Update github actions by renovate[bot] · Pull Request #197 · kamphaus/upt

renovate · 2026-05-19T20:41:49Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
Swatinem/rust-cache	action	minor	`v2` → `v2.9.1`
actions/checkout	action	patch	`v6` → `v6.0.2`
actions/download-artifact	action	patch	`v8` → `v8.0.1`
actions/upload-artifact	action	patch	`v7` → `v7.0.1`
anchore/sbom-action	action	minor	`v0` → `v0.24.0`
baptiste0928/cargo-install	action	minor	`v3` → `v3.4.0`
dtolnay/rust-toolchain	action	pinDigest	→ `29eef33`
ncipollo/release-action	action	minor	`v1` → `v1.21.0`
release-drafter/release-drafter	action	minor	`v7` → `v7.3.0`
slsa-framework/slsa-github-generator	action	pinDigest	→ `f7dd8c5`

Release Notes

Swatinem/rust-cache (Swatinem/rust-cache)

`v2.9.1`

Compare Source

Fix regression in hash calculation

Full Changelog: Swatinem/rust-cache@v2.9.0...v2.9.1

`v2.9.0`

Compare Source

What's Changed

Add support for running rust-cache commands from within a Nix shell by @marc0246 in #290
Bump taiki-e/install-action from 2.62.57 to 2.62.60 in the actions group by @dependabot[bot] in #291
Bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #296
Bump the prd-major group with 3 updates by @dependabot[bot] in #294
Bump @types/node from 24.10.1 to 25.0.2 in the dev-major group by @dependabot[bot] in #295
Consider all installed toolchains in cache key by @tamird in #293
Compare case-insenitively for full cache key match by @kbriggs in #303
Migrate to node24 runner by @rhysd in #314
Bump the actions group across 1 directory with 7 updates by @dependabot[bot] in #312
Bump the prd-minor group across 1 directory with 2 updates by @dependabot[bot] in #307
Bump @types/node from 25.0.2 to 25.2.2 in the dev-minor group by @dependabot[bot] in #309

New Contributors

@marc0246 made their first contribution in #290
@tamird made their first contribution in #293
@kbriggs made their first contribution in #303

Full Changelog: Swatinem/rust-cache@v2.8.2...v2.9.0

`v2.8.2`

Compare Source

What's Changed

ci: address lint findings, add zizmor workflow by @woodruffw in #262
feat: Implement ability to disable adding job ID + rust environment hashes to cache names by @Ryan-Brice in #279
Don't overwrite env for cargo-metadata call by @MaeIsBad in #285

New Contributors

@woodruffw made their first contribution in #262
@Ryan-Brice made their first contribution in #279
@MaeIsBad made their first contribution in #285

Full Changelog: Swatinem/rust-cache@v2.8.1...v2.8.2

`v2.8.1`

Compare Source

What's Changed

Set empty CARGO_ENCODED_RUSTFLAGS in workspace metadata retrieval by @ark0f in #249
chore(deps): update dependencies by @reneleonhardt in #251
chore: fix dependabot groups by @reneleonhardt in #253
Bump the prd-patch group with 2 updates by @dependabot[bot] in #254
chore(dependabot): regenerate and commit dist/ by @reneleonhardt in #257
Bump @types/node from 22.16.3 to 24.2.1 in the dev-major group by @dependabot[bot] in #255
Bump typescript from 5.8.3 to 5.9.2 in the dev-minor group by @dependabot[bot] in #256
Bump actions/setup-node from 4 to 5 in the actions group by @dependabot[bot] in #259
Update README.md by @Propfend in #234
Bump @types/node from 24.2.1 to 24.3.0 in the dev-minor group by @dependabot[bot] in #258

New Contributors

@ark0f made their first contribution in #249
@reneleonhardt made their first contribution in #251
@dependabot[bot] made their first contribution in #254
@Propfend made their first contribution in #234

Full Changelog: Swatinem/rust-cache@v2...v2.8.1

`v2.8.0`

Compare Source

What's Changed

Add cache-workspace-crates feature by @jbransen in #246
Feat: support warpbuild cache provider by @stegaBOB in #247

New Contributors

@jbransen made their first contribution in #246
@stegaBOB made their first contribution in #247

Full Changelog: Swatinem/rust-cache@v2.7.8...v2.8.0

`v2.7.8`

Compare Source

What's Changed

Include CPU arch in the cache key for arm64 Linux runners by @rhysd in #228

Full Changelog: Swatinem/rust-cache@v2.7.7...v2.7.8

`v2.7.7`

Compare Source

Full Changelog: Swatinem/rust-cache@v2.7.6...v2.7.7

`v2.7.6`

Compare Source

What's Changed

Updated artifact upload action to v4 by @guylamar2006 in #212
Adds an option to do lookup-only of the cache by @danlec in #217
add runner OS in cache key by @rnbguy in #220
Allow opting out of caching $CARGO_HOME/bin. by @benjyw in #216

New Contributors

@guylamar2006 made their first contribution in #212
@danlec made their first contribution in #217
@rnbguy made their first contribution in #220
@benjyw made their first contribution in #216

Full Changelog: Swatinem/rust-cache@v2.7.5...v2.7.6

`v2.7.5`

Compare Source

What's Changed

Upgrade checkout action from version 3 to 4 by @carsten-wenderdel in #190
fix: usage of deprecated version of node by @hamirmahal in #197
Only run macOsWorkaround() on macOS by @heksesang in #206
Support Cargo.lock format cargo-lock v4 by @NobodyXu in #211

New Contributors

@carsten-wenderdel made their first contribution in #190
@hamirmahal made their first contribution in #197
@heksesang made their first contribution in #206

Full Changelog: Swatinem/rust-cache@v2.7.3...v2.7.5

`v2.7.3`

Compare Source

Work around upstream problem that causes cache saving to hang for minutes.

Full Changelog: Swatinem/rust-cache@v2.7.2...v2.7.3

`v2.7.2`

Compare Source

What's Changed

Update action runtime to node20 by @rhysd in #175
Only key by Cargo.toml and Cargo.lock files of workspace members by @max-heller in #180

New Contributors

@rhysd made their first contribution in #175
@max-heller made their first contribution in #180

Full Changelog: Swatinem/rust-cache@v2.7.1...v2.7.2

`v2.7.1`

Compare Source

`v2.7.0`

Compare Source

What's Changed

Fix save-if documentation in readme by @rukai in #166
Support for trybuild and similar macro testing tools by @neysofu in #168

New Contributors

@rukai made their first contribution in #166
@neysofu made their first contribution in #168

Full Changelog: Swatinem/rust-cache@v2.6.2...v2.7.0

`v2.6.2`

Compare Source

What's Changed

dep: Use smol-toml instead of toml by @NobodyXu in #164

Full Changelog: Swatinem/rust-cache@v2...v2.6.2

`v2.6.1`

Compare Source

Fix hash contributions of Cargo.lock/Cargo.toml files.

`v2.6.0`

Compare Source

What's Changed

Add "buildjet" as a second cache-provider backend @joroshiba in #154
Clean up sparse registry index.
Do not clean up src of -sys crates.
Remove .cargo/credentials.toml before saving.

New Contributors

@joroshiba made their first contribution in #154

Full Changelog: Swatinem/rust-cache@v2.5.1...v2.6.0

`v2.5.1`

Compare Source

Fix hash contribution of Cargo.lock.

`v2.5.0`

Compare Source

What's Changed

feat: Rm workspace crates version before caching by @NobodyXu in #147
feat: Add hash of .cargo/config.toml to key by @NobodyXu in #149

New Contributors

@NobodyXu made their first contribution in #147

Full Changelog: Swatinem/rust-cache@v2.4.0...v2.5.0

`v2.4.0`

Compare Source

Fix cache key stability.
Use 8 character hash components to reduce the key length, making it more readable.

`v2.3.0`

Compare Source

Add cache-all-crates option, which enables caching of crates installed by workflows.
Add installed packages to cache key, so changes to workflows that install rust tools are detected and cached properly.
Fix cache restore failures due to upstream bug.
Fix EISDIR error due to globed directories.
Update runtime @actions/cache, @actions/io and dev typescript dependencies.
Update npm run prepare so it creates distribution files with the right line endings.

`v2.2.1`

Compare Source

Update @actions/cache dependency to fix usage of zstd compression.

`v2.2.0`

Compare Source

Add new save-if option to always restore, but only conditionally save the cache.

`v2.1.0`

Compare Source

Only hash Cargo.{lock,toml} files in the configured workspace directories.

`v2.0.2`

Compare Source

Avoid calling cargo metadata on pre-cleanup.
Added prefix-key, cache-directories and cache-targets options.

`v2.0.1`

Compare Source

Primarily just updating dependencies to fix GitHub deprecation notices.

actions/checkout (actions/checkout)

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Compare Source

actions/download-artifact (actions/download-artifact)

`v8.0.1`

Compare Source

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in #471
Add a regression test for artifact name + content-type mismatches by @danwkennedy in #472

Full Changelog: actions/download-artifact@v8...v8.0.1

actions/upload-artifact (actions/upload-artifact)

`v7.0.1`

Compare Source

What's Changed

Update the readme with direct upload details by @danwkennedy in #795
Readme: bump all the example versions to v7 by @danwkennedy in #796
Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in #797

Full Changelog: actions/upload-artifact@v7...v7.0.1

anchore/sbom-action (anchore/sbom-action)

`v0.24.0`

Compare Source

v0.24.0

chore: update to node 24 + deps (#614) [@kzantow]
chore: update to ES modules (#595) [@kzantow]

⬆️ Dependencies

chore(deps): update Syft to v1.42.3 (#615) [@anchore-actions-token-generator[bot]]

`v0.23.1`

Compare Source

v0.23.1

⬆️ Dependencies

chore(deps): update Syft to v1.42.2 (#607) [@anchore-actions-token-generator[bot]]
chore(deps): bump fast-xml-parser and all other deps (#604) [@dependabot[bot]]

`v0.23.0`

Compare Source

v0.23.0

switch to single-file dist build with sub-action flags and update dependencies (#595) [@kzantow]
switch to esbuild (#590) [@willmurphyscode]
update Syft to v1.42.1 (#599) [@anchore-actions-token-generator[bot]]

`v0.22.2`

Compare Source

v0.22.2

⬆️ Dependencies

chore(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 (#581) [@dependabot[bot]]
chore(deps): update Syft to v1.41.2 (#582) [@anchore-actions-token-generator[bot]]
chore(deps-dev): bump the dev-dependencies group with 2 updates (#580) [@dependabot[bot]]
chore(deps): update Syft to v1.41.1 (#579) [@anchore-actions-token-generator[bot]]

`v0.22.1`

Compare Source

v0.22.1

⬆️ Dependencies

chore(deps): update Syft to v1.41.0 (#576) [@anchore-actions-token-generator[bot]]
chore(deps): bump lodash from 4.17.21 to 4.17.23 (#573) [@dependabot[bot]]

`v0.22.0`

Compare Source

Changes in v0.22.0

⬆️ Dependencies

chore(deps-dev): bump the dev-dependencies group with 19 updates (#566) [@dependabot]
chore(deps): bump npm-check-updates from 17.1.3 to 19.3.1 (#567) [@dependabot]
chore(deps): update Syft to v1.40.1 (#563) [@anchore-actions-token-generator[bot]]

chore(deps): update Syft to v1.39.0 (#561)
chore(deps): bump @octokit/request-error, @octokit/core and @octokit/webhooks (#560)
chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 (#558)

`v0.20.11`

Compare Source

Changes in v0.20.11

update Syft to v1.38.2 (#557)
bump @octokit/plugin-paginate-rest, @actions/artifact and @actions/github (#550) [[dependabot[bot]](https://github.com/dependabot[bot])]
bump js-yaml (#552) [[dependabot[bot]](https://github.com/dependabot[bot])]

`v0.20.10`

Compare Source

Changes in v0.20.10

chore(deps): update Syft to v1.38.0 (#548) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]

`v0.20.9`

Compare Source

Changes in v0.20.9

chore(deps): update Syft to v1.36.0 (#546) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]

`v0.20.8`

Compare Source

Changes in v0.20.8

chore(deps): update Syft to v1.34.2 (#545) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]

`v0.20.7`

Compare Source

Changes in v0.20.7

chore(deps): update Syft to v1.34.1 (#544)

`v0.20.6`

Compare Source

Changes in v0.20.6

chore(deps): update Syft to v1.33.0 (#537) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]
chore: update actions library to resolve critical vulnerability (#536) [spiffcs]

`v0.20.5`

Compare Source

Changes in v0.20.5

Update Syft to v1.31.0 (#531)

`v0.20.4`

Compare Source

Changes in v0.20.4

chore: update Syft to v1.29.0 (#529)

`v0.20.3`

Compare Source

Changes in v0.20.3

Fix: Strip emojis from correlator before using github APIs (#527) [AndrewHendry]

`v0.20.2`

Compare Source

Changes in v0.20.2

Update Syft to v1.28.0 (#526)

`v0.20.1`

Compare Source

Changes in v0.20.1

Update Syft to v1.27.1 (#525)

`v0.20.0`

Compare Source

Changes in v0.20.0

chore(deps): update Syft to v1.24.0 (#522)

`v0.19.0`

Compare Source

Changes in v0.19.0

chore(deps): update Syft to v1.23.0 (#521)
chore(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.8 (#519)
chore(deps): bump cross-spawn (#514)

`v0.18.0`

Compare Source

Changes in v0.18.0

chore(deps): update Syft to v1.19.0 (#513)
- See Syft changelog for latest changes

`v0.17.9`

Compare Source

Changes in v0.17.9

chore(deps): update Syft to v1.18.1 (#510) [anchore-actions-token-generator]
chore(deps): update Syft to v1.18.0 (#509) [anchore-actions-token-generator]

`v0.17.8`

Compare Source

Changes in v0.17.8

chore(deps): update Syft to v1.17.0 (#507) [anchore-actions-token-generator]

`v0.17.7`

Compare Source

Changes in v0.17.7

chore(deps): update Syft to v1.16.0 (#506) [anchore-actions-token-generator]

`v0.17.6`

Compare Source

Changes in v0.17.6

chore(deps): update Syft to v1.15.0 (#505) [anchore-actions-token-generator]
chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#504) [dependabot]

`v0.17.5`

Compare Source

Changes in v0.17.5

chore(deps): update Syft to v1.14.2 (#503) [anchore-actions-token-generator]

`v0.17.4`

Compare Source

Changes in v0.17.4

chore(deps): update Syft to v1.14.1 (#502) [anchore-actions-token-generator]

`v0.17.3`

Compare Source

Changes in v0.17.3

chore(deps): update Syft to v1.14.0 (#498) [anchore-actions-token-generator]

`v0.17.2`

Compare Source

Changes in v0.17.2

Update Syft to v1.11.1 (#485) [anchore-actions-token-generator]

`v0.17.1`

Compare Source

Changes in v0.17.1

chore(deps): update Syft to v1.11.0 (#483) [anchore-actions-token-generator]

`v0.17.0`

Compare Source

Changes in v0.17.0

chore(deps): update Syft to v1.9.0 (#479) [anchore-actions-token-generator]

`v0.16.1`

Compare Source

Changes in v0.16.1

fix: workaround windows install issue (#477) [willmurphyscode]
fix: allow users to properly use the file input over the default path value (#471) [komish]
chore(deps): update Syft to v1.5.0 (#470) [anchore-actions-token-generator]
docs: notes for matrix and required permissions (#469) [kzantow]
chore(deps): bump actions/checkout from 4.1.5 to 4.1.6 (#466) [dependabot]

`v0.16.0`: v0.16

Compare Source

Changes in v0.16.0

Update Syft to v1.4.1 (#465)
Update GitHub artifact client (#463) [kzantow]

NOTE: if you are using this action within a matrix build and see failures attempting to upload artifacts with duplicate names, you will need to set the artifact-name to be unique based on the matrix properties (an example here). This is due to a change to use a newer GitHub API which no longer allows artifacts with duplicate names.

`v0.15.11`

Compare Source

Changes in v0.15.11

chore(deps): update Syft to v1.3.0 (#456) [anchore-actions-token-generator]
chore: remove outdated snapshot workflow (#457) [spiffcs]
fix: don't pass in a separate env. This makes it impossible to pass env vars via the action context to syft. (#455) [iNoahNothing]

`v0.15.10`

Compare Source

Changes in v0.15.10

Update Syft to v1.1.0 (#454)
Bump Node to v20 on download-syft/publish-sbom actions (#448) [ViacheslavKudinov]

`v0.15.9`

Compare Source

Changes in v0.15.9

reduce syft debug level (#446) [kzantow]
update Syft to v0.105.0 (#442) [anchore-actions-token-generator]

`v0.15.8`

Compare Source

Changes in v0.15.8

Update Syft to v0.103.1 (#441) [anchore-actions-token-generator]

`v0.15.7`

Compare Source

Changes in v0.15.7

chore: migrate action to use node v20.11.0 (Iron) FROM node v16.x.x (#440) [spiffcs]

`v0.15.6`

Compare Source

Changes in v0.15.6

chore(deps): update Syft to v0.102.0 (#438) [anchore-actions-token-generator]

`v0.15.5`

Compare Source

Changes in v0.15.5

chore(deps): update Syft to v0.101.1 (#437) [anchore-actions-token-generator]

`v0.15.4`

Compare Source

Changes in v0.15.4

chore(deps): update Syft to v0.101.0 (#436) [anchore-actions-token-generator]

`v0.15.3`

Compare Source

Changes in v0.15.3

chore(deps): update Syft to v0.100.0 (#435) [anchore-actions-token-generator]

`v0.15.2`

Compare Source

Changes in v0.15.2

chore(deps): update Syft to v0.99.0 (#432) [anchore-actions-token-generator]
chore: fix github-script invocation in update-snapshots workflow (#433) [willmurphyscode]

`v0.15.1`

Compare Source

Changes in v0.15.1

chore(deps): update Syft to v0.98.0 (#431) [anchore-actions-token-generator]
Add config input (#430) [eyakubovich]
chore: pin and upgrade gh actions (#429) [willmurphyscode]

`v0.15.0`

Compare Source

Changes in v0.14.4

Breaking Changes

Previously, running on Windows required WSL. Now, running on Windows expects to be run on native windows (#426) [willmurphyscode].

Other Changes

pin and upgrade actions/checkout (#428) [willmurphyscode]
chore(deps): update Syft to v0.97.1 (#427) [anchore-actions-token-generator]
add oss community board auto-add workflow (#421) [wagoodman]

`v0.14.3`

Compare Source

Changes in v0.14.3

update Syft to v0.84.0 (#418) [anchore-actions-token-generator]

`v0.14.2`

Compare Source

Changes in v0.14.2

Update Syft to v0.80.0 (#415)
Make sure all invalid artifact name characters are replaced #396 (#417) [lts-po]
Ensure SBOM is copied to output-file (#411) [gszr]

`v0.14.1`

Compare Source

Changes in v0.14.1

chore(deps): update Syft to v0.76.0 (#403) [anchore-actions-token-generator]

`v0.13.4`

Compare Source

Changes in v0.13.4

Added support of workflow artifact's retention policy (#398) [ViacheslavKudinov]
Use the correct SHA for dependency snapshots from pull requests (#401) [juxtin]
Update Syft to v0.75.0 (#394) [anchore-actions-token-generator]

`v0.13.3`

Compare Source

Changes in v0.13.3

Update Syft to v0.68.1 (#391) [anchore-actions-token-generator]

`v0.13.2`

Compare Source

Changes in v0.13.2

Update Syft to v0.68.0 (#387) [anchore-actions-token-generator]

`v0.13.1`

Compare Source

Changes in v0.13.1

File input not being passed properly to Syft invocation (#385) [kzantow]
Update Syft to v0.60.3 (#386) [anchore-actions-token-generator]

`v0.13.0`

Compare Source

Changes in v0.13.0

Allow type "file:..." to enable creation of SBOMs from tar and other package formats (#357) [malt3]
Update Syft to v0.59.0 (#371) [anchore-actions-token-generator]
Update dependencies and node version (#372) [kzantow]

`v0.12.0`

Compare Source

Changes in v0.12.0

Update dependencies (#317) kzantow
Update Syft to v0.53.4 (#266) anchore-actions-token-generator
Expose upload-artifact and upload-release-assets inputs (#277) joshowen
Document the dependency-snapshot property (#297) kzantow

`v0.11.0`

Compare Source

Changes in v0.11.0

Update GitHub Snapshot to use correlator (#259) kzantow

`v0.10.0`

Compare Source

Changes in v0.10.0

Update Syft to v0.43.2 (#225)
Improve SBOM format handling (#235)

`v0.9.0`

Compare Source

Changes in v0.9.0

Add syft-version input to download-syft action (#228)

🐛 Bug Fixes

Don't use JSON.stringify for logging purposes (#236)

[`v0.8.

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between day 19 and 20 of the month (* * 19-20 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update github actions

544f630

kamphaus approved these changes May 19, 2026

View reviewed changes

kamphaus merged commit 20969c1 into main May 19, 2026
1 check passed

kamphaus deleted the renovate/github-actions branch May 19, 2026 20:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update github actions#197

Update github actions#197
kamphaus merged 1 commit into
mainfrom
renovate/github-actions

renovate Bot commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 19, 2026

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

v0.24.0

⬆️ Dependencies

v0.23.1

⬆️ Dependencies

v0.23.0

v0.22.2

⬆️ Dependencies

v0.22.1

⬆️ Dependencies

Changes in v0.22.0

⬆️ Dependencies

Changes in v0.21.1

Changes in v0.20.11

Changes in v0.20.10

Changes in v0.20.9

Changes in v0.20.8

Changes in v0.20.7

Changes in v0.20.6

Changes in v0.20.5

Changes in v0.20.4

Changes in v0.20.3

Changes in v0.20.2

Changes in v0.20.1

Changes in v0.20.0

Changes in v0.19.0

Changes in v0.18.0

Changes in v0.17.9

Changes in v0.17.8

Changes in v0.17.7

Changes in v0.17.6

Changes in v0.17.5

Changes in v0.17.4

Changes in v0.17.3

Changes in v0.17.2

Changes in v0.17.1

Changes in v0.17.0

Changes in v0.16.1

v0.16.0: v0.16

Changes in v0.16.0

Changes in v0.15.11

Changes in v0.15.10

Changes in v0.15.9

Changes in v0.15.8

Changes in v0.15.7

Changes in v0.15.6

Changes in v0.15.5

`v0.16.0`: v0.16