Skip to content

chore(deps): bump the github-actions group with 9 updates#174

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-0d61e85fa1
Open

chore(deps): bump the github-actions group with 9 updates#174
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-0d61e85fa1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 13, 2026

Bumps the github-actions group with 9 updates:

Package From To
actions/checkout 4.3.1 6.0.2
actions/setup-node 4.4.0 6.3.0
actions/setup-java 4.8.0 5.2.0
google/osv-scanner-action 2.1.0 2.3.5
toshimaru/auto-author-assign 6a51ef50ddaa46de1440ab86bf7596a5e45f539d 16f0022cf3d7970c106d8d1105f75a1165edb516
actions/cache 4.3.0 5.0.5
maxim-lobanov/setup-xcode 1242409711ff5721add51979e9e11e23ebb7e5a4 ed7a3b1fda3918c0306d1b724322adc0b8cc0a90
peter-evans/create-pull-request 7.0.11 8.1.1
actions/stale 9.1.0 10.2.0

Updates actions/checkout from 4.3.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits

Updates actions/setup-node from 4.4.0 to 6.3.0

Release notes

Sourced from actions/setup-node's releases.

v6.3.0

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

What's Changed

Documentation

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

What's Changed

Enhancement:

Dependency updates:

... (truncated)

Commits

Updates actions/setup-java from 4.8.0 to 5.2.0

Release notes

Sourced from actions/setup-java's releases.

v5.2.0

What's Changed

Enhancement

Documentation Changes

Dependency Updates

New Contributors

Full Changelog: actions/setup-java@v5...v5.2.0

v5.1.0

What's Changed

New Features

Bug Fixes & Improvements

Documentation changes

Dependency updates

New Contributors

Full Changelog: actions/setup-java@v5...v5.1.0

... (truncated)

Commits
  • be666c2 Chore: Version Update and Checkout Update to v6 (#973)
  • f7a6fef Bump actions/checkout from 5 to 6 (#961)
  • d81c4e4 Upgrade @​actions/cache to v5 (#968)
  • 1b1bbe1 readme update (#972)
  • 5d7b214 Retry on HTTP 522 Connection timed out (#964)
  • f2beeb2 Bump actions/publish-action from 0.3.0 to 0.4.0 (#912)
  • 4e7e684 feat: Add support for .sdkmanrc file in java-version-file parameter (#736)
  • 46c56d6 Add GitHub Token Support for GraalVM and Refactor Code (#849)
  • 66b9457 Update SapMachine URLs (#955)
  • 6ba5449 Enhance error logging for network failures to include endpoint/IP details, ad...
  • Additional commits viewable in compare view

Updates google/osv-scanner-action from 2.1.0 to 2.3.5

Release notes

Sourced from google/osv-scanner-action's releases.

v2.3.5

This updates OSV-Scanner to v2.3.5.

What's Changed

New Contributors

Full Changelog: google/osv-scanner-action@v2.3.3...v2.3.5

v2.3.3

This updates OSV-Scanner to v2.3.3.

What's Changed

New Contributors

Full Changelog: google/osv-scanner-action@v2.3.2...v2.3.3

v2.3.2

This updates OSV-Scanner to v2.3.2

This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.

Fixes:

Misc:

Full Changelog: google/osv-scanner@v2.3.1...v2.3.2

v2.3.1

What's Changed

... (truncated)

Commits
  • c518547 Merge pull request #124 from google/update-to-v2.3.5
  • 1fc5ec2 Update unified workflow example to point to v2.3.5 reusable workflows
  • 3d5827d Update reusable workflows to point to v2.3.5 actions
  • 7222d1c "Update actions to use v2.3.5 osv-scanner image"
  • a30b4c3 Merge pull request #120 from google/lsc-1771431861.8381045
  • 62f47c7 Fix missing env var after the initial change
  • b7ee968 Refactor Github Action per b/485167538
  • c5996e0 Merge pull request #118 from google/update-to-v2.3.3
  • f4fac92 Update unified workflow example to point to v2.3.3 reusable workflows
  • 8ae4be8 Update reusable workflows to point to v2.3.3 actions
  • Additional commits viewable in compare view

Updates toshimaru/auto-author-assign from 6a51ef50ddaa46de1440ab86bf7596a5e45f539d to 16f0022cf3d7970c106d8d1105f75a1165edb516

Changelog

Sourced from toshimaru/auto-author-assign's changelog.

Changelog

3.0.1 (2025-12-25)

Miscellaneous Chores

3.0.0 (2025-12-21)

Features

  • Add npm run package instead of build (#130) (972720f)

Miscellaneous Chores

2.1.2 (2025-12-16)

2.1.1 (2024-06-26)

2.1.0 (2024-01-17)

2.0.1 (2023-09-26)

2.0.0 (2023-09-24)

1.6.2 (2023-01-03)

  • chore: dependencies update

1.6.1 (2022-08-01)

  • doc: README Update

1.6.0 (2022-07-28)

  • feat: Add auto-author-assign for the issues

1.5.1 (2022-07-22)

1.5.0 (2022-03-28)

  • Bump node from node12 to node16

1.4.0 (2021-10-17)

... (truncated)

Commits

Updates actions/cache from 4.3.0 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits
  • 27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
  • f280785 licensed changes
  • 619aeb1 npm run build generated dist files
  • bcf16c2 Update ts-http-runtime to 0.3.5
  • 6682284 Merge pull request #1738 from actions/prepare-v5.0.4
  • e340396 Update RELEASES
  • 8a67110 Add licenses
  • 1865903 Update dependencies & patch security vulnerabilities
  • 5656298 Merge pull request #1722 from RyPeck/patch-1
  • 4e380d1 Fix cache key in examples.md for bun.lock
  • Additional commits viewable in compare view

Updates maxim-lobanov/setup-xcode from 1242409711ff5721add51979e9e11e23ebb7e5a4 to ed7a3b1fda3918c0306d1b724322adc0b8cc0a90

Commits

Updates peter-evans/create-pull-request from 7.0.11 to 8.1.1

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.1.1

What's Changed

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

Create Pull Request v8.1.0

What's Changed

New Contributors

Full Changelog: peter-evans/create-pull-request@v8.0.0...v8.1.0

Create Pull Request v8.0.0

What's new in v8

What's Changed

New Contributors

Full Changelog: peter-evans/create-pull-request@v7.0.11...v8.0.0

Commits
  • 5f6978f fix: retry post-creation API calls on 422 eventual consistency errors (#4356)
  • d32e88d build(deps-dev): bump the npm group with 3 updates (#4349)
  • 8170bcc build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)
  • 0041819 build(deps): bump picomatch (#4339)
  • b993918 build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)
  • 36d7c84 build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)
  • a45d1fb build(deps): bump @​tootallnate/once and jest-environment-jsdom (#4323)
  • 3499eb6 build(deps): bump the github-actions group with 2 updates (#4316)
  • 3f3b473 build(deps): bump minimatch (#4311)
  • 6699836 build(deps-dev): bump the npm group with 2 updates (#4305)
  • Additional commits viewable in compare view

Updates actions/stale from 9.1.0 to 10.2.0

Release notes

Sourced from actions/stale's releases.

v10.2.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.2.0

v10.1.1

What's Changed

Bug Fix

Improvement

Dependency Upgrades

@dependabot
chore(deps): bump the github-actions group with 9 updates
b2746ca 
Bumps the github-actions group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.3.0` |
| [actions/setup-java](https://github.com/actions/setup-java) | `4.8.0` | `5.2.0` |
| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.1.0` | `2.3.5` |
| [toshimaru/auto-author-assign](https://github.com/toshimaru/auto-author-assign) | `6a51ef50ddaa46de1440ab86bf7596a5e45f539d` | `16f0022cf3d7970c106d8d1105f75a1165edb516` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.5` |
| [maxim-lobanov/setup-xcode](https://github.com/maxim-lobanov/setup-xcode) | `1242409711ff5721add51979e9e11e23ebb7e5a4` | `ed7a3b1fda3918c0306d1b724322adc0b8cc0a90` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `7.0.11` | `8.1.1` |
| [actions/stale](https://github.com/actions/stale) | `9.1.0` | `10.2.0` |


Updates `actions/checkout` from 4.3.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.3.1...de0fac2)

Updates `actions/setup-node` from 4.4.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@49933ea...53b8394)

Updates `actions/setup-java` from 4.8.0 to 5.2.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@c1e3236...be666c2)

Updates `google/osv-scanner-action` from 2.1.0 to 2.3.5
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](google/osv-scanner-action@b00f71e...c518547)

Updates `toshimaru/auto-author-assign` from 6a51ef50ddaa46de1440ab86bf7596a5e45f539d to 16f0022cf3d7970c106d8d1105f75a1165edb516
- [Release notes](https://github.com/toshimaru/auto-author-assign/releases)
- [Changelog](https://github.com/toshimaru/auto-author-assign/blob/main/CHANGELOG.md)
- [Commits](toshimaru/auto-author-assign@6a51ef5...16f0022)

Updates `actions/cache` from 4.3.0 to 5.0.5
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0057852...27d5ce7)

Updates `maxim-lobanov/setup-xcode` from 1242409711ff5721add51979e9e11e23ebb7e5a4 to ed7a3b1fda3918c0306d1b724322adc0b8cc0a90
- [Release notes](https://github.com/maxim-lobanov/setup-xcode/releases)
- [Commits](maxim-lobanov/setup-xcode@1242409...ed7a3b1)

Updates `peter-evans/create-pull-request` from 7.0.11 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@22a9089...5f6978f)

Updates `actions/stale` from 9.1.0 to 10.2.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@5bef64f...b5d41d4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: google/osv-scanner-action
  dependency-version: 2.3.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: toshimaru/auto-author-assign
  dependency-version: 16f0022cf3d7970c106d8d1105f75a1165edb516
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: maxim-lobanov/setup-xcode
  dependency-version: ed7a3b1fda3918c0306d1b724322adc0b8cc0a90
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/stale
  dependency-version: 10.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 13, 2026
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 13, 2026

🔍 Semgrep Security Scan Results

✅ No security findings detected by p/security-audit ruleset.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants