Skip to content

chore(deps): bump the actions-version group across 1 directory with 7 updates - #156

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/actions-version-cb72d2157f
Open

chore(deps): bump the actions-version group across 1 directory with 7 updates#156
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/actions-version-cb72d2157f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions-version group with 7 updates in the /.github/workflows directory:

Package From To
actions/create-github-app-token 3.2.0 3.3.0
actions/stale 10.3.0 11.0.0
actions/checkout 6.0.3 7.0.1
actions/setup-node 6.4.0 7.1.0
super-linter/super-linter/slim 8.6.0 9.0.0
actions/cache 5.0.5 6.1.0
actions/upload-artifact 7.0.1 7.0.2

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)
Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view

Updates actions/stale from 10.3.0 to 11.0.0

Release notes

Sourced from actions/stale's releases.

v11.0.0

What's Changed

Enhancement

Dependency Update

Full Changelog: actions/stale@v10...v11.0.0

v10.4.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10.3.0...v10.4.0

Commits
  • 4391f3d Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...
  • eaf9131 refactor: update imports to use ES module syntax and improve test structure (...
  • 1e223db Bump undici to 6.27.0 via override, clean up stale license files, and version...
  • 9461cb1 fix: only-issue-types does not affect PRs (#1338)
  • See full diff in compare view

Updates actions/checkout from 6.0.3 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-node from 6.4.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

v7.0.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates super-linter/super-linter/slim from 8.6.0 to 9.0.0

Release notes

Sourced from super-linter/super-linter/slim's releases.

v9.0.0

9.0.0 (2026-10-01)

⚠ BREAKING CHANGES

🚀 Features

🐛 Bugfixes

⬆️ Dependency updates

  • all: add dependency cooldowns (#7990) (123c30b)
  • bundler: bump rubocop (#8051) (8439a0b)
  • bundler: bump rubocop (#8124) (c55d5ad)
  • bundler: bump rubocop-minitest (#8005) (29e2320)
  • bundler: bump the rubocop group across 1 directory with 3 updates (#7977) (fe04526)
  • bundler: bump the rubocop group across 1 directory with 3 updates (#8085) (5d61d4a)
  • docker: bump python (#8048) (6c757dc)
  • docker: bump scalameta/scalafmt in the docker group (#8001) (07267f1)
  • docker: bump terraform-linters/tflint in the docker group (#8006) (260eccc)
  • docker: bump the docker group across 1 directory with 10 updates (#7997) (f89bfb7)
  • docker: bump the docker group across 1 directory with 13 updates (#8091) (2066911)
  • docker: bump the docker group across 1 directory with 5 updates (#8141) (0c4e34c)
  • docker: bump the docker group across 1 directory with 6 updates (#8050) (7d5c0e4)
  • docker: bump the docker group across 1 directory with 9 updates (#8118) (8a24b4b)
  • java: bump com.puppycrawl.tools:checkstyle (#7969) (a363fc9)
  • java: bump com.puppycrawl.tools:checkstyle (#7996) (b27705a)
  • java: bump com.puppycrawl.tools:checkstyle (#8026) (541db66)
  • java: bump com.puppycrawl.tools:checkstyle (#8075) (921de44)
  • java: bump the java-gradle group across 2 directories with 2 updates (#8060) (7ff6f35)
  • npm: bump @​stoplight/spectral-cli in /dependencies (#7973) (1779ac9)

... (truncated)

Changelog

Sourced from super-linter/super-linter/slim's changelog.

Changelog

9.0.0 (2026-10-01)

⚠ BREAKING CHANGES

🚀 Features

🐛 Bugfixes

⬆️ Dependency updates

  • all: add dependency cooldowns (#7990) (123c30b)
  • bundler: bump rubocop (#8051) (8439a0b)
  • bundler: bump rubocop (#8124) (c55d5ad)
  • bundler: bump rubocop-minitest (#8005) (29e2320)
  • bundler: bump the rubocop group across 1 directory with 3 updates (#7977) (fe04526)
  • bundler: bump the rubocop group across 1 directory with 3 updates (#8085) (5d61d4a)
  • docker: bump python (#8048) (6c757dc)
  • docker: bump scalameta/scalafmt in the docker group (#8001) (07267f1)
  • docker: bump terraform-linters/tflint in the docker group (#8006) (260eccc)
  • docker: bump the docker group across 1 directory with 10 updates (#7997) (f89bfb7)
  • docker: bump the docker group across 1 directory with 13 updates (#8091) (2066911)
  • docker: bump the docker group across 1 directory with 5 updates (#8141) (0c4e34c)
  • docker: bump the docker group across 1 directory with 6 updates (#8050) (7d5c0e4)
  • docker: bump the docker group across 1 directory with 9 updates (#8118) (8a24b4b)
  • java: bump com.puppycrawl.tools:checkstyle (#7969) (a363fc9)
  • java: bump com.puppycrawl.tools:checkstyle (#7996) (b27705a)
  • java: bump com.puppycrawl.tools:checkstyle (#8026) (541db66)
  • java: bump com.puppycrawl.tools:checkstyle (#8075) (921de44)
  • java: bump the java-gradle group across 2 directories with 2 updates (#8060) (7ff6f35)

... (truncated)

Commits

Updates actions/cache from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and ...

Description has been truncated

@dependabot
chore(deps): bump the actions-version group across 1 directory with 7…
82f0add 
… updates

Bumps the actions-version group with 7 updates in the /.github/workflows directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` |
| [actions/stale](https://github.com/actions/stale) | `10.3.0` | `11.0.0` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.1.0` |
| [super-linter/super-linter/slim](https://github.com/super-linter/super-linter) | `8.6.0` | `9.0.0` |
| [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |



Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

Updates `actions/stale` from 10.3.0 to 11.0.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@eb5cf3a...4391f3d)

Updates `actions/checkout` from 6.0.3 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...3d3c42e)

Updates `actions/setup-node` from 6.4.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@48b55a0...949feb2)

Updates `super-linter/super-linter/slim` from 8.6.0 to 9.0.0
- [Release notes](https://github.com/super-linter/super-linter/releases)
- [Changelog](https://github.com/super-linter/super-linter/blob/main/CHANGELOG.md)
- [Commits](super-linter/super-linter@9e86335...2da1369)

Updates `actions/cache` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@27d5ce7...55cc834)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-version
- dependency-name: actions/stale
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version
- dependency-name: super-linter/super-linter/slim
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-version
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 1, 2026
@dependabot
dependabot Bot deployed to development November 1, 2026 14:36 Active
@github-actions

github-actions Bot commented Nov 1, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/cache 55cc8345863c7cc4c66a329aec7e433d2d1c52a9 🟢 5.4
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
actions/actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
actions/actions/setup-node 949feb2413d6458794dcd2491c4babbbce0c15c1 🟢 6.4
Details
CheckScoreReason
Maintained🟢 1016 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 9binaries present in source code
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 10SAST tool is run on all commits
actions/actions/upload-artifact cf430e030ddbb5b0abf93d22962f4752f3646cd9 🟢 5.5
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
actions/super-linter/super-linter/slim 2da136927bd4a73596db63044b504547c62cb854 🟢 5.5
Details
CheckScoreReason
Code-Review⚠️ 1Found 2/16 approved changesets -- score normalized to 1
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Packaging🟢 10packaging workflow detected
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0

Scanned Files

  • .github/workflows/pr-check.yml

This branch was successfully deployed

1 active deployment
development — 82f0add9 Deployed Nov 1, 2026 by dependabot[bot] via test #251
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bot-digital-customer-success bot-digital-customer-success Awaiting requested review from bot-digital-customer-success bot-digital-customer-success is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code ready for review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants