Skip to content

Bump the github-actions group with 6 updates - #378

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-ae9886701e
Open

Bump the github-actions group with 6 updates#378
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-ae9886701e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown

Bumps the github-actions group with 6 updates:

Package From To
actions/checkout 7.0.0 7.0.1
actions/create-github-app-token 2.2.2 3.3.0
actions/setup-node 7.0.0 7.1.0
actions/upload-artifact 4.6.2 7.0.2
actions/download-artifact 5.0.0 8.0.2
hraness/.github/actions/npm-visible 9ddbd8f7187e4528278cf078159702ea333418ce c2cee53d72879c7829d3d6e47e61327369168260

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/create-github-app-token from 2.2.2 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

v3.2.0

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

  • improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

  • deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4.6.2 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

... (truncated)

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • Additional commits viewable in compare view

Updates actions/download-artifact from 5.0.0 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

... (truncated)

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • Additional commits viewable in compare view

Updates hraness/.github/actions/npm-visible from 9ddbd8f7187e4528278cf078159702ea333418ce to c2cee53d72879c7829d3d6e47e61327369168260

Changelog

Sourced from hraness/.github/actions/npm-visible's changelog.

Release pages

This guide decides what a Hraness GitHub Release page says and how the release workflow builds it. https://github.com/hraness/.github/blob/main/STYLE.md governs every sentence on the page, and https://github.com/hraness/.github/blob/main/MESSAGING.md supplies the product name.

A release page is the first thing many people read about a version: someone deciding whether to upgrade, an agent checking what changed, a security reviewer checking what they installed. It answers three questions, in this order: what changed, how to install this exact version, and how to check that the files are the ones the workflow built.

The page

Title: the product name from the portfolio registry, a space, and the tag, such as Oh v0.12.1 or Ghostget v0.18.38. Use the name, not the package name or the repository name.

Body, in this order:

  1. Summary. One or two sentences that say what this version changes for someone using it. Lead with the change a reader would notice first. A release that only fixes a bug says which behavior was wrong and what it does now.
  2. ## Changes. One bullet per change a user, integrator, or operator would notice, most important first. Start each bullet with what now happens, not with the file or module that changed. Name commands, options, and limits exactly. Leave out internal refactors, dependency bumps with no visible effect, and CI changes. Link a pull request only when it explains more than the bullet.
  3. ## Install. The exact command that installs this version from its GitHub Release asset, then the npm or other mirror command when one exists. The command names the version; never write latest here.
  4. ## Verify. Where the checksums are (usually the SHA256SUMS asset), the full source commit, and a link to the repository's guide for checking provenance or signatures, pinned to the tag.
  5. The identity record. The repository's machine-readable release identity, as an HTML comment, as the final bytes of the body. It is invisible on the rendered page. Keep each repository's existing identity format; this guide only fixes where it goes.

A page with nothing to say under ## Changes does not ship. Make the version bump carry at least one real change, or do not cut the release.

Example, from Oh v0.12.1:

Installed copies of Oh now run the Rust text engine. Releases v0.10.3 through v0.12.0 looked for its WebAssembly files in the wrong folder and fell back to the TypeScript reference, which gives the same results more slowly.

Changes

  • The packaged loader finds its WebAssembly files, so an installed copy reports rust-wasm as its engine.
  • The release check installs the packed package and fails unless the loader reports the Rust engine.

Install … Verify …

Where the words come from

The summary and changes come from CHANGELOG.md in the tagged commit. The section whose heading is the version (## 0.12.1 or ## v0.12.1, with an optional - 2026-09-26 date) holds a summary paragraph and a bulleted list. The release workflow copies that section onto the page. It does not write notes of its own, and it never uses GitHub's generated notes.

  • Write the changelog section in the version bump pull request, so the notes are reviewed with the release that carries them.
  • The release workflow fails before creating the release when the section is missing, empty, or still says Unreleased.
  • The workflow generates ## Install and ## Verify from the release record, so their commands and digests always match the attached files.
  • Keep old changelog sections as they shipped. Correct a published page by editing the page and the changelog in the same change, never by rewriting history.

Identity checks

Release workflows that verify their own release, for retries or for downstream admission, read the identity record from the end of the body. Parse from the last <!-- marker that opens the repository's identity comment, and require the body to end with -->. Check that the notes above it are byte-identical to the rendered changelog section plus the generated install and verify sections, so a hand edit to a published page is detected like any other change.

Launch-day assets

A release page does not replace the launch post. The “Introducing {product}” post, its social posts, product mockups, and launch film live on the product's site and follow the launch beats and social posts addendum in https://github.com/hraness/.github/blob/main/GENERATION_STYLE.md and the launch posts section of https://github.com/hraness/.github/blob/main/MESSAGING.md. They render status and version from the same release record as this page.

Do not put on a release page

  • “What’s Changed” lists, “Full Changelog” compare links, contributor lists, or “Generated with” lines. The compare link and the commit are in the Verify section when they help.

... (truncated)

Commits
  • c2cee53 Drop work-in-progress products from the organization profile (#53)
  • 7136607 Prefer the required CI aggregate when the local scheduler is saturated (#52)
  • e57467f Fail the coverage check when a repository lacks the audit (#51)
  • 3f16292 Include forks in the weekly dependency audit coverage check (#50)
  • 4ac4708 Add Stripe- and Vercel-derived practices to the documentation and README guid...
  • 021adfa Version the dependency audit action with release tags (#48)
  • 8a1b057 Keep existing vulnerabilities in the issue, not a red main (#47)
  • 57b7967 Add one dependency audit for every repository (#46)
  • f957ad0 Document signed-in browser recovery in the browser-automation rule (#45)
  • e41f988 STYLE: never name or link a retired prototype in public material (#44)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group with 6 updates
4693955 
Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2.2.2` | `3.3.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `5.0.0` | `8.0.2` |
| [hraness/.github/actions/npm-visible](https://github.com/hraness/.github) | `9ddbd8f7187e4528278cf078159702ea333418ce` | `c2cee53d72879c7829d3d6e47e61327369168260` |


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `actions/create-github-app-token` from 2.2.2 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@fee1f7d...64ab729)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...cf430e0)

Updates `actions/download-artifact` from 5.0.0 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@634f93c...9000827)

Updates `hraness/.github/actions/npm-visible` from 9ddbd8f7187e4528278cf078159702ea333418ce to c2cee53d72879c7829d3d6e47e61327369168260
- [Changelog](https://github.com/hraness/.github/blob/main/RELEASES.md)
- [Commits](hraness/.github@9ddbd8f...c2cee53)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: hraness/.github/actions/npm-visible
  dependency-version: c2cee53d72879c7829d3d6e47e61327369168260
  dependency-type: direct:production
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 20, 2026
@vercel

vercel Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
slopcamera Ready Ready Preview Oct 20, 2026 6:46am UTC
slopcamera-api Ready Ready Preview Oct 20, 2026 6:46am UTC

Request Review

This branch was successfully deployed

2 active deployments
Preview – slopcamera-api — 46939556 Deployed Oct 20, 2026 by vercel[bot]
View deployment
Preview – slopcamera — 46939556 Deployed Oct 20, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants