[dependabot]

Bumps the github-actions group with 4 updates in the / directory: actions/checkout, rust-lang/crates-io-auth-action, release-plz/action and zizmorcore/zizmor-action.

Updates actions/checkout from 6.0.3 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates rust-lang/crates-io-auth-action from 1.0.4 to 1.0.5

Release notes

Sourced from rust-lang/crates-io-auth-action's releases.

v1.0.5

What's Changed

• update to tsdown 0.22 by @​marcoieni in rust-lang/crates-io-auth-action#239 and rust-lang/crates-io-auth-action#254
• update to typescript 6 by @​marcoieni in rust-lang/crates-io-auth-action#256
• other dependency updates

Internal changes

• renovate: rename updateTypes field by @​marcoieni in rust-lang/crates-io-auth-action#219
• renovate: don't raise individual PRs for crates non breaking changes by @​marcoieni in rust-lang/crates-io-auth-action#220
• use rust-lang renovate preset by @​marcoieni in rust-lang/crates-io-auth-action#235
• ci(links): accept 403 as success by @​marcoieni in rust-lang/crates-io-auth-action#263

Full Changelog: rust-lang/crates-io-auth-action@v1.0.4...v1.0.5

Commits

• c6f97d4 Merge pull request #259 from rust-lang/renovate/lock-file-maintenance
• b929a92 package dist
• 9d23f3b chore(deps): lock file maintenance
• 2b6b194 Merge pull request #263 from rust-lang/ci-links-accept-403-as-failure
• 1a7afc2 ci(links): accept 403 as success
• 701b15c Merge pull request #260 from rust-lang/renovate/tsdown-0.x-lockfile
• cf898e1 package dist
• 1a6a621 chore(deps): update dependency tsdown to v0.22.2
• 9f93ac2 Merge pull request #261 from rust-lang/renovate/github-actions
• 5463451 chore(deps): update github actions to v6.0.3
• Additional commits viewable in compare view

Updates release-plz/action from 0.5.129 to 0.5.142

Release notes

Sourced from release-plz/action's releases.

v0.5.142

What's Changed

• fix(deps): update rust crate git_cmd to 0.9.0 by @​renovate[bot] in release-plz/action#565
• chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.3 by @​renovate[bot] in release-plz/action#566
• chore(deps): lock file maintenance by @​renovate[bot] in release-plz/action#567
• chore(deps): update dependency taiki-e/install-action to v2.87.28 by @​renovate[bot] in release-plz/action#568
• Update to 0.3.172 by @​marcoieni in release-plz/action#569

Full Changelog: release-plz/action@v0.5.141...v0.5.142

v0.5.141

What's Changed

• fix(deps): update rust crate git_cmd to 0.8.0 by @​renovate[bot] in release-plz/action#562
• chore(deps): update dependency taiki-e/install-action to v2.87.27 by @​renovate[bot] in release-plz/action#563
• Update to 0.3.171 by @​marcoieni in release-plz/action#564

Full Changelog: release-plz/action@v0.5.140...v0.5.141

v0.5.140

What's Changed

• fix(deps): update rust crate git_cmd to 0.7.0 by @​renovate[bot] in release-plz/action#539
• chore(deps): update dependency taiki-e/install-action to v2.87.17 by @​renovate[bot] in release-plz/action#541
• chore(deps): lock file maintenance by @​renovate[bot] in release-plz/action#542
• chore(deps): update dependency taiki-e/install-action to v2.87.18 by @​renovate[bot] in release-plz/action#543
• chore(deps): update dependency taiki-e/install-action to v2.87.19 by @​renovate[bot] in release-plz/action#544
• chore(deps): update dependency taiki-e/install-action to v2.87.20 by @​renovate[bot] in release-plz/action#545
• chore(deps): update dependency cargo-bins/cargo-binstall to v1.24.0 by @​renovate[bot] in release-plz/action#546
• chore(deps): update dependency taiki-e/install-action to v2.87.21 by @​renovate[bot] in release-plz/action#547
• docs: document the default config search order by @​marcoienibot in release-plz/action#548
• chore(deps): lock file maintenance by @​renovate[bot] in release-plz/action#549
• chore(deps): update dependency taiki-e/install-action to v2.87.22 by @​renovate[bot] in release-plz/action#550
• chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.0 by @​renovate[bot] in release-plz/action#551
• chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.1 by @​renovate[bot] in release-plz/action#552
• chore(deps): update dependency taiki-e/install-action to v2.87.23 by @​renovate[bot] in release-plz/action#553
• chore(deps): update dependency obi1kenobi/cargo-semver-checks to v0.51 by @​renovate[bot] in release-plz/action#554
• chore(deps): update dependency taiki-e/install-action to v2.87.24 by @​renovate[bot] in release-plz/action#555
• update github actions weekly by @​marcoieni in release-plz/action#556
• chore(deps): lock file maintenance by @​renovate[bot] in release-plz/action#557
• chore(deps): update dependency taiki-e/install-action to v2.87.25 by @​renovate[bot] in release-plz/action#558
• chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.2 by @​renovate[bot] in release-plz/action#559
• chore(deps): update dependency taiki-e/install-action to v2.87.26 by @​renovate[bot] in release-plz/action#560
• Update to 0.3.170 by @​marcoieni in release-plz/action#561

Full Changelog: release-plz/action@v0.5.139...v0.5.140

v0.5.139

What's Changed

... (truncated)

Commits

• 8921286 Update to 0.3.172 (#569)
• 8119464 chore(deps): update dependency taiki-e/install-action to v2.87.28 (#568)
• 0b172c2 chore(deps): lock file maintenance (#567)
• ad3f059 chore(deps): update dependency cargo-bins/cargo-binstall to v1.25.3 (#566)
• 6dee9c5 fix(deps): update rust crate git_cmd to 0.9.0 (#565)
• f393a7b Update to 0.3.171 (#564)
• 0a9a628 chore(deps): update dependency taiki-e/install-action to v2.87.27 (#563)
• 7394a5f fix(deps): update rust crate git_cmd to 0.8.0 (#562)
• 18641b6 Update to 0.3.170 (#561)
• ff20e36 chore(deps): update dependency taiki-e/install-action to v2.87.26 (#560)
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.6 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
• 8eacaa5 README: bump pins (#167)
• cc914d7 Sync zizmor versions (#166)
• bae72b7 chore(deps): bump the github-actions group with 2 updates (#165)
• Additional commits viewable in compare view