Skip to content

Bump the github-actions group across 1 directory with 15 updates#3

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-ce23264c0a
Open

Bump the github-actions group across 1 directory with 15 updates#3
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-ce23264c0a

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Oct 1, 2025 •
edited
Loading

Bumps the github-actions group with 15 updates in the / directory:

Package From To
actions/checkout 4.1.1 5.0.0
actions/upload-artifact 4.3.0 4.6.2
actions/download-artifact 4.1.1 5.0.0
hendrikmuhs/ccache-action 1.2.17 1.2.19
step-security/changed-files 45.0.1 46.0.5
actions/setup-python 5.1.1 6.0.0
EnricoMi/publish-unit-test-result-action 2.18.0 2.20.0
actions/github-script 6.4.1 8.0.0
docker/login-action 3.3.0 3.6.0
aminya/setup-cpp 1.1.1 1.7.1
actions/setup-node 4.2.0 5.0.0
actions/labeler 4.3.0 6.0.1
actions/attest-build-provenance 1.0.0 3.0.0
pypa/gh-action-pypi-publish 1.12.4 1.13.0
ossf/scorecard-action 2.4.1 2.4.3

Updates actions/checkout from 4.1.1 to 5.0.0

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

What's Changed

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.2.0...v4.2.1

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Updates actions/upload-artifact from 4.3.0 to 4.6.2

Release notes

Sourced from actions/upload-artifact's releases.

v4.6.2

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.1

v4.6.0

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.0

v4.5.0

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0

v4.4.3

What's Changed

Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3

v4.4.2

What's Changed

Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2

v4.4.1

... (truncated)

Commits
  • ea165f8 Merge pull request #685 from salmanmkc/salmanmkc/3-new-upload-artifacts-release
  • 0839620 Prepare for new release of actions/upload-artifact with new toolkit cache ver...
  • 4cec3d8 Merge pull request #673 from actions/yacaovsnc/artifact_2.2.2
  • e9fad96 license cache update for artifact
  • b26fd06 Update to use artifact 2.2.2 package
  • 65c4c4a Merge pull request #662 from actions/yacaovsnc/add_variable_for_concurrency_a...
  • 0207619 move files back to satisfy licensed ci
  • 1ecca81 licensed cache updates
  • 9742269 Expose env vars to controll concurrency and timeout
  • 6f51ac0 Merge pull request #656 from bdehamer/bdehamer/artifact-digest
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.1.1 to 5.0.0

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

  • By name: name: my-artifact → extracted to path/ (direct)
  • By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

  • By name: name: my-artifact → extracted to path/ (unchanged)
  • By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:
  • You download artifacts by name
  • You download multiple artifacts by ID
  • You already use merge-multiple: true as a workaround
⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

</tr></table>

... (truncated)

Commits
  • 634f93c Merge pull request #416 from actions/single-artifact-id-download-path
  • b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
  • e262cbe bundle dist
  • bff23f9 update docs
  • fff8c14 fix download path logic when downloading a single artifact by id
  • 448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
  • 47225c4 Update README.md
  • d3f86a1 Merge pull request #404 from actions/robherley/v4.3.0
  • fc02353 prep for v4.3.0 release
  • 7745437 Merge pull request #402 from actions/joshmgross/download-by-id-example
  • Additional commits viewable in compare view

Updates hendrikmuhs/ccache-action from 1.2.17 to 1.2.19

Release notes

Sourced from hendrikmuhs/ccache-action's releases.

v1.2.19

What's Changed

New Contributors

Full Changelog: hendrikmuhs/ccache-action@v1...v1.2.19

v1.2.18

What's Changed

New Contributors

Full Changelog: hendrikmuhs/ccache-action@v1...v1.2.18

Commits

Updates step-security/changed-files from 45.0.1 to 46.0.5

Release notes

Sourced from step-security/changed-files's releases.

v46.0.5

What's Changed

New Contributors

Full Changelog: step-security/changed-files@v45...v46.0.5

Commits
  • 95b56da ci: remove unnecessary workflows/ steps (#57)
  • 60058f6 unused workflows/steps deleted
  • eb71416 revert workflow changes
  • e152d5b fix: Security updates (#54)
  • a373b15 chore: Cherry-picked changes from upstream (#53)
  • f2de462 chore: Cherry-picked changes from upstream (#52)
  • 31ad786 cherry pick and guard dog workflow added (#48)
  • 98d7c47 [StepSecurity] Apply security best practices (#47)
  • 52f7569 Merge pull request #15 from step-security-bot/stepsecurity_remediation_174250...
  • cdb3cda [StepSecurity] ci: Harden GitHub Actions
  • See full diff in compare view

Updates actions/setup-python from 5.1.1 to 6.0.0

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

What's Changed

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

What's Changed

Enhancements:

Bug fixes:

... (truncated)

Commits
  • e797f83 Upgrade to node 24 (#1164)
  • 3d1e2d2 Revert "Enhance cache-dependency-path handling to support files outside the w...
  • 65b0712 Clarify pythonLocation behavior for PyPy and GraalPy in environment variables...
  • 5b668cf Bump actions/checkout from 4 to 5 (#1181)
  • f62a0e2 Change missing cache directory error to warning (#1182)
  • 9322b3c Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIn...
  • fbeb884 Bump form-data to fix critical vulnerabilities #182 & #183 (#1163)
  • 03bb615 Bump idna from 2.9 to 3.7 in /tests/data (#843)
  • 36da51d Add version parsing from Pipfile (#1067)
  • 3c6f142 update documentation (#1156)
  • Additional commits viewable in compare view

Updates EnricoMi/publish-unit-test-result-action from 2.18.0 to 2.20.0

Release notes

Sourced from EnricoMi/publish-unit-test-result-action's releases.

v2.20.0

Adds the following improvements:

  • Add action typing #653
  • Isolate PIP cache used by composite actions #668
  • Fix for empty <system-out> and <system-err> #667
  • Deprecate github_token_actor option, auto-detect actor #661
  • Use and recommend !cancelled() instead of always() #659
  • Add deprecationMessage to action.yml for deprecated inputs (#654)
  • Resolve regex library warnings #660

Full Changelog: EnricoMi/publish-unit-test-result-action@v2.19.0...v2.20.0

v2.19.0

Adds the following improvements:

  • Add option to verify SSL/TLS connection (#638)
  • Mention composite replacement in README.md (#647)
  • Quote $PYTHON_BIN in deprecated composite action (#646)
Commits

Updates actions/github-script from 6.4.1 to 8.0.0

Release notes

Sourced from actions/github-script's releases.

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 1, 2025
@dependabot dependabot bot force-pushed the dependabot/github_actions/github-actions-ce23264c0a branch from 118a3c8 to 7774ae8 Compare November 1, 2025 14:25
@dependabot
Bump the github-actions group across 1 directory with 15 updates
df8b045 
Bumps the github-actions group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.1.1` | `5.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.3.0` | `4.6.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.1` | `5.0.0` |
| [hendrikmuhs/ccache-action](https://github.com/hendrikmuhs/ccache-action) | `1.2.17` | `1.2.19` |
| [step-security/changed-files](https://github.com/step-security/changed-files) | `45.0.1` | `46.0.5` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.1.1` | `6.0.0` |
| [EnricoMi/publish-unit-test-result-action](https://github.com/enricomi/publish-unit-test-result-action) | `2.18.0` | `2.20.0` |
| [actions/github-script](https://github.com/actions/github-script) | `6.4.1` | `8.0.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.3.0` | `3.6.0` |
| [aminya/setup-cpp](https://github.com/aminya/setup-cpp) | `1.1.1` | `1.7.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4.2.0` | `5.0.0` |
| [actions/labeler](https://github.com/actions/labeler) | `4.3.0` | `6.0.1` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `1.0.0` | `3.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.12.4` | `1.13.0` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.3` |



Updates `actions/checkout` from 4.1.1 to 5.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.1.1...08c6903)

Updates `actions/upload-artifact` from 4.3.0 to 4.6.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4.3.0...ea165f8)

Updates `actions/download-artifact` from 4.1.1 to 5.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4.1.1...634f93c)

Updates `hendrikmuhs/ccache-action` from 1.2.17 to 1.2.19
- [Release notes](https://github.com/hendrikmuhs/ccache-action/releases)
- [Commits](hendrikmuhs/ccache-action@a1209f8...bfa03e1)

Updates `step-security/changed-files` from 45.0.1 to 46.0.5
- [Release notes](https://github.com/step-security/changed-files/releases)
- [Commits](step-security/changed-files@3dbe17c...95b56da)

Updates `actions/setup-python` from 5.1.1 to 6.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5.1.1...e797f83)

Updates `EnricoMi/publish-unit-test-result-action` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/enricomi/publish-unit-test-result-action/releases)
- [Commits](EnricoMi/publish-unit-test-result-action@170bf24...3a74b29)

Updates `actions/github-script` from 6.4.1 to 8.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v6.4.1...ed59741)

Updates `docker/login-action` from 3.3.0 to 3.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@9780b0c...5e57cd1)

Updates `aminya/setup-cpp` from 1.1.1 to 1.7.1
- [Release notes](https://github.com/aminya/setup-cpp/releases)
- [Commits](aminya/setup-cpp@17c1155...a276e6e)

Updates `actions/setup-node` from 4.2.0 to 5.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@1d0ff46...a0853c2)

Updates `actions/labeler` from 4.3.0 to 6.0.1
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@ac9175f...634933e)

Updates `actions/attest-build-provenance` from 1.0.0 to 3.0.0
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@897ed5e...977bb37)

Updates `pypa/gh-action-pypi-publish` from 1.12.4 to 1.13.0
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@76f52bc...ed0c539)

Updates `ossf/scorecard-action` from 2.4.1 to 2.4.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@f49aabe...4eaacf0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: hendrikmuhs/ccache-action
  dependency-version: 1.2.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: step-security/changed-files
  dependency-version: 46.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: EnricoMi/publish-unit-test-result-action
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: aminya/setup-cpp
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/labeler
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/attest-build-provenance
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/github_actions/github-actions-ce23264c0a branch from 7774ae8 to df8b045 Compare March 1, 2026 14:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants