chore(deps): Bump softprops/action-gh-release from 2.6.1 to 3.0.0 by dependabot[bot] · Pull Request #467 · nullvariant/nullvariant-vscode-extensions

dependabot · 2026-04-13T06:54:39Z

Bumps softprops/action-gh-release from 2.6.1 to 3.0.0.

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

Move the action runtime and bundle target to Node 24

Update @types/node to the Node 24 line and allow future Dependabot updates

Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in softprops/action-gh-release#775

chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by @dependabot[bot] in softprops/action-gh-release#777

chore(deps): bump vite from 8.0.0 to 8.0.5 by @dependabot[bot] in softprops/action-gh-release#781

Full Changelog: softprops/action-gh-release@v2...v2.6.2

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

Move the action runtime and bundle target to Node 24

Update @types/node to the Node 24 line and allow future Dependabot updates

Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

2.6.2

What's Changed

Other Changes 🔄

chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in softprops/action-gh-release#775

chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by @dependabot[bot] in softprops/action-gh-release#777

chore(deps): bump vite from 8.0.0 to 8.0.5 by @dependabot[bot] in softprops/action-gh-release#781

2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

fix: preserve discussion category on publish by @chenrui333 in softprops/action-gh-release#765

2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Commits

b430933 release: cut v3.0.0 for Node 24 upgrade (#670)
c2e35e0 chore(deps): bump the npm group across 1 directory with 7 updates (#783)
3bb1273 release 2.6.2
c34030f chore: bump node to 24.14.1
8975bd0 chore(deps): bump vite from 8.0.0 to 8.0.5 (#781)
f71937f chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 (#777)
3f0d239 chore(deps): bump picomatch from 4.0.3 to 4.0.4 (#775)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.1 to 3.0.0. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@153bb8e...b430933) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-13T06:54:40Z

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-04-13T06:55:20Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 8a39fb9.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package

Version

Score

Details

actions/softprops/action-gh-release

b4309332981a82ec1c5618f44dd2e27cc8bfbfda

🟢 4.5

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

.github/workflows/publish.yml

github-actions · 2026-04-13T06:55:24Z

VEX Assessment: `not_affected`

This dependency update modifies devDependencies only.

Status: not_affected
Justification: vulnerable_code_not_in_execute_path
Impact: Zero production dependencies. No third-party code is included in the published VSIX.

Any CVEs in updated devDependencies do not affect end users. The VEX document will be automatically updated by the weekly VEX Auto-Update workflow.

🤖 Automated VEX assessment

nullvariant-mimi · 2026-04-13T06:55:40Z

🐰 Mimi's Validation Report ✅

All checks are looking good! Great job! 🎉

⏳ Some checks are still running. I will keep watching!

バリデーターを通してくださいね

This report was carefully prepared by nullvariant-mimi[bot]

codecov · 2026-04-13T06:56:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

nullvariant-ciel · 2026-04-13T06:56:28Z

🕊️ Ciel's Mediation 💤

*~~ drifting lazily through still air ~~ The zoo is napping today...*

1 zoo member has reviewed this PR.

Zoo Member	Status
🐰 Mimi	Commented

😴 A quiet day at the zoo. Only one member peeked at this PR.

まあまあ、ほどほどに。

This mediation was peacefully delivered by nullvariant-ciel[bot]

…h-release-3.0.0

nullvariant-justice

⚖️ Justice grants passage. CI checks passed — this code meets the garden's standards.

…h-release-3.0.0

sonarqubecloud · 2026-04-13T11:25:08Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot added the dependencies Pull requests that update a dependency file label Apr 13, 2026

Merge branch 'main' into dependabot/github_actions/softprops/action-g…

2ca372d

…h-release-3.0.0

nullvariant-justice Bot approved these changes Apr 13, 2026

View reviewed changes

nullvariant added 2 commits April 13, 2026 20:20

Merge branch 'main' into dependabot/github_actions/softprops/action-g…

0e7f319

…h-release-3.0.0

Merge branch 'main' into dependabot/github_actions/softprops/action-g…

8a39fb9

…h-release-3.0.0

nullvariant merged commit 0b29367 into main Apr 13, 2026
38 of 41 checks passed

nullvariant deleted the dependabot/github_actions/softprops/action-gh-release-3.0.0 branch April 13, 2026 11:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): Bump softprops/action-gh-release from 2.6.1 to 3.0.0#467

chore(deps): Bump softprops/action-gh-release from 2.6.1 to 3.0.0#467
nullvariant merged 4 commits into
mainfrom
dependabot/github_actions/softprops/action-gh-release-3.0.0

dependabot Bot commented on behalf of github Apr 13, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 13, 2026

Uh oh!

github-actions Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 13, 2026

Uh oh!

nullvariant-mimi Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Apr 13, 2026

Uh oh!

nullvariant-ciel Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

nullvariant-justice Bot left a comment

Uh oh!

sonarqubecloud Bot commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 13, 2026

v3.0.0

What's Changed

Other Changes 🔄

v2.6.2

What's Changed

Other Changes 🔄

3.0.0

What's Changed

Other Changes 🔄

2.6.2

What's Changed

Other Changes 🔄

2.6.1

What's Changed

Bug fixes 🐛

2.6.0

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Apr 13, 2026

Labels

Uh oh!

github-actions Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Snapshot Warnings

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions Bot commented Apr 13, 2026

VEX Assessment: not_affected

Uh oh!

nullvariant-mimi Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🐰 Mimi's Validation Report ✅

Uh oh!

codecov Bot commented Apr 13, 2026

Codecov Report

Uh oh!

nullvariant-ciel Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🕊️ Ciel's Mediation 💤

Uh oh!

nullvariant-justice Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Apr 13, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Apr 13, 2026 •

edited

Loading

VEX Assessment: `not_affected`

nullvariant-mimi Bot commented Apr 13, 2026 •

edited

Loading

nullvariant-ciel Bot commented Apr 13, 2026 •

edited

Loading