Skip to content

build(deps): bump the actions group across 1 directory with 7 updates - #5

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-47de980315
Open

build(deps): bump the actions group across 1 directory with 7 updates#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-47de980315

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the actions group with 7 updates in the / directory:

Package From To
actions/setup-python 6.2.0 7.0.0
actions/cache 5.0.4 6.1.0
j178/prek-action 2.0.4 3.0.0
astral-sh/setup-uv 8.1.0 10.1.0
actions/setup-node 6.3.0 7.0.0
bytecodealliance/setup-wasi-sdk-action b2de090b44eb70013ee96b393727d473b35e1728 77d09f3df1e8da344d8403cf8631af8977938b4c
actions/stale 10.2.0 11.0.0

Updates actions/setup-python from 6.2.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

Commits

Updates actions/cache from 5.0.4 to 6.1.0

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates j178/prek-action from 2.0.4 to 3.0.0

Release notes

Sourced from j178/prek-action's releases.

v3.0.0

prek-action releases are now immutable

Starting with v3, prek-action will no longer publish moving major or minor tags. References such as j178/prek-action@v3 and j178/prek-action@v3.0 will not be available.

Moving tags can be retargeted after users adopt them, creating unnecessary supply-chain risk. Use an exact release tag or, for stronger protection, pin the action to a full commit SHA.

[!TIP] Use an exact release tag:

- uses: j178/prek-action@v3.0.0

Or, even better, pin the full commit SHA:

- uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0

What's Changed

Full Changelog: j178/prek-action@v2...v3.0.0

v2.0.6

What's Changed

New Contributors

Full Changelog: j178/prek-action@v2...v2.0.6

v2.0.5

What's Changed

... (truncated)

Commits

Updates astral-sh/setup-uv from 8.1.0 to 10.1.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.1.0 🌈 New output python-runtime-idand respect NO_PROXY

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 for details on why this can be useful.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

... (truncated)

Commits

Updates actions/setup-node from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates bytecodealliance/setup-wasi-sdk-action from b2de090b44eb70013ee96b393727d473b35e1728 to 77d09f3df1e8da344d8403cf8631af8977938b4c

Changelog

Sourced from bytecodealliance/setup-wasi-sdk-action's changelog.

Releasing

Releases use immutable semantic-version tags such as v1.0.0 and a moving major-version tag such as v1. Workflows should generally use the major tag:

- uses: bytecodealliance/setup-wasi-sdk-action@v1

Security-sensitive consumers can pin the immutable version tag or its commit.

Creating a release

  1. Confirm all required checks pass on main.
  2. Open the Release workflow in GitHub Actions and select Run workflow.
  3. Enter the next version in vMAJOR.MINOR.PATCH form, such as v1.0.0.
  4. Review the generated GitHub release notes.

The workflow always releases the current main, reruns the doctests, refuses to replace an existing semantic-version tag or move a major tag backward, creates the immutable version tag, and moves the corresponding major tag to the same commit. Tag pushes are atomic, so neither tag is updated if GitHub rejects either update.

If tag creation succeeds but GitHub release creation fails, do not rerun the workflow because the immutable tag now exists. Instead, create the GitHub release for that existing tag manually with generated release notes.

GitHub Marketplace

For the first public release, a repository owner must edit the GitHub release, select Publish this Action to the GitHub Marketplace, accept the Marketplace Developer Agreement if prompted, and choose appropriate categories. This is a one-time approval in GitHub's release interface and is not exposed by the Releases API used by the workflow.

Later releases using the same major tag remain available to existing @v1 consumers automatically.

Commits
  • 77d09f3 ci: add release CI workflow and security focused workflows (#20)
  • 44f0188 chore(ci): update old actions/checkout (#21)
  • ffaf8f7 fix: filter extracted tar archives to open them more safely (#19)
  • 0f51fb9 fix: verify WASI SDK download checksums (#17)
  • d705ea1 feat: support wasi sdk release candidates (#16)
  • 67191c8 chore: add linting w/ Ruff (#18)
  • See full diff in compare view

Updates actions/stale from 10.2.0 to 11.0.0

Release notes

Sourced from actions/stale's releases.

v11.0.0

What's Changed

Enhancement

Dependency Update

Full Changelog: actions/stale@v10...v11.0.0

v10.4.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.3.0

Commits
  • 4391f3d Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...
  • eaf9131 refactor: update imports to use ES module syntax and improve test structure (...
  • 1e223db Bump undici to 6.27.0 via override, clean up stale license files, and version...
  • 9461cb1 fix: only-issue-types does not affect PRs (#1338)
  • eb5cf3a chore: upgrade dependencies and bump version to 10.3.0 (#1335)
  • db5d06a Enhancement: ignore stale labeling events (#1311)
  • See full diff in compare view

@dependabot @github

dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: skip issue, skip news. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
build(deps): bump the actions group across 1 directory with 7 updates
9f8d8a0 
Bumps the actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `7.0.0` |
| [actions/cache](https://github.com/actions/cache) | `5.0.4` | `6.1.0` |
| [j178/prek-action](https://github.com/j178/prek-action) | `2.0.4` | `3.0.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.1.0` | `10.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `7.0.0` |
| [bytecodealliance/setup-wasi-sdk-action](https://github.com/bytecodealliance/setup-wasi-sdk-action) | `b2de090b44eb70013ee96b393727d473b35e1728` | `77d09f3df1e8da344d8403cf8631af8977938b4c` |
| [actions/stale](https://github.com/actions/stale) | `10.2.0` | `11.0.0` |



Updates `actions/setup-python` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...5fda3b9)

Updates `actions/cache` from 5.0.4 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@6682284...55cc834)

Updates `j178/prek-action` from 2.0.4 to 3.0.0
- [Release notes](https://github.com/j178/prek-action/releases)
- [Commits](j178/prek-action@bdca6f1...4e14d07)

Updates `astral-sh/setup-uv` from 8.1.0 to 10.1.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...bec219d)

Updates `actions/setup-node` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...8207627)

Updates `bytecodealliance/setup-wasi-sdk-action` from b2de090b44eb70013ee96b393727d473b35e1728 to 77d09f3df1e8da344d8403cf8631af8977938b4c
- [Release notes](https://github.com/bytecodealliance/setup-wasi-sdk-action/releases)
- [Changelog](https://github.com/bytecodealliance/setup-wasi-sdk-action/blob/main/docs/releases.md)
- [Commits](bytecodealliance/setup-wasi-sdk-action@b2de090...77d09f3)

Updates `actions/stale` from 10.2.0 to 11.0.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@b5d41d4...4391f3d)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/stale
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: bytecodealliance/setup-wasi-sdk-action
  dependency-version: 77d09f3df1e8da344d8403cf8631af8977938b4c
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: j178/prek-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the actions group with 7 updates build(deps): bump the actions group across 1 directory with 7 updates Oct 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-47de980315 branch from 3d5ea3b to 9f8d8a0 Compare October 1, 2026 08:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants