Skip to content

build(deps): bump the github-actions group across 1 directory with 9 updates#611

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-c0fb2e182b
Open

build(deps): bump the github-actions group across 1 directory with 9 updates#611
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-c0fb2e182b

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 17, 2026 •
edited
Loading

Bumps the github-actions group with 9 updates in the / directory:

Package From To
actions/checkout 4 6
actions/setup-go 5 6
actions/upload-artifact 4 7
actions/configure-pages 5 6
actions/upload-pages-artifact 4 5
dorny/paths-filter 3 4
actions/download-artifact 4 8
crate-ci/typos 1.42.2 1.45.1
AlexSim93/pull-request-analytics-action 4.6.1 4.10.0

Updates actions/checkout from 4 to 6

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

What's Changed

... (truncated)

Commits

Updates actions/setup-go from 5 to 6

Release notes

Sourced from actions/setup-go's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-go@v5...v6.0.0

v5.6.0

What's Changed

Full Changelog: actions/setup-go@v5...v5.6.0

v5.5.0

What's Changed

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-go@v5...v5.5.0

... (truncated)

Commits

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/configure-pages from 5 to 6

Release notes

Sourced from actions/configure-pages's releases.

v6.0.0

Changelog

See details of all code changes since previous release.

Commits
  • 45bfe01 Merge pull request #186 from salmanmkc/node24
  • d8770c2 Update Node version from 20 to 24 in action.yml
  • cb8a1a3 upgrade to node 24
  • d560657 Merge pull request #165 from actions/Jcambass-patch-1
  • 35e0ac4 Upgrade IA Publish
  • 1dfbcbf Merge pull request #163 from actions/Jcambass-patch-1
  • 2f4f988 Add workflow file for publishing releases to immutable action package
  • 0d7570c Merge pull request #162 from actions/pin-draft-release-verssion
  • 3ea1966 pin draft release version
  • aabcbc4 Merge pull request #160 from actions/dependabot/npm_and_yarn/espree-10.1.0
  • Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 4 to 5

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

See details of all code changes since previous release.

Commits

Updates dorny/paths-filter from 3 to 4

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.0

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3.0.3...v4.0.0

v3.0.3

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3...v3.0.3

v3.0.2

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3...v3.0.2

v3.0.1

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3...v3.0.1

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.0

v3.0.3

v3.0.2

v3.0.1

v3.0.0

v2.11.1

v2.11.0

v2.10.2

v2.10.1

v2.10.0

v2.9.3

v2.9.2

v2.9.1

v2.9.0

... (truncated)

Commits
  • fbd0ab8 feat: add merge_group event support
  • efb1da7 feat: add dist/ freshness check to PR workflow
  • d8f7b06 Merge pull request #302 from dorny/issue-299
  • addbc14 Update README for v4
  • 9d7afb8 Update CHANGELOG for v4.0.0
  • 782470c Merge branch 'releases/v3'
  • ce10459 Merge pull request #294 from saschabratton/master
  • 5f40380 feat: update action runtime to node24
  • See full diff in compare view

Updates actions/download-artifact from 4 to 8

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates crate-ci/typos from 1.42.2 to 1.45.1

Release notes

Sourced from crate-ci/typos's releases.

v1.45.1

[1.45.1] - 2026-04-13

Fixes

  • (action) Use a temp dir for caching

v1.45.0

[1.45.0] - 2026-04-01

Features

  • Updated the dictionary with the March 2026 changes

v1.44.0

[1.44.0] - 2026-02-27

Features

v1.43.5

[1.43.5] - 2026-02-16

Fixes

  • (pypi) Hopefully fix the sdist build

v1.43.4

[1.43.4] - 2026-02-09

Fixes

  • Don't correct pincher

v1.43.3

[1.43.3] - 2026-02-06

Fixes

  • (action) Adjust how typos are reported to github

v1.43.2

[1.43.2] - 2026-02-05

Fixes

  • Don't correct certifi in Python

v1.43.1

... (truncated)

Changelog

Sourced from crate-ci/typos's changelog.

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased] - ReleaseDate

[1.45.1] - 2026-04-13

Fixes

  • (action) Use a temp dir for caching

[1.45.0] - 2026-04-01

Features

  • Updated the dictionary with the March 2026 changes

[1.44.0] - 2026-02-27

Features

[1.43.5] - 2026-02-16

Fixes

  • (pypi) Hopefully fix the sdist build

[1.43.4] - 2026-02-09

Fixes

  • Don't correct pincher

[1.43.3] - 2026-02-06

Fixes

  • (action) Adjust how typos are reported to github

[1.43.2] - 2026-02-05

Fixes

  • Don't correct certifi in Python

... (truncated)

Commits

Updates AlexSim93/pull-request-analytics-action from 4.6.1 to 4.10.0

Release notes

Sourced from AlexSim93/pull-request-analytics-action's releases.

Release v4.10.0

What's Changed

Full Changelog: AlexSim93/pull-request-analytics-action@v4.9.0...v4.10.0

Release v4.9.0

What's Changed

Full Changelog: AlexSim93/pull-request-analytics-action@v4.8.1...v4.9.0

Release v4.8.1

Release notes

  • Added support for including and excluding GitHub teams via the EXCLUDE_USERS and INCLUDE_USERS parameters. These parameters now accept both individual users and teams (comma-separated), allowing more flexible configuration of who is counted in the analytics.

Release v4.8.0

Release Notes

  • Added REQUIRED_APPROVALS Parameter: Introduced a new input, REQUIRED_APPROVALS, which lets you configure the number of review approvals needed for a pull request to be considered approved.

Release v4.7.0

Release Notes

  • User Exclusion Filters: Added the ability to exclude data for users listed in the INCLUDE_USERS / EXCLUDE_USERS parameters from the report.
  • Fixed PR Count for Missing Reviews/Approvals: Corrected the calculation of PRs without review or without approval in the report.

Release v4.6.2

Release Notes

  • Issue Graph Color Support: Corrected color handling in graph sections within issues, ensuring accurate display.
Commits
  • 2393847 Feature: Configure discussion types (#78)
  • 591a820 Fix documentation
  • 0ba6293 Feature: Filtering by branch name (#77)
  • c4d0c64 Feature: Support for teams in EXCLUDE_USERS/INCLUDE_USERS parameters (#76)
  • 01d9a21 Feature: Configure approvals number (#71)
  • a6bf785 Feature: Exclude/Include users from report (#70)
  • 41f0e91 Fix: Change colors displaying for charts (#69)
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code major labels Apr 17, 2026
This was referenced Apr 17, 2026
Closed
Closed
Closed
@ambient-code
Copy link
Copy Markdown
Contributor

ambient-code Bot commented Apr 18, 2026

Dependabot PR Review Summary

Overview

This PR bumps 9 GitHub Actions to their latest major versions across 11 workflow files. Several are major version jumps (e.g., checkout v4→v6, upload-artifact v4→v7, download-artifact v4→v8).

CI Failures Analysis

1. typos — FAILING (false positive from crate-ci/typos v1.45.1)
The bumped crate-ci/typos v1.45.1 now flags Iz as a typo (suggesting Is). However, all occurrences are inside base64-encoded token strings in Python test files (e.g., create_test.py, delete_test.py, exporter_test.py, client_config_test.py). These are clearly false positives. Fix: add Iz = "Iz" to the [default.extend-words] section in typos.toml.

2. e2e-compat-old-client / e2e-compat-old-controller — FAILING
These fail with gRPC connection refused errors followed by go: errors parsing go.mod. The connection failures suggest the controller service didn't start correctly in the Kind cluster. This could be related to the actions/checkout@v6 or actions/setup-go@v6 changes affecting the build/deployment flow, or could be a flaky test. Worth re-running to rule out flakiness.

3. e2e-tests — FAILING
Similar e2e infrastructure issues. Logs expired for some jobs.

Notable Major Version Bumps

  • actions/checkout v4→v6: Now uses Node.js 24, persists credentials differently.
  • actions/setup-go v5→v6: May change Go installation behavior.
  • actions/upload-artifact v4→v7 / download-artifact v4→v8: May have API changes in artifact handling.
  • dorny/paths-filter v3→v4: Filter logic may have changed.

No go.mod Impact

This PR only modifies workflow YAML files — no Go subproject updates needed.

Recommendation

  1. Fix the typos false positive by adding Iz to typos.toml word exceptions, or by pinning crate-ci/typos to a version that doesn't flag this.
  2. Re-run the e2e tests to rule out flakiness. If they consistently fail, investigate whether actions/checkout@v6 or actions/setup-go@v6 changes affect the Kind cluster setup.
  3. Note: the CI also warns that Node.js 20 actions are deprecated — this PR addresses that by moving to v6 which uses Node.js 24.

@dependabot
build(deps): bump the github-actions group with 9 updates
ecb6899 
Bumps the github-actions group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `6` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5` | `6` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/configure-pages](https://github.com/actions/configure-pages) | `5` | `6` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `4` | `5` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) | `3` | `4` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` |
| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.42.2` | `1.45.1` |
| [AlexSim93/pull-request-analytics-action](https://github.com/alexsim93/pull-request-analytics-action) | `4.6.1` | `4.10.0` |


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v6)

Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v6)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `actions/configure-pages` from 5 to 6
- [Release notes](https://github.com/actions/configure-pages/releases)
- [Commits](actions/configure-pages@v5...v6)

Updates `actions/upload-pages-artifact` from 4 to 5
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@v4...v5)

Updates `dorny/paths-filter` from 3 to 4
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](dorny/paths-filter@v3...v4)

Updates `actions/download-artifact` from 4 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v8)

Updates `crate-ci/typos` from 1.42.2 to 1.45.1
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@a1d6497...cf5f1c2)

Updates `AlexSim93/pull-request-analytics-action` from 4.6.1 to 4.10.0
- [Release notes](https://github.com/alexsim93/pull-request-analytics-action/releases)
- [Commits](AlexSim93/pull-request-analytics-action@cc57ceb...2393847)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/configure-pages
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dorny/paths-filter
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: crate-ci/typos
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: AlexSim93/pull-request-analytics-action
  dependency-version: 4.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the github-actions group with 9 updates build(deps): bump the github-actions group across 1 directory with 9 updates Apr 21, 2026
@dependabot dependabot Bot force-pushed the dependabot/github_actions/github-actions-c0fb2e182b branch from 381f670 to ecb6899 Compare April 21, 2026 04:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

already-checked dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code major

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants