chore(deps): bump the github-actions group across 1 directory with 9 updates#2636
chore(deps): bump the github-actions group across 1 directory with 9 updates#2636dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
|
||
| - name: Create pull request | ||
| uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v7 | ||
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7 |
There was a problem hiding this comment.
🟡 The trailing comment on this line still reads # v7, but the SHA 5f6978f corresponds to peter-evans/create-pull-request v8.1.1 (per the Dependabot description). This is a pre-existing inaccuracy — the old SHA was already v8.1.0 with the same # v7 comment — and Dependabot won't auto-correct it because it only rewrites comments that match a full-semver pattern. Since this line is being touched anyway, consider updating the comment to # v8.1.1 so it tracks correctly on future bumps.
Extended reasoning...
What the bug is. In .github/workflows/weekly-lockfile-update.yml line 32, the action pin was bumped from c0f553fe549906ede9cf27b5156039d195d2ece0 to 5f6978faf089d4d20b00c7766989d076bb2fc7f1, but the trailing version comment still says # v7. According to the Dependabot PR description, this bump is peter-evans/create-pull-request 8.1.0 → 8.1.1, so the SHA actually corresponds to v8.1.1 — a full major version newer than what the comment claims.
Why Dependabot didn't fix it. Dependabot rewrites the trailing version comment when it recognizes the existing comment as the version it is replacing (a full vX.Y.Z string matching the old version). Here the pre-existing comment was # v7, which didn't match the old version v8.1.0, so Dependabot preserved it verbatim — the same way it preserved # release/v1 on the pypa/gh-action-pypi-publish pin in this PR. This means the comment will keep being left as # v7 on every future bump until someone manually corrects it to a proper full-semver comment.
This is pre-existing. The comment was already wrong before this PR: c0f553fe... is v8.1.0, and the line said # v7 then too. This PR did not introduce the staleness; it just carried it forward. It is also worth noting that contrary to first impressions, not every other pin's comment was updated in this PR — pypa/gh-action-pypi-publish retained its # release/v1 comment for the same reason.
Impact. The SHA pin is what actually executes, so there is zero functional impact. But the entire point of putting a human-readable version comment next to an opaque SHA pin is so reviewers can audit at a glance. A reviewer auditing this workflow would be told they're running v7 of create-pull-request when they're actually running v8.1.1 — two major versions off. That defeats the purpose of the comment and could mislead someone reasoning about which features or breaking changes apply.
How to fix. Change the comment to # v8.1.1 (the exact version corresponding to the pinned SHA). Once the comment matches a full-semver string, Dependabot will keep it in sync automatically on future bumps. Note that hand-editing a Dependabot PR is normally avoided since it can interfere with auto-rebase — an alternative is to land this PR as-is and apply the one-character comment fix in a tiny follow-up.
Step-by-step proof:
- The diff line 32 changes
uses: peter-evans/create-pull-request@c0f553fe... # v7touses: peter-evans/create-pull-request@5f6978f... # v7— only the SHA changed, not the comment. - The Dependabot PR description states:
peter-evans/create-pull-request8.1.0 → 8.1.1, with commit linkpeter-evans/create-pull-request/commit/5f6978faf089d4d20b00c7766989d076bb2fc7f1listed under v8.1.1. - Therefore the SHA on line 32 is v8.1.1, but the comment claims v7 — the comment is stale by a full major version.
- Compare to
actions/checkoutlines elsewhere in this PR:# v4.3.1→# v6.0.2. Those comments were updated because the old comment exactly matched the old version, which Dependabot recognizes and rewrites.# v7did not matchv8.1.0, so it was left alone.
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-838d6d6bfb
branch
from
562d7b8 to
d69f730
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Create pull request | ||
| uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v7 | ||
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7 |
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-838d6d6bfb
branch
from
d69f730 to
4d1f444
Compare
…updates Bumps the github-actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.3` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.53` | `1.0.148` | | [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.2.1` | `8.2.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.4.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` | Updates `actions/checkout` from 4.3.1 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.3.1...df4cb1c) Updates `anthropics/claude-code-action` from 1.0.53 to 1.0.148 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@2f8ba26...d5726de) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@ed59741...3a2844b) Updates `astral-sh/setup-uv` from 7.2.1 to 8.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@803947b...fac544c) Updates `actions/setup-node` from 6.2.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@6044e13...48b55a0) Updates `actions/upload-artifact` from 6.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b7c566a...043fb46) Updates `actions/download-artifact` from 7.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@37930b1...3e5f45b) Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210) Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@c0f553f...5f6978f) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.123 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-838d6d6bfb
branch
from
4d1f444 to
63ba00a
Compare
1 participant
Bumps the github-actions group with 9 updates in the / directory:
4.3.16.0.31.0.531.0.1488.0.09.0.07.2.18.2.06.2.06.4.06.0.07.0.17.0.08.0.11.13.01.14.08.1.08.1.1Updates
actions/checkoutfrom 4.3.1 to 6.0.3Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
df4cb1cUpdate changelog for v6.0.3 (#2446)1cce339Fix checkout init for SHA-256 repositories (#2439)900f221fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)0c366fdUpdate changelog (#2357)de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)Updates
anthropics/claude-code-actionfrom 1.0.53 to 1.0.148Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
d5726dechore: bump Claude Code to 2.1.177 and Agent SDK to 0.3.17756fa348chore: bump Claude Code to 2.1.176 and Agent SDK to 0.3.17682d95d4Add pr-stamp-sweep review workflow (#1409)0cb4f3echore: bump Claude Code to 2.1.175 and Agent SDK to 0.3.1758551f4bfix(image-downloader): detect image type from magic bytes (#1396)eba921fdocs: fix execution file parsing example (#1297)36617bdfix(sanitizer): match attribute quotes by type to avoid mangling content (#1371)24b9156Include labels in formatContext() output for issues and PRs (#1298)9441a7ffix: clear stale claude-prompts dir before each write (#1288)b371255pin setup-bun path for post steps (#1365)Updates
actions/github-scriptfrom 8.0.0 to 9.0.0Release notes
Sourced from actions/github-script's releases.
Commits
3a2844bMerge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...ca10bbdfix: use@octokit/core/types import for v7 compatibility86e48e2merge: incorporate main branch changesc108472chore: rebuild dist for v9 upgrade and getOctokit factoryafff112Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...ff8117eci: fix user-agent test to handle orchestration ID81c6b78ci: use deployment: false to suppress deployment noise from integration tests3953cafdocs: update README examples from@v8to@v9, add getOctokit docs and v9 brea...c17d55bci: add getOctokit integration test joba047196test: add getOctokit integration tests via callAsyncFunctionUpdates
astral-sh/setup-uvfrom 7.2.1 to 8.2.0Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
fac544cchore(deps): roll up dependabot updates (#903)7390f77docs: update dependabot rollup biome guidance (#902)363c64achore(deps): roll up dependabot updates (#901)c4fcbafchore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#900)8e642c5chore: update known checksums for 0.11.18 (#899)a92cb43Add quiet input to suppress info-level log output (#898)e07f2acchore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 (#842)bc4034echore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 (#893)df42d4fchore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 (#891)b9c8c4cfeat: adddownload-from-astral-mirrorinput (#897)Updates
actions/setup-nodefrom 6.2.0 to 6.4.0Release notes
Sourced from actions/setup-node's releases.
Commits
48b55a0Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)ab72c7eUpgrade@actionsdependencies (#1525)53b8394Bump minimatch from 3.1.2 to 3.1.5 (#1498)54045abScope test lockfiles by package manager and update cache tests (#1495)c882bffReplace uuid with crypto.randomUUID() (#1378)774c1d6feat(node-version-file): support parsingdevEnginesfield (#1283)efcb663fix: remove hardcoded bearer (#1467)d02c89dFix npm audit issues (#1491)Updates
actions/upload-artifactfrom 6.0.0 to 7.0.1Release notes
Sourced from actions/upload-artifact's releases.
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testUpdates
actions/download-artifactfrom 7.0.0 to 8.0.1Release notes
Sourced from actions/download-artifact's releases.
Commits
3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issuesbd7976bAdd a setting to specify what to do on hash mismatch and default it toerrorac21fcfMerge pull request #460 from actions/danwkennedy/download-no-unzip15999bfAdd note about package bumps974686eBump the version tov8and add release notesfbe48b1Update test names to make it clearer what they doUpdates
pypa/gh-action-pypi-publishfrom 1.13.0 to 1.14.0Release notes
Sourced from pypa/gh-action-pypi-publish's releases.
Commits
cef2210Merge pull request #397 from whitequark/patch-1b4595e2Enableverboseandprint-hashby default.e2bab26Merge pull request #395 from him2him2/docs/fix-typos-and-grammar7495c38docs: fix typos and grammar in README and SECURITY03f86feMerge pull request #388 from woodruffw-forks/ww/rm-experimental4c78f1cMerge branch 'unstable/v1' into ww/rm-experimentalb5a6e8bdeps: bump sigstore and pypi-attestationsa48a03eremove another experimental mention8087a88action: remove a lingering mention of PEP 740 being experimental3317ede🧪 Integrate actionlint via pre-commit frameworkUpdates
peter-evans/create-pull-requestfrom 8.1.0 to 8.1.1Release notes
Sourced from peter-evans/create-pull-request's releases.
Commits
5f6978ffix: retry post-creation API calls on 422 eventual consistency errors (#4356)d32e88dbuild(deps-dev): bump the npm group with 3 updates (#4349)8170bccbuild(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)0041819build(deps): bump picomatch (#4339)b993918build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)36d7c84build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)a45d1fbbuild(deps): bump@toot...Description has been truncated