade IA publish by @​Jcambass in #​943

Bug Fixes:

• Normalise Line Endings to Ensure Cross-Platform Consistency by @​priya-kinthali in #​938
• Revise isGhes logic by @​jww3 in #​963
• Bump pillow from 7.2 to 10.2.0 by @​aparnajyothi-y in #​956

Enhancements:

• Enhance workflows and documentation updates by @​priya-kinthali in #​965
• Bump default versions to latest by @​jeffwidman in #​905

New Contributors

• @​Jcambass made their first contribution in #​941
• @​jww3 made their first contribution in #​963

Full Changelog: actions/setup-python@v5...v5.3.0

actions/upload-artifact (actions/upload-artifact)

v6.0.0

Compare Source

v5.0.0

Compare Source

google-github-actions/release-please-action (google-github-actions/release-please-action)

v4

Compare Source

⚠ BREAKING CHANGES

• remove most configuration options in favor of manifest configuration to configure the release-please-action
• rewrite in typescript
• remove command option in favor of setting release-type and skip-github-release/skip-github-pull-request
• run on node20
• deps: upgrade release-please to v16
• v4 release

Features

• deps: upgrade release-please to v16 (9cf05a0)
• remove command option in favor of setting release-type and skip-github-release/skip-github-pull-request (9cf05a0)
• remove most configuration options in favor of manifest configuration to configure the release-please-action (9cf05a0)
• run on node20 (9cf05a0)
• v4 release (9cf05a0)

Bug Fixes

• bump release-please from 16.3.0 to 16.3.1 (#​876) (c9291a9)
• restore include-component-in-tag default (false) (#​888) (19431a1)

Code Refactoring

• rewrite in typescript (9cf05a0)

stefanzweifel/git-auto-commit-action (stefanzweifel/git-auto-commit-action)

v7

Compare Source

Added

• Add skip_push input option (#​401) @​kvanzuijlen

Changes

• docs: fix typo in README.md (#​400) @​GideonBear

Dependency Updates

• Bump actions/checkout from 5 to 6 (#​399) [@​dependabot[bot]](https://github.com/@​[dependabot[bot]](https://github.com/apps/dependabot))
• Bump bats from 1.12.0 to 1.13.0 (#​398) [@​dependabot[bot]](https://github.com/@​[dependabot[bot]](https://github.com/apps/dependabot))

v6

Compare Source

Fixed

• Disable Check if Repo is in Detached State (#​379) @​stefanzweifel

---

Configuration

📅 Schedule: Branch creation - On day 1 of the month ( * * 1 * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.