Skip to content

Bump the actions group with 2 updates - #1

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/actions-92fc61efd5
Closed

Bump the actions group with 2 updates#1
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/actions-92fc61efd5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown

Bumps the actions group with 2 updates: pnpm/action-setup and actions/download-artifact.

Updates pnpm/action-setup from 6.0.10 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

Commits

Updates actions/download-artifact from 7.0.0 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

JayYuen666 and others added 2 commits October 24, 2026 12:23
@JayYuen666
release 0.1.7：发布机器钉死动作与凭据边界，lib/config 审查轮收紧读取与合并契约
6350114 
exports 不变（无子路径增删改名），但 lib/ 与 config/ 不再与 0.1.6 逐字节相同，
八仓消费者已在同一棵树上全部过 check。

- 发布机器：四个 workflow 的三方 action 全部钉 commit SHA（tag 版本写同行注释）；
  并发组带 event_name、取消只限 push/PR；覆盖率上传走 if: always()；attest 独立
  job 持最小权限集；install 探针只拿 contents: read；checkout 一律
  persist-credentials: false；publish 的 npm 凭据不跨步骤，跨步骤的只有一枚布尔；
  job 上限 45 分钟；dependabot 撤掉 npm 块。README 双语新增「共享版本下限」一节；
  catalog 里本包下限 ^0.1.5 → ^0.1.6。
- config 基线：vitest 把 coverage 覆盖项从 test 拆成独立参数逐键合并（thresholds
  之内也逐键，test.coverage 出现即拒），include 放宽到 .spec/.tsx/.mts/.cts（纯
  超集，现量零命中），排除面补 .d.ts / test / node_modules，空 coverageInclude
  装载即抛；oxlint 的 sonarjs 逃生口只认确指向 sonarjs 的调用方入口，vitest 规则
  快照导出并加对 oxlint --rules 现量的一致性用例。
- lib：record 的 fieldOf/hasMethods 读取永不抛（敌意 getter / Proxy 塌成取不到），
  且不再把 Object.prototype 成员当服务实现；card-apply 的占位改每次 claim 现造
  symbol、清理只认自己那枚并按先前描述符恢复，flag 名装载即拒 Object.prototype
  成员；canonicalize-region-paths 新增 cwd 精确档（rel 前缀整段收，九仓 20 处
  build 调用点补 process.cwd()）并加跨行模板字面量的形状闸；text 的亚码元预算
  按零预算同口径；lesson-bus 的 report 收住 async onFailure、收口自身失败不再
  递归；card-diff 按表单语义逐值比较；project-key 认 UNC 共享根；job-outcome
  收掉 kill() 的异步拒绝、无退出码的完成记 0；jsonl 半切后的前导空行整段收
  （含 CRLF 形态）。
- 构建：build-host 导出 facets 并加四份同源清单的 parity 用例；新增
  build-types-check 挂在 build 链尾（dist/types 残留 .ts 系相对说明符即退 1）；
  build-shared 的 extraNames 过 packageNameOf 归一；.gitattributes 给
  *.bat / *.cmd 保留 CRLF。
- 消费者随本契约的同步在各仓自己的树里：ocr-review 的 providers 敌意 getter
  折进 namespace-unavailable，session-rescue 与 ocr-review 的 claimApply flag
  声明放宽到 | symbol。
@dependabot
Bump the actions group with 2 updates
4343da2 
Bumps the actions group with 2 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup) and [actions/download-artifact](https://github.com/actions/download-artifact).


Updates `pnpm/action-setup` from 6.0.10 to 6.1.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@0977fd9...ea17c68)

Updates `actions/download-artifact` from 7.0.0 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@37930b1...9000827)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 24, 2026
@JayYuen666 JayYuen666 closed this Oct 24, 2026
@JayYuen666
JayYuen666 deleted the dependabot/github_actions/actions-92fc61efd5 branch October 24, 2026 11:25
@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JayYuen666