Skip to content

chore(deps): update github-actions (major) - #113

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions
Open

chore(deps): update github-actions (major)#113
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
actions/checkout action major v5 → v7 age confidence
actions/setup-node action major v6 → v7 age confidence
marocchino/sticky-pull-request-comment action major v2 → v3.0.5 age confidence
pnpm (source) uses-with major 10.33.4 → 12.5.1 12.6.0 age confidence
pnpm/action-setup action major v2 → v6 age confidence
pnpm/action-setup action major v4 → v6 age confidence

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

v6.1.0

Compare Source

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.1.0

Compare Source

v5.0.1

Compare Source

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency update:
New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

Compare Source

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

Compare Source

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

Compare Source

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:
Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

What's Changed

Documentation
Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

Compare Source

What's Changed

Enhancement:
Dependency updates:
Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

marocchino/sticky-pull-request-comment (marocchino/sticky-pull-request-comment)

v3.0.5

Compare Source

v3.0.4

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.3...v3.0.4

v3.0.3

Compare Source

What's Changed
New Contributors

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.2...v3.0.3

v3.0.2

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.1...v3.0.2

v3.0.1

Compare Source

What's Changed
  • Update deps
  • Change build system from ncc to rollup
  • Use pull_request trigger in github action

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.0...v3.0.1

v3.0.0

Compare Source

What's Changed
  • Update node to 24
  • Update deps
New Contributors

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.4...v3.0.0

v2.9.4

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.3...v2.9.4

v2.9.3

Compare Source

What's Changed
  • Update deps (including security issues)
  • Test with vitest instead of jest
  • Use biome

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.2...v2.9.3

v2.9.2

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.1...v2.9.2

v2.9.1

Compare Source

What's Changed
New Contributors

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.0...v2.9.1

v2.9.0

Compare Source

  • Update deps
  • Use node 20

v2.8.0

Compare Source

  • Add skip_unchanged input
  • Update deps

v2.7.0

Compare Source

Update deps.
Add two output.

  • previous_comment_id: "ID of previous comment, if found"
  • created_comment_id: "ID of newly created comment, if any"

v2.6.2

Compare Source

Reverted changes in version 2.6. As a result, the base_url has been removed.

v2.6.1

Compare Source

Change base_url default to ${{ env.GITHUB_API_URL }}

v2.6.0

Compare Source

v2.5.0

Compare Source

  • Update deps
  • Add only_update option.
  • Add owner option.

v2.4.0

Compare Source

  • Update deps
  • Add only_create option.

v2.3.1

Compare Source

  • Update deps
  • Change ignore empty default from true to false (This change will fix bug delete or hide comment not works)

v2.3.0

Compare Source

  • Support glob path
  • Add follow_symbolic_links for path
  • Add ignore_empty for skip empty body
  • Update README for new output syntax

v2.2.1: Update deps

Compare Source

  • Use node 16
  • Update npm deps

v2.2.0

Compare Source

Add hide, hide_details, hide_and_recreate, hide_classsify options

v2.1.1

Compare Source

v2.1.0: Set GitHub token by default

Compare Source

Features

Bug fix

  • Fix unexpected delete fail #​226
  • Convert buffer to string when file read #​202
  • Fix boolean handling #​215
pnpm/pnpm (pnpm)

v12.5.1: pnpm 12.5.1

Compare Source

Patch Changes

  • pnpm now reports an unknown task setting in pnpm-workspace.yaml and carries on. It used to refuse to start, so a project could not use a task setting that only the pnpm version its packageManager pins reads. The setting is still an error when the running pnpm is that pinned version.

  • Python interpreter installation now retries historical release metadata requests. It caches the release list for up to 24 hours and refreshes it once after a lookup miss. When a release omits the current platform, the search samples at most eight other releases before reporting that the lookup is inconclusive.

  • Python registries entries now route packages by exact names or trailing-prefix patterns in packages. Registry declaration order no longer affects resolution. A matched package resolves exclusively from its assigned registry, including transitive and build dependencies. Use packages: ["*"] to declare the default index.

  • pnpm install no longer fails with "Too many levels of symbolic links" when a Cargo configuration file above the workspace is a symlink, such as a ~/.cargo/config.toml linked from a dotfiles repository.

  • pnpm install now returns "Already up to date" in a workspace where dedupeDirectDeps left a project without a node_modules directory of its own. Such a project forced a full install on every run.

  • pnpm install no longer refuses the repeat-install fast path just because a changed pnpm-lock.yaml is 16 MiB or larger. Such a lockfile forced a full install on the run after every change.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.5.0: pnpm 12.5

Compare Source

pnpm 12.5.0 makes Python a first-class ecosystem, accepts Package URLs in pnpm add, names whole platforms in supportedArchitectures, and gives tasks machine-wide concurrency limits. It also fixes an install that could reuse one package's downloaded tarball for another.

Minor Changes

Installing packages

  • pnpm add accepts a Package URL in place of a package name. pnpm add pkg:npm/express@4.18.2 saves express to package.json. pnpm add pkg:cargo/serde@1.0.188 saves serde to Cargo.toml. pnpm add pkg:pypi/requests@2.31.0 saves requests to pyproject.toml. pkg is now a reserved specifier prefix, whatever case it is written in, so a named registry can no longer be called pkg.

  • A registries entry can now name the ecosystem it serves.

    registries:
  https://internal.example/simple/:
    ecosystem: pypi
  https://pypi.org/simple/:
    ecosystem: pypi
  https://index.crates.io/:
    ecosystem: cargo

    ecosystem accepts npm, cargo and pypi. An entry that does not name one serves npm, as every entry did before.

    An ecosystem with several indexes searches them in the order they are declared. The first index that has a package supplies it, so the one declared last answers what none before it had.

    A registries entry may not carry credentials. pnpm reads them from .npmrc, matched by origin, for a PyPI index as for every other package source.

Configuring pnpm

  • supportedArchitectures now accepts a list of platforms, in place of the os, cpu and libc axes.

    supportedArchitectures:
  - linux-x64
  - darwin-arm64
  - win32-x64

    An install prepares for the platforms the list names, and for those only. A platform reads as <os>-<cpu>, with a C library on Linux, as in linux-x64-musl or linux-x64-manylinux_2_28. The Rust target triple of the same machine is accepted too, so x86_64-unknown-linux-gnu names the platform linux-x64 names. A Linux platform that names no C library is the glibc platform. current is the platform the install runs on.

    The os, cpu and libc mapping keeps working and keeps its meaning.

  • Added concurrency groups for tasks. A task in pnpm-workspace.yaml can name a concurrencyGroup. The new concurrencyGroups setting gives each group a limit. At most that many tasks of the group run at once on the machine, counted across every pnpm process, pnpm pipeline included. A task past the limit waits for a running one to finish. A script that calls pnpm run for a task of the same group runs under the slot its parent holds.

    tasks:
  test:rust:
    concurrencyGroup: cargo
concurrencyGroups:
  cargo: 2

  • tools names the programs pnpm downloads, and mirror says where each one comes from.

    tools:
  node:
    mirror: https://mirror.example.com/node/download
    channels:
      nightly: https://nightly.example.com/
  bun:
    mirror: https://mirror.example.com/bun
  python:
    mirror: https://mirror.example.com/python-build-standalone/releases

    node, bun and python can be named. Any other tool is refused.

    mirror is the base a tool's own layout hangs off.

    channels sends one release channel elsewhere. A channel neither it nor node-mirror:<channel> names is left to mirror. Only node publishes channels, so naming them for another tool is refused.

    Set it in the global config.yaml or in PNPM_CONFIG_TOOLS. A pnpm-workspace.yaml that names a tool mirror is ignored.

    pnpm pack-app downloads the Node.js it embeds through tools.node. node-mirror:<channel> keeps working and names the same thing as an entry under channels.

Python interpreters and environments

  • pnpm install now chooses a Python interpreter for each project instead of installing every project with one interpreter #​14945. A project is installed with the first interpreter on the machine that its requires-python accepts, so a workspace can hold projects that support different Python versions. pnpm reads .python-version too, and prefers the version it asks for. Set python.executable in pnpm-workspace.yaml to name one interpreter for every project.

  • pnpm install now installs a Python interpreter when no interpreter on the machine fits the project #​14945. The builds are python-build-standalone's, which uv and rye install too. One interpreter is shared by every project on the machine, and a later install uses it without downloading anything. runtimeOnFail decides what an install with no interpreter that fits does, the way it does for a Node.js runtime. error reports the project instead of installing one. warn and ignore install with an interpreter the machine has that the project's requires-python rejects. tools.python.mirror names a mirror.

  • Python environments now live in the store. Each project keeps only its .venv link, which points at the project's current environment generation under python-envs in the store. A repository with many Python projects no longer holds a .pnpm/python-envs directory in each of them. The next install relinks a .venv that an earlier release published. The old .pnpm/python-envs directory is left in place, since a running program may still use it, and can be deleted once none does. With frozenStore set, pnpm writes nothing to the store, so environments stay in the project's .pnpm/python-envs #​15014.

  • Python environments now use packageImportMethod to import wheel files from the store. Use clone-or-copy for copy-on-write clones with a copy fallback, or copy for independent files. Hardlinked files share writes with the store and other environments.

    Isolated Python build environments keep backend writes private with copy-on-write clones or copies.

Python projects and workspaces

  • pnpm install now installs a Python project's own package, so the project can be imported and the commands in [project.scripts] run right after an install #​14945. The installed package points at the source tree, so an edit to a module takes effect without another install. pnpm installs the package of a project that declares a [build-system]. tool.uv.package overrides that either way.

  • pnpm install now installs a Python project in the workspace from its own source. Declare it under [tool.uv.sources], as shared = { workspace = true } or shared = { path = "../shared", editable = true }. pnpm builds the project with the backend it declares. It installs the build editable, so an edit to the project takes effect without another install.

    Approve the build backend under allowBuilds in pnpm-workspace.yaml as a Package URL, as pkg:pypi/hatchling: true. An install that has not approved a backend does not build the projects that need it. The message names the key to add.

    pnpm install now refuses a requirement that names a project in the workspace when nothing declares where it comes from. It used to take that name from the index.

  • The members of a uv workspace can now share one Python environment. Set shared-environment = true under [tool.pnpm.python] in the pyproject.toml that declares [tool.uv.workspace]. pnpm install then resolves every member as one graph into one pylock.toml and one .venv at the workspace root. Two members that require versions of a distribution no release satisfies at once are refused with an error naming both. Each project still gets an environment of its own by default #​15015.

  • Python projects can now select extras and dependency groups through [tool.pnpm.python] in pyproject.toml #​14945. Workspace python.extras and python.groups defaults now skip names a project does not define.

  • pnpm install now reads dynamic Python project metadata from the build backend #​14945. Projects with only a requirements.txt file now get a Python environment and lockfile.

Python dependencies and lockfiles

  • pnpm can now resolve pylock.toml for several platforms and Python versions at once. supportedArchitectures names the platforms to lock for and python.versions the versions. Every platform is paired with every version. One committed lockfile then serves Linux CI and macOS or Windows contributors #​14945.

    supportedArchitectures:
  - linux-x64-manylinux_2_28
  - darwin-arm64
  - win32-x64
python:
  enabled: true
  versions: ['3.12', '3.13']

    The lockfile pins the wheel each environment takes for a distribution. It marks a package only some environments install. pnpm install takes the packages and wheels of the environment its interpreter matches, and refuses an interpreter none of them stand for. pnpm resolves a project that declares environments itself, not through the server pnprServer names. Naming neither setting locks for the interpreter running the install.

  • python.overrides and python.constraints pin the versions a Python resolution may pick #​14945. pnpm reads uv's own overrides and constraints from pyproject.toml too.

  • pnpm install now supports Python dependencies from Git repositories #​14945. Direct wheel URLs are also supported. Sources can be declared in [tool.uv.sources]. Git dependencies require allowBuilds approval.

  • pnpm install can install a Python release that publishes no wheel this interpreter accepts, by building the source distribution the index serves beside it #​14945. The archive is pinned in pylock.toml by name and SHA-256. A later install replays it from the store, offline included. Building a source distribution runs the release's own build backend. Approve it with pkg:pypi/<distribution>: true under allowBuilds.

    A resolution that finds no version of a distribution now says why. It tells apart a distribution no index publishes, one whose releases publish nothing this interpreter can install, and one whose versions the project's requirements exclude.

Patch Changes

Installing packages

  • pnpm no longer reuses one package's downloaded tarball for another package whose resolution pins a different integrity hash to the same URL #​15021.

  • pnpm install and pnpm add now report an error when package.json, pnpm-lock.yaml, pyproject.toml or another file they snapshot before installing is a named pipe or a device. The command used to wait forever for something to write to it.

  • pnpm install --prod and pnpm install --dev now record every dependency group in pnpm-lock.yaml. node_modules still holds only the groups the filter selects. They used to write the filter into the lockfile, so a later pnpm install --frozen-lockfile rejected it. pnpm prune --prod, pnpm prune --dev, and pnpm prune --no-optional behave the same way #​14912.

  • POSIX bin shims now convert a Windows-form path such as C:\node_modules\.bin\tsc correctly. The shim mangled the backslashes in such a path and could not reach the package it runs. Installing again replaces the shims already in node_modules #​14867.

  • Two pnpm processes installing one workspace at the same time no longer fail on Windows with "Access is denied" while writing node_modules/.pnpm-workspace-state-v1.json. The write now retries the transient lock the other process holds, as pnpm's other file writes do.

  • pnpm now reads the manifest from the tarball when a pnpmfile resolvers hook returns a resolution without one. Such a package installed alone, with none of its own dependencies and no warning #​15000.

  • pnpm install now merges Git conflict markers in pnpm-lock.yaml. It parses both sides of the conflict and keeps the versions they locked. A conflict in the config dependencies recorded at the top of the lockfile is merged too #​14880.

Cargo projects

  • pnpm install can now generate Cargo.lock for workspaces with path or Git [patch] and [replace] overrides. Adding, removing, and updating crates also preserve these overrides #​14950.

    Cargo lockfile resolution blocks unsupported Git transport helpers declared by transitive dependencies.

  • pnpm install now vendors recursive Git submodules for Cargo dependencies at their pinned commits. Cargo builds can use these sources offline. Set Git's protocol.file.allow to always to fetch local file submodules. pnpm fetches cached Git crates again on the first online install #​14951.

  • pnpm install now generates Cargo.lock for workspaces with Git dependencies, including a dependency that omits a package version. It also downloads the Rust standard library's dependencies when Cargo configuration enables build-std #​14944.

  • pnpm install now handles weak Cargo features, written crate?/feature. Resolution failed when one dependency turned on an optional crate and another asked for a weak feature of it #​14960. The generated Cargo.lock now also includes the dependencies weak features reference, which Cargo rejected with --locked for crates such as uuid #​14978.

  • pnpm install now generates Cargo.lock when a crate version it considers depends on a release the registry carries only as yanked. pnpm rules that version out and resolves the rest of the graph. Resolution failed with an error such as `no non-yanked version o

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 2am and before 3am"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 4 times, most recently from 41c60df to 49aa220 Compare August 6, 2026 18:06
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from c27f8af to 9bd694c Compare August 18, 2026 17:41
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 3 times, most recently from b9b0e87 to 6944f59 Compare September 1, 2026 18:36
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 7 times, most recently from 62017e2 to 739751c Compare September 11, 2026 17:03
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from 0fc8bc2 to 7181b95 Compare September 18, 2026 21:04
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 7181b95 to 2f3e5b2 Compare September 21, 2026 20:52
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 2f3e5b2 to ec00f47 Compare September 22, 2026 02:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants