From fd91b790e3886182559c40a85ebe94a5163889b6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 05:47:32 +0000 Subject: [PATCH] Bump the actions group across 1 directory with 8 updates Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `7` | | [actions/setup-python](https://github.com/actions/setup-python) | `5` | `7` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` | | [actions/setup-node](https://github.com/actions/setup-node) | `4` | `7` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2` | `3` | Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) Updates `actions/setup-python` from 5 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5...v7) Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) Updates `docker/build-push-action` from 6 to 7 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6...v7) Updates `actions/setup-node` from 4 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v7) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) Updates `actions/download-artifact` from 4 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v8) Updates `softprops/action-gh-release` from 2 to 3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/cd.yml | 6 +++--- .github/workflows/ci.yml | 40 +++++++++++++++++------------------ .github/workflows/release.yml | 20 +++++++++--------- 3 files changed, 33 insertions(+), 33 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 013ddb7..887ee65 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -67,7 +67,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # FULL history, not the default depth-1 shallow clone. A shallow # HEAD pushed onto an EXISTING `release` is rejected as @@ -179,8 +179,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.14" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 89bc901..c2e364b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -51,8 +51,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.14" cache: pip @@ -78,8 +78,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.14" cache: pip @@ -159,14 +159,14 @@ jobs: timeout-minutes: 25 needs: [docs-tests] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # The same build Render runs. This is where a dependency-resolution # failure surfaces โ€” at CI time, not deploy time โ€” and where a missing # COPY line dies loudly instead of at gunicorn boot (LESSONS ยง19). - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 - name: Build the production image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . tags: dash-mui-charts-docs:ci @@ -284,9 +284,9 @@ jobs: - dash: "4.4.1" python: "3.12" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: ${{ matrix.python }} cache: pip @@ -295,7 +295,7 @@ jobs: # component bundle and wrappers from source, so a broken webpack # config or a component that stopped generating fails HERE, per # supported environment, not on the next release. - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: "20" @@ -332,7 +332,7 @@ jobs: - name: Smoke test run: python scripts/smoke_test.py --json smoke-${{ matrix.dash }}-py${{ matrix.python }}.json - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: always() with: name: smoke-${{ matrix.dash }}-py${{ matrix.python }} @@ -344,14 +344,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # check_release.py compares the git commit times of the bundle and # src/lib/components. A shallow clone can omit the commit that # last touched one of them, turning the check into a false # "no git history" skip. fetch-depth: 0 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.12" @@ -440,7 +440,7 @@ jobs: echo "package.json=$PY_VER installed=$WHEEL_VER" test "$PY_VER" = "$WHEEL_VER" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: dist path: dist/ @@ -459,10 +459,10 @@ jobs: # package's floor is not the docs site's. python: ["3.9", "3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: ${{ matrix.python }} - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: name: dist path: dist/ @@ -501,8 +501,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: "20" # The committed bundle is what users actually load, and it is a build @@ -533,8 +533,8 @@ jobs: # red pip-audit now means something new landed. Keep it that way: fix # the dependency, don't re-add continue-on-error or --ignore-vuln. steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.14" - run: pip install pip-audit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 45b642c..770ca6d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,12 +31,12 @@ jobs: name: Verify the tag runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # check_release.py compares git commit times of the bundle and the # React source; a shallow clone turns that into a false skip. fetch-depth: 0 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.12" @@ -62,14 +62,14 @@ jobs: runs-on: ubuntu-latest needs: verify steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.12" # node makes the smoke test's JS syntax checks real โ€” the committed # bundle is what ships in the wheel, and check_release has already # proven it fresh; no rebuild happens here. - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: "20" @@ -90,7 +90,7 @@ jobs: python -m build python -m twine check dist/* - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: dist path: dist/ @@ -110,7 +110,7 @@ jobs: # checks. Without it trusted publishing fails with an opaque 403. id-token: write steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: name: dist path: dist/ @@ -133,8 +133,8 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@v7 + - uses: actions/download-artifact@v8 with: name: dist path: dist/ @@ -152,7 +152,7 @@ jobs: fi cat release-notes.md - - uses: softprops/action-gh-release@v2 + - uses: softprops/action-gh-release@v3 with: body_path: release-notes.md files: dist/*