Skip to content

chore(deps): bump the actions-version group across 1 directory with 3 updates - #525

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-version-195c220e1b
Closed

chore(deps): bump the actions-version group across 1 directory with 3 updates#525
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-version-195c220e1b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the actions-version group with 3 updates in the / directory: actions/setup-java, gradle/actions/setup-gradle and swift-actions/setup-swift.

Updates actions/setup-java from 4.9.1 to 6.0.0

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

... (truncated)

Commits

Updates gradle/actions/setup-gradle from 4.4.3 to 6.3.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.3.0

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

  • Cache entries failed to store at all on Windows.. Every entry failed with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of @actions/glob combined with a silently swallowed require() in the bundle, which left Windows path separators unnormalized.

  • Cache cleanup deleted instrumented jars that were in use. A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created caches/jars-9 entries as unused and remove them, so the instrumented-jars entry was never saved and every job re-instrumented its classpaths.

    Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT] Existing cache entries are invalidated by this release. The cache protocol version was bumped to v2, so the first run after upgrading will be a cache miss and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports (Entry not saved: save failed) in the Job Summary when a cache save fails, rather than reporting success (#1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it (#1025). Thanks to @​reinsch82 for the contribution.

Updated defaults

  • Injected Develocity Gradle plugin: 4.4.2 → 4.5.0
  • 36 new known-good wrapper checksums added for wrapper-validation

What's Changed

... (truncated)

Commits
  • 9c97196 Bump the github-actions group across 2 directories with 9 updates (#1024)
  • 760e4a4 Bump the npm-dependencies group across 1 directory with 2 updates (#1037)
  • 73e4c42 Update gradle-actions-caching library to v1.0.0 (#1029)
  • a9d1438 Add dependabot ignore rules for TypeScript 7.x and @​types/node 25.x/26.x
  • 68f3700 [bot] Update dist directory
  • 5971332 Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...
  • b5bc804 [bot] Update dist directory
  • dcbab4e Bump npm-dependencies group with TypeScript 6.0.3, @​types/node 24.x, and secu...
  • ca8d957 Move non-smoke restore-gradle-home tests back to the integ-test suite (#1032)
  • 4318659 [bot] Update dist directory
  • Additional commits viewable in compare view

Updates swift-actions/setup-swift from 2.4.0 to 3

Release notes

Sourced from swift-actions/setup-swift's releases.

3.0.0 Beta 1

Beta 1 of using Swiftly to setup Swift

  • Now uses Swiftly to set up Swift
  • Added flag skip-verify-signature to disable GPG verification checks

Features

  • Setup Swift more Swiftly 🚀 (setup-swift 3.0) (#710) @​fwal
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 9, 2026
Seth Juarez (sethjuarez) added a commit that referenced this pull request Sep 9, 2026
@sethjuarez
ci(dependabot): hold swift-actions/setup-swift at v2 (v3 GPG bug)
e3cca00 
The regenerated actions-version group (PR #525) bumps
swift-actions/setup-swift v2 -> v3, which fails the Swift CI job on Linux:

  gpg: Can't check signature: No public key
  The process '/usr/bin/gpg' failed with exit code 2

This is an open upstream bug in the action's Swiftly-based installer:
swift-actions/setup-swift#798

Ignore major (v3) bumps for swift-actions/setup-swift so the group keeps the
working v2 SHA pin while still taking the passing setup-java/gradle bumps.
Remove once upstream v3 installs cleanly.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@sethjuarez Seth Juarez (sethjuarez) mentioned this pull request Sep 9, 2026
Merged
@dependabot
chore(deps): bump the actions-version group across 1 directory with 3…
f779c2c 
… updates

Bumps the actions-version group with 3 updates in the / directory: [actions/setup-java](https://github.com/actions/setup-java), [gradle/actions/setup-gradle](https://github.com/gradle/actions) and [swift-actions/setup-swift](https://github.com/swift-actions/setup-swift).


Updates `actions/setup-java` from 4.9.1 to 6.0.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@cf277c6...dd06d9c)

Updates `gradle/actions/setup-gradle` from 4.4.3 to 6.3.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@ed40850...9c97196)

Updates `swift-actions/setup-swift` from 2.4.0 to 3
- [Release notes](https://github.com/swift-actions/setup-swift/releases)
- [Commits](swift-actions/setup-swift@7ca6abe...364295d)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version
- dependency-name: gradle/actions/setup-gradle
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version
- dependency-name: swift-actions/setup-swift
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-version-195c220e1b branch from dd5d853 to f779c2c Compare September 9, 2026 19:59
Seth Juarez (sethjuarez) added a commit that referenced this pull request Sep 9, 2026
@sethjuarez
ci(dependabot): hold CI-breaking major bumps (setup-swift v3, rand 0.…
ed36683 
…10) (#526)

* ci(dependabot): hold swift-actions/setup-swift at v2 (v3 GPG bug)

The regenerated actions-version group (PR #525) bumps
swift-actions/setup-swift v2 -> v3, which fails the Swift CI job on Linux:

  gpg: Can't check signature: No public key
  The process '/usr/bin/gpg' failed with exit code 2

This is an open upstream bug in the action's Swiftly-based installer:
swift-actions/setup-swift#798

Ignore major (v3) bumps for swift-actions/setup-swift so the group keeps the
working v2 SHA pin while still taking the passing setup-java/gradle bumps.
Remove once upstream v3 installs cleanly.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* ci(dependabot): hold rand at 0.9 (rand 0.10 breaks the Rust build)

The cargo-version group (PR #504) bumps rand 0.9 -> 0.10, a breaking API
change that removes the Rng::random()/random_range() methods our code uses:

  error[E0599]: no method named \
andom\ found for struct \ThreadRng\
  error[E0599]: no method named \
andom_range\ found for struct \ThreadRng\

These are used in prompty (parsers/prompty.rs, renderers/common.rs,
pipeline/live_turn.rs) and prompty-foundry (oauth.rs). Hold rand on 0.9 until
the source is migrated to the 0.10 API so the grouped cargo updates stay green.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer being updated by Dependabot, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 9, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-version-195c220e1b branch September 9, 2026 20:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants