Skip to content

chore(deps): bump the actions group across 1 directory with 7 updates - #921

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-3b7b77b27f
Closed

chore(deps): bump the actions group across 1 directory with 7 updates#921
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-3b7b77b27f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 7 updates in the / directory:

Package From To
actions/checkout 6.0.2 7.0.0
gitleaks/gitleaks-action 2.3.9 3.0.0
actions/cache 5.0.5 6.0.0
petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml 1 2
petry-projects/.github/.github/workflows/dependency-audit-reusable.yml 1 2
anthropics/claude-code-action 1.0.148 1.0.157
actions/setup-java 5.2.0 5.3.0

Updates actions/checkout from 6.0.2 to 7.0.0

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates gitleaks/gitleaks-action from 2.3.9 to 3.0.0

Release notes

Sourced from gitleaks/gitleaks-action's releases.

v3.0.0

What's changed

gitleaks-action v3 migrates the runtime from Node 20 to Node 24. No changes to inputs, outputs, or behavior. Update your workflow from gitleaks/gitleaks-action@v2 to gitleaks/gitleaks-action@v3.

Migration

# Before
- uses: gitleaks/gitleaks-action@v2
After

uses: gitleaks/gitleaks-action@v3

Why

GitHub is deprecating the Node 20 runtime for Actions:

  • June 2, 2026: GitHub flips the runner default to Node 24. Workflows using gitleaks-action@v2 (Node 20) will still run, but only if ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true is set as an environment variable.
  • September 16, 2026: Node 20 is removed from GitHub-hosted runners entirely. gitleaks-action@v2 stops working regardless of any opt-out flag.

Changes

  • action.yml: runtime node20node24
  • @actions/core: 1.10.0 → 1.11.1
  • dist/ rebuilt
  • Example workflows updated to actions/checkout@v6 and gitleaks-action@v3
  • README updated with v3 migration guide

Self-hosted runners

If you use self-hosted runners, ensure your runner version is >= v2.327.1 (required for Node 24 support).

Commits

Updates actions/cache from 5.0.5 to 6.0.0

Release notes

Sourced from actions/cache's releases.

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits

Updates petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml from 1 to 2

Commits
  • 376a4fc feat: auto-trigger PR review when all readiness criteria are met (#323)
  • 6306793 feat(concurrency): add per-repo serialized concurrency to dev-lead stubs (#322)
  • 0765a60 fix(compliance): track per-workflow version tags in stub checker (#302)
  • 66c4866 chore: remove claude-code-reusable.yml and update auto-rebase references
  • f666f32 Merge pull request #320 from petry-projects/feat/harden-scorecard-workflow
  • 9c9cdd3 feat: harden scorecard workflow to report malformed YAML as findings
  • f88d254 Merge pull request #319 from petry-projects/fix/scorecard-summary-score
  • 57c1c5e fix: update aggregate score extraction key for scorecard v5.5.0
  • 6fd676b Merge pull request #312 from petry-projects/fix/scorecard-workflow-v2
  • b1b947e fix: resolve jq parse error by iterating with index
  • Additional commits viewable in compare view

Updates petry-projects/.github/.github/workflows/dependency-audit-reusable.yml from 1 to 2

Commits
  • 376a4fc feat: auto-trigger PR review when all readiness criteria are met (#323)
  • 6306793 feat(concurrency): add per-repo serialized concurrency to dev-lead stubs (#322)
  • 0765a60 fix(compliance): track per-workflow version tags in stub checker (#302)
  • 66c4866 chore: remove claude-code-reusable.yml and update auto-rebase references
  • f666f32 Merge pull request #320 from petry-projects/feat/harden-scorecard-workflow
  • 9c9cdd3 feat: harden scorecard workflow to report malformed YAML as findings
  • f88d254 Merge pull request #319 from petry-projects/fix/scorecard-summary-score
  • 57c1c5e fix: update aggregate score extraction key for scorecard v5.5.0
  • 6fd676b Merge pull request #312 from petry-projects/fix/scorecard-workflow-v2
  • b1b947e fix: resolve jq parse error by iterating with index
  • Additional commits viewable in compare view

Updates anthropics/claude-code-action from 1.0.148 to 1.0.157

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.157

Full Changelog: anthropics/claude-code-action@v1...v1.0.157

v1.0.156

Full Changelog: anthropics/claude-code-action@v1...v1.0.156

v1.0.155

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.155

v1.0.154

Full Changelog: anthropics/claude-code-action@v1...v1.0.154

v1.0.153

Full Changelog: anthropics/claude-code-action@v1...v1.0.153

v1.0.152

Full Changelog: anthropics/claude-code-action@v1...v1.0.152

v1.0.151

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.151

v1.0.150

Full Changelog: anthropics/claude-code-action@v1...v1.0.150

v1.0.149

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.149

Commits
  • 428971d chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191
  • 74eedf1 chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190
  • 80b3182 chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187
  • 360be9c fix: allow @ in branch names (valid per git-check-ref-format) (#1411)
  • e452eb9 test: cover format-turns content-type fallbacks and system_other handling (#1...
  • 6b80630 fix: filter PR reviews and inline review comments to trigger time (#1385)
  • 30544b6 chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186
  • 2fee155 chore: bump Claude Code to 2.1.185 and Agent SDK to 0.3.185
  • 51705da chore: bump Claude Code to 2.1.183 and Agent SDK to 0.3.183
  • 806af32 chore: bump Claude Code to 2.1.181 and Agent SDK to 0.3.181
  • Additional commits viewable in compare view

Updates actions/setup-java from 5.2.0 to 5.3.0

Release notes

Sourced from actions/setup-java's releases.

v5.3.0

What's Changed

New Contributors

Full Changelog: actions/setup-java@v5...v5.3.0

Commits
  • ad2b381 Bump @​vercel/ncc from 0.38.1 to 0.44.0 (#1018)
  • b24df5b Make the Adoptopenjdk package type look at the Temurin repo first for latest ...
  • 43120bc Implement pagination with link headers for Adoptium based apis (#1014)
  • ad9d6a6 Bump @​types/node from 24.1.0 to 25.9.3 (#950)
  • 039af37 Bump picomatch, @​types/jest, jest, jest-circus and ts-jest (#1016)
  • 1756ab6 Bump eslint-config-prettier from 8.10.0 to 10.1.8 (#881)
  • 662bb59 Bump @​typescript-eslint/eslint-plugin from 8.35.1 to 8.46.2 (#952)
  • 1071fc1 fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parse...
  • 576b821 Merge pull request #674 from gdams/alpine
  • 307d3a2 update readme for ubuntu sudo java_home behavior (#1013)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` |
| [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2.3.9` | `3.0.0` |
| [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.0.0` |
| [petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml](https://github.com/petry-projects/.github) | `1` | `2` |
| [petry-projects/.github/.github/workflows/dependency-audit-reusable.yml](https://github.com/petry-projects/.github) | `1` | `2` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.148` | `1.0.157` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.3.0` |



Updates `actions/checkout` from 6.0.2 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6.0.2...9c091bb)

Updates `gitleaks/gitleaks-action` from 2.3.9 to 3.0.0
- [Release notes](https://github.com/gitleaks/gitleaks-action/releases)
- [Commits](gitleaks/gitleaks-action@ff98106...e0c47f4)

Updates `actions/cache` from 5.0.5 to 6.0.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@27d5ce7...2c8a9bd)

Updates `petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml` from 1 to 2
- [Commits](petry-projects/.github@v1...v2)

Updates `petry-projects/.github/.github/workflows/dependency-audit-reusable.yml` from 1 to 2
- [Commits](petry-projects/.github@v1...v2)

Updates `anthropics/claude-code-action` from 1.0.148 to 1.0.157
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@d5726de...428971d)

Updates `actions/setup-java` from 5.2.0 to 5.3.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@be666c2...ad2b381)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: gitleaks/gitleaks-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.157
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/setup-java
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency update PRs security Security-related PRs and issues labels Jun 25, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner June 25, 2026 02:49
@dependabot dependabot Bot added security Security-related PRs and issues dependencies Dependency update PRs labels Jun 25, 2026
@petry-projects-dependabot-automrg
petry-projects-dependabot-automrg Bot enabled auto-merge (squash) June 25, 2026 02:49
@dependabot @github

dependabot Bot commented on behalf of github Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 25, 2026
auto-merge was automatically disabled June 25, 2026 03:27

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-3b7b77b27f branch June 25, 2026 03:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency update PRs security Security-related PRs and issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants