build(deps): bump arduino/setup-task from 2 to 3 by dependabot[bot] · Pull Request #566 · atlascloud/aports

dependabot · 2026-07-01T07:32:14Z

Release notes

Sourced from arduino/setup-task's releases.

3.0.0

Migration Guide

The version of the Node.js runtime used to execute the action has been updated from 20 to 24. This could be a breaking change for certain GitHub Actions workflows.

If a workflow with dependency on the arduino/setup-task action uses only GitHub-hosted GitHub Actions runners, no changes are required.

If the workflow uses a self-hosted runner, the workflow run might fail after updating arduino/setup-task:
Error: System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values. (Parameter ''using: node24' is not supported, use 'docker', 'node16' or 'node20' instead.')
   at GitHub.Runner.Worker.ActionManifestManager.ConvertRuns(IExecutionContext executionContext, TemplateContext templateContext, TemplateToken inputsToken, String fileRelativePath, MappingToken outputs)
   at GitHub.Runner.Worker.ActionManifestManager.Load(IExecutionContext executionContext, String manifestFile)
Error: Fail to load arduino/setup-task/v3/action.yml
This means an older runner version that does not provide Node.js 24.x is installed on the runner machine. In this case, the runner must be updated to a modern version with Node.js 24.x support prior to updating the arduino/setup-task action in the affected workflow.

Changelog

Breaking

Update Node.js runtime for action from 20 to 24 (#1408)

Enhancement

Convert project to ECMAScript module format (#1410)

Various dependency updates

Full Changeset

arduino/setup-task@2.0.0...3.0.0

Contributors

@tbjers

Commits

c0bc642 Merge pull request #1412 from arduino/dependabot/npm_and_yarn/prettier-3.9.4
c07d23e build(deps-dev): bump prettier from 3.9.3 to 3.9.4
f08c616 Merge pull request #1413 from arduino/dependabot/npm_and_yarn/vercel/ncc-0.44.1
9258741 build(deps-dev): bump @vercel/ncc from 0.44.0 to 0.44.1
5da2ac7 Merge pull request #1341 from arduino/dependabot/npm_and_yarn/actions/tool-ca...
939b4bb Update dependency license metadata cache for @actions/tool-cache bump
8ee93ed Repackage action following @actions/tool-cache bump
d179139 build(deps): bump @actions/tool-cache from 3.0.1 to 4.0.0
fdf1a08 Merge pull request #1340 from arduino/dependabot/npm_and_yarn/actions/io-3.0.2
b3c627a Repackage action following @actions/io bump
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [arduino/setup-task](https://github.com/arduino/setup-task) from 2 to 3. - [Release notes](https://github.com/arduino/setup-task/releases) - [Commits](arduino/setup-task@v2...v3) --- updated-dependencies: - dependency-name: arduino/setup-task dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-01T07:36:34Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
⚠️ ACTION	actionlint	3		1	0	0.18s
❌ ACTION	zizmor	3	0	1	0	0.28s
✅ BASH	bash-exec	3		0	0	0.18s
✅ BASH	shellcheck	3		0	0	0.12s
✅ BASH	shfmt	3	0	0	0	0.03s
✅ DOCKERFILE	hadolint	1		0	0	0.15s
✅ MARKDOWN	markdownlint	1	0	0	0	0.73s
✅ MARKDOWN	markdown-table-formatter	1	0	0	0	0.35s
✅ PYTHON	bandit	1		0	0	1.62s
✅ PYTHON	black	1	0	0	0	0.98s
✅ PYTHON	flake8	1		0	0	0.83s
✅ PYTHON	isort	1	0	0	0	0.25s
❌ PYTHON	mypy	1		2	0	12.78s
⚠️ PYTHON	pylint	1		2	0	6.09s
⚠️ PYTHON	pyright	1		7	0	2.01s
✅ PYTHON	ruff	1	0	0	0	0.06s
✅ REPOSITORY	betterleaks	yes		no	no	1.06s
⚠️ REPOSITORY	checkov	yes		4	no	22.28s
⚠️ REPOSITORY	devskim	yes		1	1	1.53s
✅ REPOSITORY	dustilock	yes		no	no	0.02s
✅ REPOSITORY	gitleaks	yes		no	no	2.1s
✅ REPOSITORY	git_diff	yes		no	no	0.03s
✅ REPOSITORY	grype	yes		no	no	54.8s
✅ REPOSITORY	kingfisher	yes		no	no	7.57s
✅ REPOSITORY	osv-scanner	yes		no	no	0.12s
✅ REPOSITORY	secretlint	yes		no	no	0.83s
✅ REPOSITORY	syft	yes		no	no	2.47s
✅ REPOSITORY	trivy	yes		no	no	11.46s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.23s
✅ REPOSITORY	trufflehog	yes		no	no	5.76s
✅ YAML	prettier	6	0	0	0	0.62s
✅ YAML	v8r	6		0	0	4.24s
✅ YAML	yamllint	6		0	0	0.68s

Detailed Issues

❌ PYTHON / mypy - 2 errors

Collecting types-requests
  Downloading types_requests-2.33.0.20260518-py3-none-any.whl.metadata (2.2 kB)
Collecting urllib3>=2 (from types-requests)
  Downloading urllib3-2.7.0-py3-none-any.whl.metadata (6.9 kB)
Downloading types_requests-2.33.0.20260518-py3-none-any.whl (21 kB)
Downloading urllib3-2.7.0-py3-none-any.whl (131 kB)
Installing collected packages: urllib3, types-requests

   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0/2 [urllib3]
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2/2 [types-requests]

Successfully installed types-requests-2.33.0.20260518 urllib3-2.7.0
checkers/utils.py:39: error: Incompatible return value type (got "Version", expected "str")  [return-value]
checkers/utils.py:72: error: Incompatible return value type (got "Version", expected "str")  [return-value]
Installing missing stub packages:
/venvs/mypy/bin/python3 -m pip install types-requests


Found 2 errors in 1 file (checked 1 source file)

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/build.yaml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

⚠️ ACTION / actionlint - 1 error

.github/workflows/build.yaml:49:9: shellcheck reported issue in this script: SC2044:warning:3:12: For loops over find output are fragile. Use find -exec or a while read loop [shellcheck]
   |
49 |         run: |
   |         ^~~~

⚠️ REPOSITORY / checkov - 4 errors

dockerfile scan results:

Passed checks: 62, Failed checks: 1, Skipped checks: 0

Check: CKV2_DOCKER_1: "Ensure that sudo isn't used"
	FAILED for resource: /Dockerfile.RUN
	File: /Dockerfile:13-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-docker-dont-use-sudo

		13 | RUN apk add bash alpine-conf alpine-sdk ccache cmake coreutils m4 sudo fish

github_actions scan results:

Passed checks: 77, Failed checks: 3, Skipped checks: 0

Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(build packages)
	File: /.github/workflows/build.yaml:0-1
Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(MegaLinter)
	File: /.github/workflows/megalinter.yml:26-27
Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(check package versions for upgrades)
	File: /.github/workflows/check-package-versions.yaml:0-1

⚠️ REPOSITORY / devskim - 1 error

{"$schema":"https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.6.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"devskim","fullName":"Microsoft DevSkim Command Line Interface","version":"1.0.70+d69541fde7","informationUri":"https://github.com/microsoft/DevSkim/","rules":[{"id":"DS176209","name":"SuspiciousComment","fullDescription":{"text":"Suspicious comment: A \"TODO\" or similar was left in source code, possibly indicating incomplete functionality"},"help":{"text":"A \"TODO\" or similar was left in source code, possibly indicating incomplete functionality","markdown":"Visit [https://github.com/Microsoft/DevSkim/blob/main/guidance/DS176209.md](https://github.com/Microsoft/DevSkim/blob/main/guidance/DS176209.md) for additional guidance on this issue."},"shortDescription":{"text":"A \"TODO\" or similar was left in source code, possibly indicating incomplete functionality"},"defaultConfiguration":{"level":"note"},"helpUri":"https://github.com/Microsoft/DevSkim/blob/main/guidance/DS176209.md","properties":{"precision":"high","problem.severity":"recommendation","DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"id":"DS137138","name":"InsecureUrl","fullDescription":{"text":"Insecure URL: An HTTP-based URL without TLS was detected."},"help":{"text":"Update to an HTTPS-based URL if possible.","markdown":"Update to an HTTPS-based URL if possible. Visit [https://github.com/Microsoft/DevSkim/blob/main/guidance/DS137138.md](https://github.com/Microsoft/DevSkim/blob/main/guidance/DS137138.md) for additional guidance on this issue."},"shortDescription":{"text":"An HTTP-based URL without TLS was detected."},"helpUri":"https://github.com/Microsoft/DevSkim/blob/main/guidance/DS137138.md","properties":{"precision":"high","problem.severity":"warning","DevSkimSeverity":"Moderate","DevSkimConfidence":"High"},"defaultConfiguration":{"level":"warning"}}]}},"versionControlProvenance":[{"repositoryUri":"https://github.com/atlascloud/aports","revisionId":"HIDDEN_BY_MEGALINTER","branch":"dependabot/github_actions/arduino/setup-task-3"}],"results":[{"ruleId":"DS137138","message":{"text":"Insecure URL"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"entrypoint.sh"},"region":{"startLine":4,"startColumn":12,"endLine":4,"endColumn":41,"charOffset":58,"charLength":29,"snippet":{"text":"http://dl-cdn.alpinelinux.org","rendered":{"text":"http://dl-cdn.alpinelinux.org","markdown":"`http://dl-cdn.alpinelinux.org`"}},"sourceLanguage":"shellscript"}}}],"fixes":[{"description":{"text":"An HTTP-based URL without TLS was detected."},"artifactChanges":[{"artifactLocation":{"uri":"entrypoint.sh"},"replacements":[{"deletedRegion":{"charOffset":58,"charLength":29},"insertedContent":{"text":"https://dl-cdn.alpinelinux.org"}}]}]}],"properties":{"tags":["ThreatModel.Integration.HTTP"],"DevSkimSeverity":"Moderate","DevSkimConfidence":"High"},"level":"warning"},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/check_updates.sh"},"region":{"startLine":22,"startColumn":3,"endLine":22,"endColumn":8,"charOffset":714,"charLength":5,"snippet":{"text":"FIXME","rendered":{"text":"FIXME","markdown":"`FIXME`"}},"sourceLanguage":"shellscript"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/build.yaml"},"region":{"startLine":17,"startColumn":26,"endLine":17,"endColumn":30,"charOffset":290,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}

⚠️ PYTHON / pylint - 2 errors

************* Module /action/lib/.automation/.pylintrc
/action/lib/.automation/.pylintrc:1:0: E0015: Unrecognized option found: suggestion-mode (unrecognized-option)
************* Module utils
checkers/utils.py:3:0: E0401: Unable to import 'requests' (import-error)

⚠️ PYTHON / pyright - 7 errors

checkers/utils.py
  checkers/utils.py:24:14 - error: Cannot access attribute "get" for class "str"
    Attribute "get" is unknown (reportAttributeAccessIssue)
  checkers/utils.py:24:30 - error: Argument of type "Literal['name']" cannot be assigned to parameter "key" of type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" in function "__getitem__"
    Type "Literal['name']" is not assignable to type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]"
      "Literal['name']" is incompatible with protocol "SupportsIndex"
        "__index__" is not present
      "Literal['name']" is not assignable to "slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" (reportArgumentType)
  checkers/utils.py:26:38 - error: Argument of type "Literal['name']" cannot be assigned to parameter "key" of type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" in function "__getitem__"
    Type "Literal['name']" is not assignable to type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]"
      "Literal['name']" is incompatible with protocol "SupportsIndex"
        "__index__" is not present
      "Literal['name']" is not assignable to "slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" (reportArgumentType)
  checkers/utils.py:31:37 - error: Argument of type "Literal['name']" cannot be assigned to parameter "key" of type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" in function "__getitem__"
    Type "Literal['name']" is not assignable to type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]"
      "Literal['name']" is incompatible with protocol "SupportsIndex"
        "__index__" is not present
      "Literal['name']" is not assignable to "slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" (reportArgumentType)
  checkers/utils.py:34:30 - error: Argument of type "Literal['name']" cannot be assigned to parameter "key" of type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" in function "__getitem__"
    Type "Literal['name']" is not assignable to type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]"
      "Literal['name']" is incompatible with protocol "SupportsIndex"
        "__index__" is not present
      "Literal['name']" is not assignable to "slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" (reportArgumentType)
  checkers/utils.py:39:12 - error: Type "Version" is not assignable to return type "str"
    "Version" is not assignable to "str" (reportReturnType)
  checkers/utils.py:72:12 - error: Type "Version" is not assignable to return type "str"
    "Version" is not assignable to "str" (reportReturnType)
7 errors, 0 warnings, 0 informations

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump arduino/setup-task from 2 to 3#566

build(deps): bump arduino/setup-task from 2 to 3#566
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/arduino/setup-task-3

dependabot Bot commented on behalf of github Jul 1, 2026

Uh oh!

github-actions Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026

3.0.0

Migration Guide

Changelog

Breaking

Enhancement

Full Changeset

Contributors

Uh oh!

github-actions Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

github-actions Bot commented Jul 1, 2026 •

edited

Loading