deps(actions): bump the github-actions-all group with 9 updates by dependabot[bot] · Pull Request #560 · hashgraph-online/hol-guard

dependabot · 2026-06-02T04:25:36Z

Bumps the github-actions-all group with 9 updates:

Package	From	To
astral-sh/setup-uv	`6.8.0`	`8.1.0`
actions/setup-node	`4.4.0`	`6.4.0`
pnpm/action-setup	`4.1.0`	`6.0.8`
github/codeql-action	`4.35.2`	`4.36.0`
actions/upload-artifact	`7.0.0`	`7.0.1`
pypa/gh-action-pypi-publish	`1.13.0`	`1.14.0`
docker/setup-buildx-action	`3.10.0`	`4.1.0`
docker/login-action	`3.3.0`	`4.2.0`
docker/build-push-action	`6.18.0`	`7.2.0`

Updates astral-sh/setup-uv from 6.8.0 to 8.1.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.1.0 🌈 New input no-project

Changes

This add the a new boolean input no-project. It only makes sense to use in combination with activate-environment: true and will append --no project to the uv venv call. This is for example useful if you have a pyproject.toml file with parts unparseable by uv

🚀 Enhancements

Add input no-project in combination with activate-environment @eifinger (#856)

🧰 Maintenance

fix: grant contents:write to validate-release job @eifinger (#860)

Add a release-gate step to the release workflow @zanieb (#859)

Draft commitish releases @eifinger (#858)

Add action-types.yml to instructions @eifinger (#857)

chore: update known checksums for 0.11.7 @github-actions[bot] (#853)

Refactor version resolving @eifinger (#852)

chore: update known checksums for 0.11.6 @github-actions[bot] (#850)

chore: update known checksums for 0.11.5 @github-actions[bot] (#845)

chore: update known checksums for 0.11.4 @github-actions[bot] (#843)

Add a release workflow @zanieb (#839)

chore: update known checksums for 0.11.3 @github-actions[bot] (#836)

📚 Documentation

Update ignore-nothing-to-cache documentation @eifinger (#833)

Pin setup-uv docs to v8 @eifinger (#829)

⬆️ Dependency updates

chore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 @dependabot[bot] (#855)

v8.0.0 🌈 Immutable releases and secure tags

This is the first immutable release of setup-uv 🥳

All future releases are also immutable, if you want to know more about what this means checkout the docs.

This release also has two breaking changes

New format for manifest-file

The previously deprecated way of defining a custom version manifest to control which uv versions are available and where to download them from got removed. The functionality is still there but you have to use the new format.

No more major and minor tags

To increase security even more we will stop publishing minor tags. You won't be able to use @v8 or @v8.0 any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to tj-actions.

[!TIP] Use the immutable tag as a version astral-sh/setup-uv@v8.0.0 Or even better the githash astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57

... (truncated)

Commits

0880764 fix: grant contents:write to validate-release job (#860)
717d6ab Add a release-gate step to the release workflow (#859)
5a911eb Draft commitish releases (#858)
080c31e Add action-types.yml to instructions (#857)
b3e97d2 Add input no-project in combination with activate-environment (#856)
7dd591d chore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 (#855)
1541b77 chore: update known checksums for 0.11.7 (#853)
cdfb2ee Refactor version resolving (#852)
cb84d12 chore: update known checksums for 0.11.6 (#850)
1912cc6 chore: update known checksums for 0.11.5 (#845)
Additional commits viewable in compare view

Updates actions/setup-node from 4.4.0 to 6.4.0

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in actions/setup-node#1525

Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in actions/setup-node#1533

New Contributors

@Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

Support parsing devEngines field by @susnux in actions/setup-node#1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Fix npm audit issues by @gowridurgad in actions/setup-node#1491

Replace uuid with crypto.randomUUID() by @trivikr in actions/setup-node#1378

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-node#1498

Bug fixes:

Remove hardcoded bearer for mirror-url @marco-ippolito in actions/setup-node#1467

Scope test lockfiles by package manager and update cache tests by @gowridurgad in actions/setup-node#1495

New Contributors

@susnux made their first contribution in actions/setup-node#1283

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

What's Changed

Documentation

Documentation update related to absence of Lockfile by @mahabaleshwars in actions/setup-node#1454

Correct mirror option typos by @MikeMcC399 in actions/setup-node#1442

Readme update on checkout version v6 by @deining in actions/setup-node#1446

Readme typo fixes @munyari in actions/setup-node#1226

Advanced document update on checkout version v6 by @aparnajyothi-y in actions/setup-node#1468

Dependency updates:

Upgrade @actions/cache to v5.0.1 by @salmanmkc in actions/setup-node#1449

New Contributors

@mahabaleshwars made their first contribution in actions/setup-node#1454

@MikeMcC399 made their first contribution in actions/setup-node#1442

@deining made their first contribution in actions/setup-node#1446

... (truncated)

Commits

48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
ab72c7e Upgrade @actions dependencies (#1525)
53b8394 Bump minimatch from 3.1.2 to 3.1.5 (#1498)
54045ab Scope test lockfiles by package manager and update cache tests (#1495)
c882bff Replace uuid with crypto.randomUUID() (#1378)
774c1d6 feat(node-version-file): support parsing devEngines field (#1283)
efcb663 fix: remove hardcoded bearer (#1467)
d02c89d Fix npm audit issues (#1491)
6044e13 Docs: bump actions/checkout from v5 to v6 (#1468)
8e49463 Fix README typo (#1226)
Additional commits viewable in compare view

Updates pnpm/action-setup from 4.1.0 to 6.0.8

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.8

What's Changed

docs(README): fix cache_dependency_path type by @haines in pnpm/action-setup#257

fix: drop patchPnpmEnv so standalone+self-update works on Windows by @zkochan in pnpm/action-setup#258

fix: update pnpm to 11.1.1 by @mungodewar in pnpm/action-setup#248

New Contributors

@mungodewar made their first contribution in pnpm/action-setup#248

Full Changelog: pnpm/action-setup@v6.0.7...v6.0.8

v6.0.7

What's Changed

fix: honor devEngines.packageManager.onFail=error (#252) by @zkochan in pnpm/action-setup#254

fix: restore inputs from state in post by @haines in pnpm/action-setup#255

fix: self-update bootstrap to packageManager-pinned version (#233) by @zkochan in pnpm/action-setup#256

New Contributors

@haines made their first contribution in pnpm/action-setup#255

Full Changelog: pnpm/action-setup@v6.0.6...v6.0.7

v6.0.6

What's Changed

fix: bin_dest output points to self-updated pnpm, not bootstrap by @zkochan in pnpm/action-setup#249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

v6.0.5

What's Changed

fix: append (not prepend) action node dir to PATH for npm bootstrap by @zkochan in pnpm/action-setup#241

Full Changelog: pnpm/action-setup@v6.0.4...v6.0.5

v6.0.4

What's Changed

fix: use npm co-located with the action node binary by @benquarmby in pnpm/action-setup#239

New Contributors

@benquarmby made their first contribution in pnpm/action-setup#239

Full Changelog: pnpm/action-setup@v6.0.3...v6.0.4

v6.0.3

Updated pnpm to v11.0.0-rc.5

Full Changelog: pnpm/action-setup@v6.0.2...v6.0.3

... (truncated)

Commits

0e279bb fix: update pnpm to 11.1.1 (#248)
3e83581 fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)
551b42e docs(README): fix cache_dependency_path type (#257)
739bfe4 fix: self-update bootstrap to packageManager-pinned version (#233) (#256)
f61705d chore: add CODEOWNERS
7a5507b fix: restore inputs from state in post (#255)
1155470 fix: honor devEngines.packageManager.onFail=error (#252) (#254)
91ab88e fix: bin_dest output points to self-updated pnpm, not bootstrap (#249)
e578e19 fix: update pnpm to 11.0.4
8912a91 fix: append (not prepend) action node dir to PATH for npm bootstrap (#241)
Additional commits viewable in compare view

Updates github/codeql-action from 4.35.2 to 4.36.0

Release notes

Sourced from github/codeql-action's releases.

v4.36.0

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

v4.35.5

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

v4.35.4

Update default CodeQL bundle version to 2.25.4. #3881

v4.35.3

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

4.35.1 - 27 Mar 2026

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

4.35.0 - 27 Mar 2026

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

Update default CodeQL bundle version to 2.25.1. #3773

... (truncated)

Commits

7211b7c Merge pull request #3927 from github/update-v4.36.0-ebc2d9e2b
7740f2f Update changelog for v4.36.0
ebc2d9e Merge pull request #3926 from github/update-bundle/codeql-bundle-v2.25.5
d1f74b7 Add changelog note
2dc40ce Update default bundle to codeql-bundle-v2.25.5
8449852 Merge pull request #3910 from github/henrymercer/repo-size-diff-check
72ac23c Update excluded required check list
c5297a2 Merge pull request #3919 from github/henrymercer/workflow-concurrency
8ffeae7 CI: Automatically cancel non-generated workflows
f3f52bf Revert getErrorMessage import
Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.0

✨ What's Changed

The main change in this release is that verbose and print-hash inputs are now on by default. This was contributed by @whitequark💰 in #397.

📝 Docs

@woodruffw💰 updated the mentions of PEP 740 to stop implying that it might be experimental (it hasn't been for quite a while!) in #388 and @him2him2💰 brushed up some grammar in the README and SECURITY docs via #395.

🛠️ Internal Updates

@woodruffw💰 bumped sigstore and pypi-attestations in the lock file (#391) and @webknjaz💰 added infra for using type annotations in the project (#381).

💪 New Contributors

@him2him2 made their first contribution in #395

@whitequark made their first contribution in #397

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.13.0...v1.14.0

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

🙏 Special Thanks to @facutuesca💰 and @woodruffw💰 for helping maintain this project when I can't!

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

cef2210 Merge pull request #397 from whitequark/patch-1
b4595e2 Enable verbose and print-hash by default.
e2bab26 Merge pull request #395 from him2him2/docs/fix-typos-and-grammar
7495c38 docs: fix typos and grammar in README and SECURITY
03f86fe Merge pull request #388 from woodruffw-forks/ww/rm-experimental
4c78f1c Merge branch 'unstable/v1' into ww/rm-experimental
b5a6e8b deps: bump sigstore and pypi-attestations
a48a03e remove another experimental mention
8087a88 action: remove a lingering mention of PEP 740 being experimental
3317ede 🧪 Integrate actionlint via pre-commit framework
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.10.0 to 4.1.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.1.0

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in docker/setup-buildx-action#489

Bump brace-expansion from 1.1.12 to 5.0.6 in docker/setup-buildx-action#547 docker/setup-buildx-action#508

Bump fast-xml-builder from 1.0.0 to 1.2.0 in docker/setup-buildx-action#540

Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/setup-buildx-action#496

Bump flatted from 3.3.3 to 3.4.2 in docker/setup-buildx-action#499

Bump glob from 10.3.12 to 13.0.6 in docker/setup-buildx-action#495

Bump handlebars from 4.7.8 to 4.7.9 in docker/setup-buildx-action#504

Bump lodash from 4.17.23 to 4.18.1 in docker/setup-buildx-action#523

Bump picomatch from 4.0.3 to 4.0.4 in docker/setup-buildx-action#503

Bump postcss from 8.5.6 to 8.5.10 in docker/setup-buildx-action#537

Bump tar from 6.2.1 to 7.5.15 in docker/setup-buildx-action#545

Bump undici from 6.23.0 to 6.25.0 in docker/setup-buildx-action#492

Bump vite from 7.3.1 to 7.3.2 in docker/setup-buildx-action#520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

v4.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/setup-buildx-action#483

Remove deprecated inputs/outputs by @crazy-max in docker/setup-buildx-action#464

Switch to ESM and update config/test wiring by @crazy-max in docker/setup-buildx-action#481

Bump @actions/core from 1.11.1 to 3.0.0 in docker/setup-buildx-action#475

Bump @docker/actions-toolkit from 0.63.0 to 0.79.0 in docker/setup-buildx-action#482 docker/setup-buildx-action#485

Bump js-yaml from 4.1.0 to 4.1.1 in docker/setup-buildx-action#452

Bump lodash from 4.17.21 to 4.17.23 in docker/setup-buildx-action#472

Bump minimatch from 3.1.2 to 3.1.5 in docker/setup-buildx-action#480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

v3.12.0

Deprecate install input by @crazy-max in docker/setup-buildx-action#455

Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/setup-buildx-action#434

Bump brace-expansion from 1.1.11 to 1.1.12 in docker/setup-buildx-action#436

Bump form-data from 2.5.1 to 2.5.5 in docker/setup-buildx-action#432

Bump undici from 5.28.4 to 5.29.0 in docker/setup-buildx-action#435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

v3.11.1

Fix keep-state not being respected by @crazy-max in docker/setup-buildx-action#429

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

Keep BuildKit state support by @crazy-max in docker/setup-buildx-action#427

Remove aliases created when installing by default by @hashhar in docker/setup-buildx-action#139

Bump @docker/actions-toolkit from 0.56.0 to 0.62.1 in docker/setup-buildx-action#422 docker/setup-buildx-action#425

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

Commits

d7f5e7f Merge pull request #489 from docker/dependabot/npm_and_yarn/docker/actions-to...
92bc5c9 chore: update generated content
da11e35 build(deps): bump @docker/actions-toolkit from 0.79.0 to 0.90.0
f021e16 Merge pull request #492 from docker/dependabot/npm_and_yarn/undici-6.24.1
b5af94f chore: update generated content
16ad977 build(deps): bump undici from 6.23.0 to 6.25.0
d7a12d7 Merge pull request #495 from docker/dependabot/npm_and_yarn/glob-10.5.0
28ff27d build(deps): bump glob from 10.3.12 to 13.0.6
daf436b Merge pull request #496 from docker/dependabot/npm_and_yarn/fast-xml-parser-5...
9725348 chore: update generated content
Additional commits viewable in compare view

Updates docker/login-action from 3.3.0 to 4.2.0

Release notes

Sourced from docker/login-action's releases.

v4.2.0

Bump @actions/core from 3.0.0 to 3.0.1 in docker/login-action#976

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1050.0 in docker/login-action#960

Bump @docker/actions-toolkit from 0.86.0 to 0.90.0 in docker/login-action#970

Bump brace-expansion from 2.0.1 to 5.0.6 in docker/login-action#993

Bump fast-xml-builder from 1.1.4 to 1.2.0 in docker/login-action#985

Bump fast-xml-parser from 5.3.6 to 5.8.0 in docker/login-action#963

Bump http-proxy-agent and https-proxy-agent to 9.0.0 in docker/login-action#961

Bump postcss from 8.5.6 to 8.5.10 in docker/login-action#979

Bump tar from 6.2.1 to 7.5.15 in docker/login-action#991

Bump vite from 7.3.1 to 7.3.3 in docker/login-action#986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

v4.1.0

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in docker/login-action#945

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in docker/login-action#930

Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in docker/login-action#932 docker/login-action#936

Bump brace-expansion from 1.1.12 to 1.1.13 in docker/login-action#952

Bump fast-xml-parser from 5.3.4 to 5.3.6 in docker/login-action#942

Bump flatted from 3.3.3 to 3.4.2 in docker/login-action#944

Bump glob from 10.3.12 to 10.5.0 in docker/login-action#940

Bump handlebars from 4.7.8 to 4.7.9 in docker/login-action#949

Bump http-proxy-agent and https-proxy-agent to 8.0.0 in docker/login-action#937

Bump lodash from 4.17.23 to 4.18.1 in docker/login-action#958

Bump minimatch from 3.1.2 to 3.1.5 in docker/login-action#941

Bump picomatch from 4.0.3 to 4.0.4 in docker/login-action#948

Bump undici from 6.23.0 to 6.24.1 in docker/login-action#938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

v4.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/login-action#929

Switch to ESM and update config/test wiring by @crazy-max in docker/login-action#927

Bump @actions/core from 1.11.1 to 3.0.0 in docker/login-action#919

Bump @aws-sdk/client-ecr from 3.890.0 to 3.1000.0 in docker/login-action#909 docker/login-action#920

Bump @aws-sdk/client-ecr-public from 3.890.0 to 3.1000.0 in docker/login-action#909 docker/login-action#920

Bump @docker/actions-toolkit from 0.63.0 to 0.77.0 in docker/login-action#910 docker/login-action#928

Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in docker/login-action#921

Bump js-yaml from 4.1.0 to 4.1.1 in docker/login-action#901

Full Changelog: docker/login-action@v3.7.0...v4.0.0

v3.7.0

Add scope input to set scopes for the authentication token by @crazy-max in docker/login-action#912

Add support for AWS European Sovereign Cloud ECR by @dphi in docker/login-action#914

Ensure passwords are redacted with registry-auth input by @crazy-max in docker/login-action#911

build(deps): bump lodash from 4.17.21 to 4.17.23 in docker/login-action#915

Full Changelog: docker/login-action@v3.6.0...v3.7.0

... (truncated)

Commits

650006c Merge pull request #960 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
99df1a3 chore: update generated content
3ab375f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
39d8580 Merge pull request #970 from docker/dependabot/npm_and_yarn/docker/actions-to...
4eefcd3 chore: update generated content
56d092c build(deps): bump @docker/actions-toolkit from 0.86.0 to 0.90.0
e2e31ca Merge pull request #976 from docker/dependabot/npm_and_yarn/actions/core-3.0.1
0bced94 chore: update generated c...
Description has been truncated

Bumps the github-actions-all group with 9 updates: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.8.0` | `8.1.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.4.0` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4.1.0` | `6.0.8` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.2` | `4.36.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `4.1.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.3.0` | `4.2.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.18.0` | `7.2.0` | Updates `astral-sh/setup-uv` from 6.8.0 to 8.1.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v6.8...0880764) Updates `actions/setup-node` from 4.4.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@49933ea...48b55a0) Updates `pnpm/action-setup` from 4.1.0 to 6.0.8 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@a7487c7...0e279bb) Updates `github/codeql-action` from 4.35.2 to 4.36.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...7211b7c) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210) Updates `docker/setup-buildx-action` from 3.10.0 to 4.1.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@b5ca514...d7f5e7f) Updates `docker/login-action` from 3.3.0 to 4.2.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@9780b0c...650006c) Updates `docker/build-push-action` from 6.18.0 to 7.2.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@2634353...f9f3042) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: pnpm/action-setup dependency-version: 6.0.8 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-all - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-all - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-all - dependency-name: docker/setup-buildx-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: docker/build-push-action dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all ... Signed-off-by: dependabot[bot] <support@github.com>

greptile-apps · 2026-06-02T04:28:09Z

Greptile Summary

This is a routine dependabot bump of 9 GitHub Actions across 6 workflow files, all pinned to full commit SHAs. Several updates cross major version boundaries (notably actions/setup-node v4→v6, pnpm/action-setup v4→v6, three Docker actions v3/v6→v4/v7), but the inputs used in each workflow are stable primitives unaffected by the documented breaking changes.

astral-sh/setup-uv v6→v8: v8.0.0 dropped mutable major/minor tags and changed the manifest-file format — neither feature is exercised here, only enable-cache: true is set.
Docker actions v4/v7: docker/setup-buildx-action, docker/login-action, and docker/build-push-action now require Actions Runner ≥ v2.327.1 (Node 24 runtime); deprecated inputs removed in setup-buildx-action v4 are not referenced in these workflows.
pypa/gh-action-pypi-publish v1.14.0: verbose and print-hash are now on by default, which may produce more verbose publish logs but has no functional impact on the release process.

Confidence Score: 5/5

Safe to merge — all actions are pinned to full commit SHAs and the inputs used in each workflow are unaffected by the breaking changes in the new major versions.

Every action reference uses a full commit hash rather than a mutable tag, which is good supply-chain hygiene. The three Docker actions that cross a major version boundary now require Actions Runner ≥ v2.327.1 for the Node 24 runtime; GitHub-hosted runners on ubuntu-latest already satisfy this. The deprecated inputs removed in docker/setup-buildx-action v4 are not used in these workflows. The setup-uv v8 breaking changes have no impact here since no manifest-file input is configured. The two-major-version jumps for actions/setup-node and pnpm/action-setup are safe because only basic, long-stable inputs are used.

No files require special attention. The publish.yml Docker section is the most complex area but uses only standard, supported inputs for all three updated Docker actions.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Bumps actions/setup-node from 4.4.0 to 6.4.0 (two major versions) and pnpm/action-setup from 4.1.0 to 6.0.8; both actions are used with simple, stable inputs (node-version: "20" and version: "10") that are unaffected by the breaking changes in the newer major versions.
.github/workflows/codeql.yml	Bumps github/codeql-action (init, analyze) from 4.35.2 to 4.36.0; minor version bump, no breaking changes for the inputs used (languages, build-mode, source-root, category).
.github/workflows/dependabot-uv-lock.yml	Bumps astral-sh/setup-uv from 6.8.0 to 8.1.0; v8.0.0 dropped mutable major/minor tags and changed the manifest-file format, but neither feature is used here — only enable-cache: true is set.
.github/workflows/harness-smoke.yml	Bumps astral-sh/setup-uv from 6.8.0 to 8.1.0 in three job steps; all usages are identical (enable-cache: true only) and unaffected by the v8 breaking changes.
.github/workflows/publish.yml	Bumps actions/upload-artifact (7.0.0→7.0.1 patch), pypa/gh-action-pypi-publish (1.13.0→1.14.0), docker/setup-buildx-action (3.10.0→4.1.0), docker/login-action (3.3.0→4.2.0), and docker/build-push-action (6.18.0→7.2.0); the three docker action major bumps require Actions Runner ≥ v2.327.1 (Node 24), and the deprecated inputs removed in docker/setup-buildx-action v4 are not used by this workflow.
.github/workflows/scorecard.yml	Bumps actions/upload-artifact (7.0.0→7.0.1) and github/codeql-action/upload-sarif (4.35.2→4.36.0); both are routine patch/minor bumps with no breaking changes for the inputs used.

_{Reviews (1): Last reviewed commit: "deps(actions): bump the github-actions-a..." | Re-trigger Greptile}

dependabot · 2026-06-04T21:47:58Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file github-actions Pull requests that update GitHub Actions workflows labels Jun 2, 2026

dependabot Bot closed this Jun 4, 2026

dependabot Bot deleted the dependabot/github_actions/github-actions-all-8c31c7de1d branch June 4, 2026 21:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps(actions): bump the github-actions-all group with 9 updates#560

deps(actions): bump the github-actions-all group with 9 updates#560
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-all-8c31c7de1d

dependabot Bot commented on behalf of github Jun 2, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jun 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v8.1.0 🌈 New input no-project

Changes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v8.0.0 🌈 Immutable releases and secure tags

This is the first immutable release of setup-uv 🥳

New format for manifest-file

No more major and minor tags

v6.4.0

What's Changed

Dependency updates:

New Contributors

v6.3.0

What's Changed

Enhancements:

Dependency updates:

Bug fixes:

New Contributors

v6.2.0

What's Changed

Documentation

Dependency updates:

New Contributors

v6.0.8

What's Changed

New Contributors

v6.0.7

What's Changed

New Contributors

v6.0.6

What's Changed

v6.0.5

What's Changed

v6.0.4

What's Changed

New Contributors

v6.0.3

v4.36.0

v4.35.5

v4.35.4

v4.35.3

CodeQL Action Changelog

[UNRELEASED]

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

v7.0.1

What's Changed

v1.14.0

✨ What's Changed

📝 Docs

🛠️ Internal Updates

💪 New Contributors

v4.1.0

v4.0.0

v3.12.0

v3.11.1

v3.11.0

v4.2.0

v4.1.0

v4.0.0

v3.7.0

Uh oh!

greptile-apps Bot commented Jun 2, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

dependabot Bot commented on behalf of github Jun 4, 2026

Uh oh!

Reviewers

dependabot Bot commented on behalf of github Jun 2, 2026 •

edited

Loading

v8.1.0 🌈 New input `no-project`

This is the first immutable release of `setup-uv` 🥳

New format for `manifest-file`