chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 in the all-dependencies group

[dependabot]

Bumps the all-dependencies group with 1 update: actions/upload-artifact.

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

• Update the readme with direct upload details by @​danwkennedy in actions/upload-artifact#795
• Readme: bump all the example versions to v7 by @​danwkennedy in actions/upload-artifact#796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in actions/upload-artifact#754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in actions/upload-artifact#762
• Support direct file uploads by @​danwkennedy in actions/upload-artifact#764

New Contributors

• @​Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Upload Artifact Node 24 support by @​salmanmkc in actions/upload-artifact#719
• fix: update @​actions/artifact for Node.js 24 punycode deprecation by @​salmanmkc in actions/upload-artifact#744
• prepare release v6.0.0 for Node.js 24 support by @​salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• bbbca2d Support direct file uploads (#764)
• 589182c Upgrade the module to ESM and bump dependencies (#762)
• 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
• 02a8460 Add proxy integration test
• b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
• e516bc8 docs: correct description of Node.js 24 support in README
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c002f14d-2a64-47b0-96a2-7112fd2779b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• chore(deps): update psycopg2-binary requirement from >=2.9.12 to >=2.9.13 in /autobot-slm-backend in the all-dependencies group #16737 chore(deps): update psycopg2-binary requirement from >=2.9.12 to >=2.9.13 in /autobot-slm-backend in the all-dependencies group
• chore(deps): bump the all-dependencies group in /autobot-backend with 4 updates #16736 chore(deps): bump the all-dependencies group in /autobot-backend with 4 updates
• docs(positioning): state Why/How/What and the EU AI Act governance fit in README and Platform Model #16734 docs(positioning): state Why/How/What and the EU AI Act governance fit in README and Platform Model
• security(memory): /verbatim-memory/search and session delete are scoped to the caller (#16701) #16732 security(memory): /verbatim-memory/search and session delete are scoped to the caller (security(memory): /verbatim-memory/search returns every user's verbatim conversation chunks to any signed-in user #16701)
• security(kb): the MCP knowledge tools return non-private facts only (#16666) #16730 security(kb): the MCP knowledge tools return non-private facts only (security(kb): the raw ChromaDB explorer and the MCP knowledge tools bypass fact visibility #16666)
• fix(hooks,tests): pre-push runs changed test_*.py, and a services/ test no longer swaps the real package over the conftest stub (#16711, #16722) #16728 fix(hooks,tests): pre-push runs changed test_*.py, and a services/ test no longer swaps the real package over the conftest stub (ci(pre-push): a changed test file named test_*.py never runs in the pre-push hook #16711, sys.modules leak guard: reconciler_status_restart_delta_14465_test.py leaks 'services' into a later autobot-slm-backend/tests file #16722)
• test(settings): an anonymous caller gets 401 through the real gate (#16278) #16725 test(settings): an anonymous caller gets 401 through the real gate (security(settings): the core /api/settings routes read and write system config with no authentication #16278)
• security(kb): backfill ownerless ingested documents as SYSTEM, frozen to the facts present at deploy (#16693) #16723 security(kb): backfill ownerless ingested documents as SYSTEM, frozen to the facts present at deploy (security(kb): backfill facts with no owner or visibility as SYSTEM before chat grounding is scoped #16693)
• fix(ansible): venvs create with python -m venv, chdir their relative editables, single-source two venvs #16721 fix(ansible): venvs create with python -m venv, chdir their relative editables, single-source two venvs
• fix(kb): six callers and a doc pass get_fact(query=...) to a synchronous get_fact(fact_id) (#16710) #16719 fix(kb): six callers and a doc pass get_fact(query=...) to a synchronous get_fact(fact_id) (bug(kb): six callers and a doc pass get_fact(query=...) to a synchronous get_fact(fact_id) #16710)
• security(kb): ai-stack and RAG search routes filter results by the caller's access (#16665, PR 3/3 partial) #16716 security(kb): ai-stack and RAG search routes filter results by the caller's access (security(kb): the knowledge search and RAG routes filter results by the caller's access #16665, PR 3/3 partial)
• security(kb): scope knowledge-CRUD category counts and confirm admin-gated routes carry no T3 gap (#16665, PR 2/3) #16706 security(kb): scope knowledge-CRUD category counts and confirm admin-gated routes carry no T3 gap (security(kb): the knowledge search and RAG routes filter results by the caller's access #16665, PR 2/3)
• fix(kb): ID lists read back as lists, explicit read APIs pass the admin input, MCP add refuses non-admin platform-wide reach, and fact store/delete survive a missing ownership manager (#16662, #16663, #16685) #16705 fix(kb): ID lists read back as lists, explicit read APIs pass the admin input, MCP add refuses non-admin platform-wide reach, and fact store/delete survive a missing ownership manager (security(kb): the ownership helpers fail open and misread shared and group facts #16662, security(kb): only admins may make a fact platform-wide, and visibility writes keep the indexes current #16663, bug(kb): hasattr(self, "ownership_manager") is always true, so a missing ownership manager crashes fact store and delete #16685)
• test(kb): the read guard ratchets against detected reads and sees raw ChromaDB reads on KB content (#16667, #16666 part 3) #16703 test(kb): the read guard ratchets against detected reads and sees raw ChromaDB reads on KB content (test(kb): a shrink-only guard over every knowledge-base read entry point #16667, security(kb): the raw ChromaDB explorer and the MCP knowledge tools bypass fact visibility #16666 part 3)
• batch(2d): combine 14 reviewed members into one vehicle #16702 batch(2d): combine 14 reviewed members into one vehicle
• security(redis): every Ansible-rendered client pairs its Redis password with a username; deploy scripts drop the hardcoded password (#16678, #16686) #16700 security(redis): every Ansible-rendered client pairs its Redis password with a username; deploy scripts drop the hardcoded password (security(redis): the ai-stack env and deploy playbooks send a Redis password without a username #16678, security(redis): deploy-hybrid.sh and deploy-native.sh write a hardcoded Redis password into the generated env file #16686)
• fix(knowledge-ui): move Watch Folders under Knowledge → Manage and fix its form styling (#16695) #16696 fix(knowledge-ui): move Watch Folders under Knowledge → Manage and fix its form styling (fix(knowledge-ui): watch folders belongs under Knowledge → Manage; the Add watch folder form styling is broken #16695)
• security(kb): the canonical search and multi-source routes filter results by the caller's access (#16665) [1/3] #16691 security(kb): the canonical search and multi-source routes filter results by the caller's access (security(kb): the knowledge search and RAG routes filter results by the caller's access #16665) [1/3]
• security(kb): the raw ChromaDB explorer is admin-only (#16666, part 1) #16689 security(kb): the raw ChromaDB explorer is admin-only (security(kb): the raw ChromaDB explorer and the MCP knowledge tools bypass fact visibility #16666, part 1)
• chore(deps): bump the all-dependencies group across 1 directory with 6 updates #16645 chore(deps): bump the all-dependencies group across 1 directory with 6 updates
• feat(knowledge): import Claude Code auto-memory into knowledge_facts (#16642) #16643 feat(knowledge): import Claude Code auto-memory into knowledge_facts (feat(memory): import Claude Code auto-memory into AutoBot knowledge base #16642)
• chore(deps): bump the all-dependencies group across 1 directory with 12 updates #16611 chore(deps): bump the all-dependencies group across 1 directory with 12 updates
• chore(deps): bump the uv group across 1 directory with 2 updates #16597 chore(deps): bump the uv group across 1 directory with 2 updates
• chore(deps): dependabot train — 10 members onto current main [no-merge] #16591 chore(deps): dependabot train — 10 members onto current main [no-merge]
• feat(llm): wire extractive prompt compression and enforce per-provider concurrency cap (#16526, #16527) #16546 feat(llm): wire extractive prompt compression and enforce per-provider concurrency cap (Wire the existing extractive prompt compressor into the live LLM completion path #16526, Enforce the existing per-provider LLM concurrency cap #16527)
• fix(infra): consolidate the last 3 private TLS-cert-generation copies (#16020) #16522 fix(infra): consolidate the last 3 private TLS-cert-generation copies (nginx cannot start on a node with no TLS cert: five roles consume the shared keypair, four provision it #16020)
• fix(frontend): retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (#16481) #16484 fix(frontend): retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (retire useSettingsApi/SystemRepository/services-api.ts/CacheService.ts dead settings paths #16481)
• feat(llm): cross-worker quota headroom store, persist real 429 headroom #16483 feat(llm): cross-worker quota headroom store, persist real 429 headroom
• chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates #16474 chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[github-actions]

Retargeted to main (main-first flow, #11696). Dependabot security updates always open against the default branch; this workflow re-applies the retarget after every Dependabot push, so rebases cannot revert it.