chore(deps): update github actions (major)

[BryanFRD]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
FerrLabs/Fixtures	action	major	v0 → v1
actions/cache	action	major	v4 → v5
actions/checkout	action	major	v4 → v6
actions/upload-artifact	action	major	v4 → v7
github/codeql-action	action	major	v3 → v4

---

Release Notes

FerrLabs/Fixtures (FerrLabs/Fixtures)

v1.0.2

Compare Source

[1.0.2] - 2026-04-23

Bug Fixes

• fix(deps): update rust crate toml to 0.9 (#​90)

v1.0.1

Compare Source

[1.0.1] - 2026-04-21

Bug Fixes

• fix(ci): rebrand GHCR + GitHub URLs from ferrflow-org to ferrlabs (#​87)

v1.0.0

Compare Source

[1.0.0] - 2026-04-15

Breaking Changes

• chore!: switch license from MIT to MPL-2.0 (#​83)

v1

Compare Source

v0.16.2

Compare Source

[0.16.2] - 2026-04-08

Bug Fixes

• fix(rng): reject seed=0 in bulk generation (#​82)

v0.16.1

Compare Source

[0.16.1] - 2026-04-08

v0.16.0

Compare Source

[0.16.0] - 2026-04-08

Features

• feat: add fixture examples for remaining versioning strategies (#​79)

v0.15.3

Compare Source

[0.15.3] - 2026-04-08

Bug Fixes

• fix: validate duplicate package names and paths (#​78)

v0.15.2

Compare Source

[0.15.2] - 2026-04-08

Bug Fixes

• fix: validate hook and file paths for directory traversal (#​77)

v0.15.1

Compare Source

[0.15.1] - 2026-04-08

Bug Fixes

• fix: correct invalid config values in fixture examples (#​76)

v0.15.0

Compare Source

[0.15.0] - 2026-04-08

Features

• feat: add fixture examples for missing FerrFlow features (#​68)

v0.14.0

Compare Source

[0.14.0] - 2026-04-08

Features

• feat: add JSON schema for fixture definitions (#​66)

v0.13.0

Compare Source

[0.13.0] - 2026-04-08

Features

• feat: add --verbose flag for detailed generation output (#​65)

v0.12.0

Compare Source

[0.12.0] - 2026-04-08

Features

• feat: add --validate flag for definition validation (#​64)

v0.11.2

Compare Source

[0.11.2] - 2026-04-08

Bug Fixes

• fix: replace panic!() in tree.rs with proper error propagation (#​62)

v0.11.1

Compare Source

[0.11.1] - 2026-04-08

v0.11.0

Compare Source

[0.11.0] - 2026-04-08

Features

• feat: add --help and --version CLI flags (#​49)
• feat: add config format fixture definitions (#​47)

v0.10.0

Compare Source

[0.10.0] - 2026-04-08

Features

• feat: add release commit mode fixture definitions (#​48)
• feat: add edge case fixture definitions (#​46)

v0.9.0

Compare Source

[0.9.0] - 2026-04-08

Features

• feat: add hook execution fixture definitions (#​45)
• feat: add changelog generation fixture definitions (#​44)
• feat: add floating tags fixture definitions (#​43)
• feat: add tag template fixture definitions (#​42)
• feat: add pre-release channel fixture definitions (#​41)

v0.8.1

Compare Source

[0.8.1] - 2026-04-08

Bug Fixes

• fix(ci): detect zero-fixture generation as failure (#​40)

v0.8.0

Compare Source

[0.8.0] - 2026-04-05

Features

• feat: support multiple branches in fixture definitions (#​30)

v0.7.0

Compare Source

[0.7.0] - 2026-04-05

Features

• feat: add default_branch support and head branch detection fixtures (#​29)

v0.6.0

Compare Source

[0.6.0] - 2026-04-04

Features

• feat: ignore unknown fields in definitions and disable skipCi (#​27)

v0.5.0

Compare Source

[0.5.0] - 2026-04-04

Features

• feat: make config field optional for tool-agnostic fixture generation (#​26)

v0.4.0

Compare Source

[0.4.0] - 2026-04-04

Features

• feat: migrate fixture definitions from TOML to JSON (#​24)

v0.3.0

Compare Source

[0.3.0] - 2026-04-04

Features

• feat: add bulk generation mode for benchmarks and stress tests (#​20)

v0.2.3

Compare Source

[0.2.3] - 2026-04-04

v0.2.2

Compare Source

[0.2.2] - 2026-04-04

Bug Fixes

• fix: resolve ferrflow binary to absolute path before cd into fixtures (#​18)

v0.2.1

Compare Source

[0.2.1] - 2026-04-04

Bug Fixes

• fix: add workspace marker to prevent parent workspace detection (#​17)

v0.2.0

Compare Source

[0.2.0] - 2026-04-04

Features

• feat: reusable GitHub Action for fixture generation and testing (#​14)
• feat: extend generator with tags, hooks, config formats, and merge commits (#​13)
• feat: initial test infrastructure with fixture generator, runner, and 9 scenarios

Bug Fixes

• fix(ci): use FERRFLOW_TOKEN for release push authentication (#​15)

actions/cache (actions/cache)

v5.0.5

Compare Source

What's Changed

• Update ts-http-runtime dependency by @​yacaovsnc in #​1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

Compare Source

What's Changed

• Add release instructions and update maintainer docs by @​Link- in #​1696
• Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @​Link- in #​1697
• Fix workflow permissions and cleanup workflow names / formatting by @​Link- in #​1699
• docs: Update examples to use the latest version by @​XZTDean in #​1690
• Fix proxy integration tests by @​Link- in #​1701
• Fix cache key in examples.md for bun.lock by @​RyPeck in #​1722
• Update dependencies & patch security vulnerabilities by @​Link- in #​1738

New Contributors

• @​XZTDean made their first contribution in #​1690
• @​RyPeck made their first contribution in #​1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

Compare Source

What's Changed

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v5.0.2: v.5.0.2

Compare Source

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

Compare Source

[!IMPORTANT]
actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

---

v5.0.1

What's Changed

• fix: update @​actions/cache for Node.js 24 punycode deprecation by @​salmanmkc in #​1685
• prepare release v5.0.1 by @​salmanmkc in #​1686

v5.0.0

What's Changed

• Upgrade to use node24 by @​salmanmkc in #​1630
• Prepare v5.0.0 release by @​salmanmkc in #​1684

Full Changelog: actions/cache@v5...v5.0.1

v5.0.0

Compare Source

[!IMPORTANT]
actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

---

What's Changed

• Upgrade to use node24 by @​salmanmkc in #​1630
• Prepare v5.0.0 release by @​salmanmkc in #​1684

Full Changelog: actions/cache@v4.3.0...v5.0.0

v5

Compare Source

v4.3.0

Compare Source

What's Changed

• Add note on runner versions by @​GhadimiR in #​1642
• Prepare v4.3.0 release by @​Link- in #​1655

New Contributors

• @​GhadimiR made their first contribution in #​1642

Full Changelog: actions/cache@v4...v4.3.0

v4.2.4

Compare Source

What's Changed

• Update README.md by @​nebuk89 in #​1620
• Upgrade @actions/cache to 4.0.5 and move @protobuf-ts/plugin to dev depdencies by @​Link- in #​1634
• Prepare release 4.2.4 by @​Link- in #​1636

New Contributors

• @​nebuk89 made their first contribution in #​1620

Full Changelog: actions/cache@v4...v4.2.4

v4.2.3

Compare Source

What's Changed

• Update to use @​actions/cache 4.0.3 package & prepare for new release by @​salmanmkc in #​1577 (SAS tokens for cache entries are now masked in debug logs)

New Contributors

• @​salmanmkc made their first contribution in #​1577

Full Changelog: actions/cache@v4.2.2...v4.2.3

v4.2.2

Compare Source

What's Changed

[!IMPORTANT]
As a reminder, there were important backend changes to release v4.2.0, see those release notes and the announcement for more details.

• Bump @​actions/cache to v4.0.2 by @​robherley in #​1560

Full Changelog: actions/cache@v4.2.1...v4.2.2

v4.2.1

Compare Source

What's Changed

[!IMPORTANT]
As a reminder, there were important backend changes to release v4.2.0, see those release notes and the announcement for more details.

• docs: GitHub is spelled incorrectly in caching-strategies.md by @​janco-absa in #​1526
• docs: Make the "always save prime numbers" example more clear by @​Tobbe in #​1525
• Update force deletion docs due a recent deprecation by @​sebbalex in #​1500
• Bump @​actions/cache to v4.0.1 by @​robherley in #​1554

New Contributors

• @​janco-absa made their first contribution in #​1526
• @​Tobbe made their first contribution in #​1525
• @​sebbalex made their first contribution in #​1500

Full Changelog: actions/cache@v4.2.0...v4.2.1

v4.2.0

Compare Source

⚠️ Important Changes

The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.

We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).

If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0

If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.

Upgrading to the recommended versions will not break your workflows.

Read more about the change & access the migration guide: reference to the announcement.

Minor changes

Minor and patch version updates for these dependencies:

• @​actions/core: 1.11.1
• @​actions/io: 1.1.3
• @​vercel/ncc: 0.38.3

Full Changelog: actions/cache@v4.1.2...v4.2.0

v4.1.2

Compare Source

What's Changed

• Add Bun example by @​idleberg in #​1456
• Revise isGhes logic by @​jww3 in #​1474
• Bump braces from 3.0.2 to 3.0.3 by @​dependabot in #​1475
• Add dependabot.yml to enable automatic dependency upgrades by @​Link- in #​1476
• Bump actions/checkout from 3 to 4 by @​dependabot in #​1478
• Bump actions/stale from 3 to 9 by @​dependabot in #​1479
• Bump github/codeql-action from 2 to 3 by @​dependabot in #​1483
• Bump actions/setup-node from 3 to 4 by @​dependabot in #​1481
• Prepare 4.1.2 release by @​Link- in #​1477

New Contributors

• @​idleberg made their first contribution in #​1456
• @​jww3 made their first contribution in #​1474
• @​Link- made their first contribution in #​1476

Full Changelog: actions/cache@v4.1.1...v4.1.2

v4.1.1

Compare Source

What's Changed

• Restore original behavior of cache-hit output by @​joshmgross in #​1467

Full Changelog: actions/cache@v4.1.0...v4.1.1

v4.1.0

Compare Source

What's Changed

• Fix cache-hit output when cache missed by @​fchimpan in #​1404
• Deprecate save-always input by @​joshmgross in #​1452

New Contributors

• @​ottlinger made their first contribution in #​1437
• @​Olegt0rr made their first contribution in #​1377
• @​fchimpan made their first contribution in #​1404
• @​x612skm made their first contribution in #​1434
• @​todgru made their first contribution in #​1311
• @​Jcambass made their first contribution in #​1463
• @​mackey0225 made their first contribution in #​1462
• @​quatquatt made their first contribution in #​1445

Full Changelog: actions/cache@v4.0.2...v4.1.0

v4.0.2

Compare Source

What's Changed

• Fix fail-on-cache-miss not working by @​cdce8p in #​1327

Full Changelog: actions/cache@v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

• Update README.md by @​yacaovsnc in #​1304
• Update examples by @​yacaovsnc in #​1305
• Update actions/cache publish flow by @​bethanyj28 in #​1340
• Update @​actions/cache by @​bethanyj28 in #​1341

New Contributors

• @​yacaovsnc made their first contribution in #​1304

Full Changelog: actions/cache@v4...v4.0.1

actions/checkout (actions/checkout)

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v6

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v5.0.0

Compare Source

• Update actions checkout to use node 24 by @​salmanmkc in #​2226

v5

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v4.3.1

Compare Source

• Port v6 cleanup to v4 by @​ericsciple in #​2305

v4.3.0

Compare Source

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236

v4.2.2

Compare Source

• url-helper.ts now leverages well-known environment variables by @​jww3 in #​1941
• Expand unit test coverage for isGhes by @​jww3 in #​1946

v4.2.1

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in #​1924

v4.2.0

Compare Source

• Add Ref and Commit outputs by @​lucacome in #​1180
• Dependency updates by @​dependabot- #​1777, #​1872

v4.1.7

Compare Source

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in #​1739
• Bump actions/checkout from 3 to 4 by @​dependabot in #​1697
• Check out other refs/* by commit by @​orhantoy in #​1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in #​1776

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in #​1732

v4.1.5

Compare Source

• Update NPM dependencies by @​cory-miller in #​1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in #​1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in #​1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in #​1695
• README: Suggest user.email to be 41898282+github-actions[bot]@​users.noreply.github.com by @​cory-miller in #​1707

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in #​1692
• Add dependabot config by @​cory-miller in #​1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in #​1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in #​1643

v4.1.3

Compare Source

• Check git version before attempting to disable sparse-checkout by @​jww3 in #​1656
• Add SSH user parameter by @​cory-miller in #​1685
• Update actions/checkout version in update-main-version.yml by @​jww3 in #​1650

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598

v4.1.1

Compare Source

• Correct link to GitHub Docs by @​peterbe in #​1511
• Link to release page from what's new section by @​cory-miller in #​1514

v4.1.0

Compare Source

• Add support for partial checkout filters

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in #​754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in #​762
• Support direct file uploads by @​danwkennedy in #​764

New Contributors

• @​Link- made their first contribution in #​754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v7

Compare Source

v6

Compare Source

v6.0.0

Compare Source

v6 - What's new

[!IMPORTANT]
actions/upload-artifact@​v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Upload Artifact Node 24 support by @​salmanmkc in #​719
• fix: update @​actions/artifact for Node.js 24 punycode deprecation by @​salmanmkc in #​744
• prepare release v6.0.0 for Node.js 24 support by @​salmanmkc in #​745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5

Compare Source

v5.0.0

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

• Update README.md by @​GhadimiR in #​681
• Update README.md by @​nebuk89 in #​712
• Readme: spell out the first use of GHES by @​danwkennedy in #​727
• Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in #​725
• Bump @actions/artifact to v4.0.0
• Prepare v5.0.0 by @​danwkennedy in #​734

New Contributors

• @​GhadimiR made their first contribution in #​681
• @​nebuk89 made their first contribution in #​712
• @​danwkennedy made their first contribution in #​727
• @​patrikpolyak made their first contribution in #​725

Full Changelog: actions/upload-artifact@v4...v5.0.0

v4.6.2

Compare Source

What's Changed

• Update to use artifact 2.3.2 package & prepare for new upload-artifact release by @​salmanmkc in #​685

New Contributors

• @​salmanmkc made their first contribution in #​685

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

Compare Source

What's Changed

• Update to use artifact 2.2.2 package by @​yacaovsnc in #​673

Full Changelog: actions/upload-artifact@v4...v4.6.1

v4.6.0

Compare Source

What's Changed

• Expose env vars to control concurrency and timeout by @​yacaovsnc in #​662

Full Changelog: actions/upload-artifact@v4...v4.6.0

v4.5.0

Compare Source

What's Changed

• fix: deprecated Node.js version in action by @​hamirmahal in #​578
• Add new artifact-digest output by @​bdehamer in #​656

New Contributors

• @​hamirmahal made their first contribution in #​578
• @​bdehamer made their first contribution in #​656

Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0

v4.4.3

Compare Source

What's Changed

• Undo indirect dependency updates from #​627 by @​joshmgross in #​632

Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3

v4.4.2

Compare Source

What's Changed

• Bump @actions/artifact to 2.1.11 by @​robherley in #​627
  • Includes fix for relative symlinks not resolving properly

Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2

v4.4.1

Compare Source

What's Changed

• Add a section about hidden files by @​joshmgross in #​607
• Add workflow file for publishing releases to immutable action package by @​Jcambass in #​621
• Update @​actions/artifact to latest version, includes symlink and timeout fixes by @​robherley in #​625

New Contributors

• @​Jcambass made their first contribution in #​621

Full Changelog: actions/upload-artifact@v4.4.0...v4.4.1

v4.4.0

Compare Source

Notice: Breaking Changes ⚠️

We will no longer include hidden files and folders by default in the upload-artifact action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, include-hidden-files, to continue to do so.

See "Notice of upcoming deprecations and breaking changes in GitHub Actions runners" changelog and this issue for more details.

What's Changed

• Exclude hidden files by default by @​joshmgross in #​598

Full Changelog: actions/upload-artifact@v4.3.6...v4.4.0

v4.3.6

Compare Source

What's Changed

• Revert to @​actions/artifact 2.1.8 by @​robherley in #​594

Full Changelog: actions/upload-artifact@v4...v4.3.6

v4.3.5

Compare Source

What's Changed

• Bump @​actions/artifact to v2.1.9 by @​robherley in #​588
  • Fixed artifact upload chunk timeout logic #​1774
  • Use lazy stream to prevent issues with open file limits #​1771

Full Changelog: actions/upload-artifact@v4.3.4...v4.3.5

v4.3.4

Compare Source

What's Changed

• Update @​actions/artifact version, bump dependencies by @​robherley in #​584

Full Changelog: actions/upload-artifact@v4.3.3...v4.3.4

v4.3.3

Compare Source

What's Changed

• updating @actions/artifact dependency to v2.1.6 by @​eggyhead in #​565

Full Changelog: actions/upload-artifact@v4.3.2...v4.3.3

v4.3.2

Compare Source

What's Changed

• Update release-new-action-version.yml by @​konradpabjan in #​516
• Minor fix to the migration readme by @​andrewakim in #​523
• Update readme with v3/v2/v1 deprecation notice by @​robherley in #​561
• updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @​eggyhead in #​562

New Contributors

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[BryanFRD]

Closing in favor of Dependabot — see the org-wide migration in this repo's chore(deps) PR. Renovate's GitHub App will be uninstalled at the org level shortly.