Skip to content

🔼(deps): Bump the github-actions group with 11 updates - #17

Merged
livingstaccato merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-a35b8496c3
Aug 24, 2026
Merged

🔼(deps): Bump the github-actions group with 11 updates#17
livingstaccato merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-a35b8496c3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 11 updates:

Package From To
actions/checkout 6 7
actions/cache 5 6
astral-sh/setup-uv 8.0.0 10.0.1
actions/setup-go 6 7
cross-platform-actions/action 0.32.0 1.4.0
dawidd6/action-download-artifact 19 24
test-summary/action 2.4 2.6
codecov/codecov-action 6 7
actions/setup-python 6 7
softprops/action-gh-release 2.6.1 3.0.2
github/codeql-action 3 4

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/cache from 5 to 6

Release notes

Sourced from actions/cache's releases.

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 8.0.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table>

... (truncated)

Commits

Updates actions/setup-go from 6 to 7

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

New Contributors

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

Updates cross-platform-actions/action from 0.32.0 to 1.4.0

Release notes

Sourced from cross-platform-actions/action's releases.

Cross Platform Action 1.4.0

Added

  • Add support for FreeBSD on RISC-V 64 (riscv64) (#36)
  • Add support for NetBSD on VAX, running on the SIMH simulator
  • Add support for NetBSD 11.0 (#154)

Changed

  • OpenBSD on ARM64 now boots with the same EDK II UEFI firmware (uefi.fd) as every other ARM64 guest, instead of a separate Linaro UEFI build. The QEMU machine type for OpenBSD on ARM64 is now virt,acpi=off, which makes the kernel fall back to the device tree instead of hanging during ACPI attach. This removes the dependency on the Linaro release server, which no longer exists

Fixed

  • Don't log the Tearing down VM group when shutdown_vm is false, since the VM is not being torn down in that case (#109)
  • The "Start VM" step could keep running for hours when the VM failed to boot (#158). Waiting for the VM to become ready is now bounded by an actual wall clock timeout, instead of by a number of connection attempts, and a single SSH connection attempt is bounded by ConnectTimeout.
  • The post job step now reports when the console log of the VM is missing or empty, instead of silently printing nothing (#158)
  • A reboot of a guest that dies instead of rebooting now fails after roughly 20 seconds, instead of after 13 minutes. The SSH session that issues the reboot is bounded by ServerAliveInterval, so it no longer blocks for the full TCP retransmission time, and waiting for the VM to come back up is given up on as soon as the guest announces a kernel panic on its serial console
  • Advanced Matrix Extensions (AMX) is no longer exposed to the guests on x86-64, so which runner a job happens to get no longer decides whether the VM boots (#158). Kernels released before AMX existed fault as soon as userland starts, which affected NetBSD 9.4 and 10.1 and FreeBSD 12.4 on the runners that have it

Cross Platform Action 1.3.0

Added

  • Add support for FreeBSD 15.1 (#153)

  • Add a --environment-variables post-flag to the cpa.sh custom shell for forwarding additional environment variables to the VM on a per-step basis, without having to declare them on the Start VM step via the environment_variables input (#145):

    

    • 






... (truncated)





Changelog

Sourced from cross-platform-actions/action's changelog.




[1.4.0] - 2026-08-10


Added


    

  • Add support for FreeBSD on RISC-V 64 (riscv64) (#36)
    • 

  • Add support for NetBSD on VAX, running on the SIMH simulator
    • 

  • Add support for NetBSD 11.0 (#154)
    • 



Changed


    

  • OpenBSD on ARM64 now boots with the same EDK II UEFI firmware (uefi.fd) as
every other ARM64 guest, instead of a separate Linaro UEFI build. The QEMU
machine type for OpenBSD on ARM64 is now virt,acpi=off, which makes the
kernel fall back to the device tree instead of hanging during ACPI attach.
This removes the dependency on the Linaro release server, which no longer
exists
    • 



Fixed


    

  • Don't log the Tearing down VM group when shutdown_vm is false, since
the VM is not being torn down in that case
(#109)
    • 

  • The "Start VM" step could keep running for hours when the VM failed to boot
(#158).
Waiting for the VM to become ready is now bounded by an actual wall clock
timeout, instead of by a number of connection attempts, and a single SSH
connection attempt is bounded by ConnectTimeout.
    • 

  • The post job step now reports when the console log of the VM is missing or
empty, instead of silently printing nothing
(#158)
    • 

  • A reboot of a guest that dies instead of rebooting now fails after roughly
20 seconds, instead of after 13 minutes. The SSH session that issues the
reboot is bounded by ServerAliveInterval, so it no longer blocks for the
full TCP retransmission time, and waiting for the VM to come back up is
given up on as soon as the guest announces a kernel panic on its serial
console
    • 

  • Advanced Matrix Extensions (AMX) is no longer exposed to the guests on
x86-64, so which runner a job happens to get no longer decides whether the
VM boots
(#158).
Kernels released before AMX existed fault as soon as userland starts, which
affected NetBSD 9.4 and 10.1 and FreeBSD 12.4 on the runners that have it
    • 



[1.3.0] - 2026-06-22


Added


    

  • 

    Add support for FreeBSD 15.1 (#153)
    

    • 

  • 

    Add a --environment-variables post-flag to the cpa.sh custom shell for
forwarding additional environment variables to the VM on a per-step basis,
without having to declare them on the Start VM step via the
environment_variables input
(#145):
    

    - name: Run a command with extra environment variables
    

    • 






... (truncated)





Commits

    

  • 24ef01d Release 1.4.0
    • 

  • ca658ec Bump OpenBSD
    • 

  • de7ca38 Update changelog
    • 

  • f529a9b Fix #154: Add support for NetBSD 11.0
    • 

  • 9a8bf0a Attach two 2 GB scratch disks to the NetBSD/vax VM
    • 

  • 9ff5d24 Add support for NetBSD on VAX via the SIMH simulator
    • 

  • 48a3280 [no ci] Indicate the readme applies to master and not the latest release
    • 

  • 9bc6a97 Don't expose AMX to the guests
    • 

  • 41fae45 Fail fast when a guest crashes while rebooting
    • 

  • c84882c Log the CPU of the host
    • 

  • Additional commits viewable in compare view
    • 







Updates dawidd6/action-download-artifact from 19 to 24



Release notes

Sourced from dawidd6/action-download-artifact's releases.




v24


What's Changed



Full Changelog: dawidd6/action-download-artifact@v23...v24


v23


Info


This release is rather big. Not gonna lie to you, I've used LLMs to get there. I can't vouch for all the changes but CI confirms there should be no regressions. Please report any issues you encounter with this release. You can always revert to previous working one.


What's Changed



Full Changelog: dawidd6/action-download-artifact@v22...v23


v22


What's Changed



New Contributors



Full Changelog: dawidd6/action-download-artifact@v21...v22


v21


What's Changed






... (truncated)





Commits






Updates test-summary/action from 2.4 to 2.6



Release notes

Sourced from test-summary/action's releases.




v2.6


Actually update the tag to point to the correct branch (dist) instead of the dev branch.


v2.5


What's Changed



New Contributors



Full Changelog: https://github.com/test-summary/action/commits/v2.5







Commits






Updates codecov/codecov-action from 6 to 7



Release notes

Sourced from codecov/codecov-action's releases.




v7.0.0


⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key


What's Changed



Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0


v6.0.2


This is a copy of the v7.0.0 release to make updates easier


What's Changed



    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          🔼(deps): Bump the github-actions group with 11 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          3a0a99d
        
      

    

  

    

      
Bumps the github-actions group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6` | `7` |
| [actions/cache](https://github.com/actions/cache) | `5` | `6` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.0.0` | `10.0.1` |
| [actions/setup-go](https://github.com/actions/setup-go) | `6` | `7` |
| [cross-platform-actions/action](https://github.com/cross-platform-actions/action) | `0.32.0` | `1.4.0` |
| [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) | `19` | `24` |
| [test-summary/action](https://github.com/test-summary/action) | `2.4` | `2.6` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6` | `7` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6` | `7` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.1` | `3.0.2` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

Updates `actions/cache` from 5 to 6
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5...v6)

Updates `astral-sh/setup-uv` from 8.0.0 to 10.0.1
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@cec2083...20cfd1b)

Updates `actions/setup-go` from 6 to 7
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v6...v7)

Updates `cross-platform-actions/action` from 0.32.0 to 1.4.0
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](cross-platform-actions/action@v0.32.0...v1.4.0)

Updates `dawidd6/action-download-artifact` from 19 to 24
- [Release notes](https://github.com/dawidd6/action-download-artifact/releases)
- [Commits](dawidd6/action-download-artifact@v19...v24)

Updates `test-summary/action` from 2.4 to 2.6
- [Release notes](https://github.com/test-summary/action/releases)
- [Commits](test-summary/action@v2.4...v2.6)

Updates `codecov/codecov-action` from 6 to 7
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v6...v7)

Updates `actions/setup-python` from 6 to 7
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6...v7)

Updates `softprops/action-gh-release` from 2.6.1 to 3.0.2
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2.6.1...v3.0.2)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: cross-platform-actions/action
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dawidd6/action-download-artifact
  dependency-version: '24'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: test-summary/action
  dependency-version: '2.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  github_actions

  Pull requests that update GitHub Actions code

  labels


      Aug 24, 2026

    

  



  
 
  

    
  

  


        
    

        

              @livingstaccato


        

      

              livingstaccato



            merged commit b75d80a
          into

          
  
    main
  


        Aug 24, 2026

          

            8 checks passed
          

      

    


      

        
  
          
  
    
    


  
      

  







  

  
  

  
    

        

              @livingstaccato


        

      

            livingstaccato


        
    deleted the
    
      
        dependabot/github_actions/github-actions-a35b8496c3
    
    branch

        August 24, 2026 18:21        
        
      

    














  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    

    No reviews







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    github_actions

  Pull requests that update GitHub Actions code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      1 participant
    

    

        
          @livingstaccato