Skip to content

ci: bump the actions group with 9 updates - #22

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-9e0e0a3f09
Closed

ci: bump the actions group with 9 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-9e0e0a3f09

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the actions group with 9 updates:

Package From To
actions/checkout 4.4.0 7.0.1
actions/attest-build-provenance 2.4.0 4.2.2
actions/upload-artifact 4.6.2 7.0.1
getplumber/plumber 0.4.26 0.4.60
actions/download-artifact 4.3.0 8.0.1
mikepenz/release-changelog-builder-action 5.4.1 6.3.0
softprops/action-gh-release 2.6.2 3.0.3
aquasecurity/trivy-action 0.35.0 0.36.0
gitleaks/gitleaks-action 2.3.9 3.0.0

Updates actions/checkout from 4.4.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/attest-build-provenance from 2.4.0 to 4.2.2

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

v4.1.1

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

v4.1.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.0.0...v4.1.0

v4.0.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

... (truncated)

Commits

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates getplumber/plumber from 0.4.26 to 0.4.60

Release notes

Sourced from getplumber/plumber's releases.

v0.4.60

0.4.60 (2026-09-11)

✨ Features

  • platform: decode policy min_points and the push response's global score into a verdict (83dbfba)
  • platform: evaluate resolved policies as first-class runs with no local fallback (1fedc61)
  • platform: in platform mode the resolved policies drive the log, the push and the exit code (8f4b6ba)
  • platform: local gates, thresholds and the degraded exit are inert in platform mode (551eac6)
  • platform: per-policy artifacts, badge and MR comment from the platform verdict (5ef59c2), closes #467
  • platform: per-policy log sections and the platform verdict block (13d0da9)

🐛 Bug Fixes

  • platform: a --no-controls run is not platform mode in the summary (65ae90c)
  • platform: carry each run's not-evaluable marks in its policy report entry (d16571b)
  • platform: decode the gate strictly, only the global score tolerantly (ef0733a)
  • platform: honest verdict line, collection diagnostics and header in platform mode (db8aedf)
  • platform: inventory runs keep their guards in platform mode, pin the run-level dismissal mark (ee6de90)
  • platform: platform-mode artifacts carry only the policies' verdicts (b8c3411)
  • platform: tolerant gate decode and validated global letter (9c292fe)
  • platform: track the two image controls independently in pbom verdicts (2928548)

📚 Documentation

  • platform: platform mode evaluates only the platform's policies and takes its verdict (8ff0c69)
  • platform: replace em dashes and restore template backticks (f73aa78)

✅ Tests

  • platform: cover outputControlEntries's multi-policy accumulation (7e7fe68)
  • platform: cover the post-action and pbom summaries through the cmd path (7e334ba)
  • platform: cover the report's un-applied policy entry and min_points (93b6185)
  • platform: cover the union's not-evaluable swap and the degraded sections (e10cc50), closes #220
  • platform: pin the notEvaluable key removal in platform-mode json reports (6cc5dd0)

👷 CI/CD

  • release: pin v0.4.59 refs [skip ci] (8da00d4)

v0.4.59

0.4.59 (2026-09-10)

✨ Features

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.4.63 (2026-09-14)

✨ Features

  • cmd: push a linked run that evaluated nothing, with the marker the platform records (row 63) (c713d04)
  • control: drive platform-mode collection from the union of the resolved policies (row 62) (f318bcb)

🐛 Bug Fixes

  • cmd: ignore --controls and --skip-controls on a linked run (row 64) (f93ed94)
  • cmd: terminal, exit code and docs follow the policy verdicts on a linked run (row 62) (9b5d4ff)

♻️ Refactoring

  • gitlab: export the multi-document CI parser as ParseGitlabCIConf (row 54) (0795790)

👷 CI/CD

  • release: pin v0.4.62 refs [skip ci] (1840df4)

0.4.62 (2026-09-12)

🐛 Bug Fixes

  • gitremote: eat every userinfo @ up to the last one before the path (d370cbd)
  • platform: a served empty include list is complete attribution, not unknown (754ab69)
  • platform: use the includes the resolve endpoint serves (dc10a57)

✅ Tests

  • platform: pin the no-attribution branch of the includes served line (9b18a79)
  • platform: pin the wire-level decode of resolve response includes (4e2837d)

👷 CI/CD

  • release: pin v0.4.61 refs [skip ci] (cc366ec)

0.4.61 (2026-09-12)

✨ Features

  • configuration: export nullable on schema fields so an editor knows when unset is meaningful (6ce3630)

... (truncated)

Commits
  • f84005b chore(release): 0.4.60 [skip ci]
  • e10cc50 test(platform): cover the union's not-evaluable swap and the degraded sections
  • d16571b fix(platform): carry each run's not-evaluable marks in its policy report entry
  • 7e7fe68 test(platform): cover outputControlEntries's multi-policy accumulation
  • 93b6185 test(platform): cover the report's un-applied policy entry and min_points
  • 65ae90c fix(platform): a --no-controls run is not platform mode in the summary
  • 7e334ba test(platform): cover the post-action and pbom summaries through the cmd path
  • 2928548 fix(platform): track the two image controls independently in pbom verdicts
  • ef0733a fix(platform): decode the gate strictly, only the global score tolerantly
  • f73aa78 docs(platform): replace em dashes and restore template backticks
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates mikepenz/release-changelog-builder-action from 5.4.1 to 6.3.0

Release notes

Sourced from mikepenz/release-changelog-builder-action's releases.

v6.3.0

🚀 Features

  • ci: add OpenSSF Scorecard analysis and fix CI badge

💬 Other

  • ci: fix Scorecard Dangerous-Workflow finding (script injection)
  • dev -> main
  • ci: run Scorecard on develop, the default branch

📦 Dependencies

  • chore(deps): lock file maintenance
  • fix(deps): update dependency semver to v7.8.4
  • chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 4823a29
  • chore(deps): update node devdependency non-major updates
  • fix(deps): update dependency https-proxy-agent to v9.1.0
  • chore(deps): update node devdependency non-major updates
  • chore(deps): lock file maintenance
  • chore(deps): update actions/checkout action to v7
  • chore(deps): lock file maintenance
  • fix(deps): update dependency semver to v7.8.5
  • chore(deps): update dependency js-yaml to v5
  • chore(deps): lock file maintenance
  • chore(deps): update node devdependency non-major updates
  • chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 2449e39
  • chore(deps): update dependency vite to v8.1.0
  • chore(deps): update node devdependency non-major updates
  • chore(deps): lock file maintenance

... (truncated)

Commits
  • cb021f9 Merge pull request #1666 from mikepenz/develop
  • 48658d7 chore(deps): update mikepenz/action-gh-release action to v3.1.0 (#1665)
  • 6c6fe84 Merge pull request #1661 from mikepenz/renovate/node-devdependency-non-major-...
  • 27dc4b4 chore: rebuild dist for renovate
  • f911262 chore(deps): update node devdependency non-major updates
  • 217d3c7 Merge pull request #1660 from mikepenz/renovate/js-yaml-5.x
  • a5deb72 chore: rebuild dist for renovate
  • 72b7476 chore: sync js-yaml version between devDependencies and overrides
  • 325c6d9 chore(deps): update dependency js-yaml to v5.3.0
  • 390cad3 chore(deps): lock file maintenance (#1664)
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 2.6.2 to 3.0.3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

Other Changes 🔄

  • dependency updates

v3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

v3.0.1

3.0.1

  • maintenance release with updated dependencies

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

Other Changes 🔄

  • dependency updates

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

3.0.1

  • maintenance release with updated dependencies

... (truncated)

Commits
  • efb3536 release 3.0.3 (#840)
  • 6441963 chore(deps): bump the npm group with 2 updates (#839)
  • e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
  • d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)

@dependabot
ci: bump the actions group with 9 updates
eab98da 
Bumps the actions group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.4.0` | `4.2.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [getplumber/plumber](https://github.com/getplumber/plumber) | `0.4.26` | `0.4.60` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` |
| [mikepenz/release-changelog-builder-action](https://github.com/mikepenz/release-changelog-builder-action) | `5.4.1` | `6.3.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.2` | `3.0.3` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.35.0` | `0.36.0` |
| [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2.3.9` | `3.0.0` |


Updates `actions/checkout` from 4.4.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11d5960...3d3c42e)

Updates `actions/attest-build-provenance` from 2.4.0 to 4.2.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@e8998f9...4d10147)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...043fb46)

Updates `getplumber/plumber` from 0.4.26 to 0.4.60
- [Release notes](https://github.com/getplumber/plumber/releases)
- [Changelog](https://github.com/getplumber/plumber/blob/main/CHANGELOG.md)
- [Commits](getplumber/plumber@7ad9d26...f84005b)

Updates `actions/download-artifact` from 4.3.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...3e5f45b)

Updates `mikepenz/release-changelog-builder-action` from 5.4.1 to 6.3.0
- [Release notes](https://github.com/mikepenz/release-changelog-builder-action/releases)
- [Commits](mikepenz/release-changelog-builder-action@c9dc836...cb021f9)

Updates `softprops/action-gh-release` from 2.6.2 to 3.0.3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@3bb1273...efb3536)

Updates `aquasecurity/trivy-action` from 0.35.0 to 0.36.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@57a97c7...ed142fd)

Updates `gitleaks/gitleaks-action` from 2.3.9 to 3.0.0
- [Release notes](https://github.com/gitleaks/gitleaks-action/releases)
- [Commits](gitleaks/gitleaks-action@ff98106...e0c47f4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: getplumber/plumber
  dependency-version: 0.4.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: mikepenz/release-changelog-builder-action
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: gitleaks/gitleaks-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7d649388-c67f-484d-b42c-a8a6588e5d98

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 14, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-9e0e0a3f09 branch September 14, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants