Skip to content

chore(deps): bump the github-actions group across 1 directory with 16 updates - #9

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-6e9b498020
Open

chore(deps): bump the github-actions group across 1 directory with 16 updates#9
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-6e9b498020

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown

Bumps the github-actions group with 16 updates in the / directory:

Package From To
actions/checkout 4 7
pnpm/action-setup 4 6
actions/setup-node 4 7
actions/setup-java 4 6
android-actions/setup-android 3 4
actions/upload-artifact 4 7
actions/attest-build-provenance 2 4
github/codeql-action/init 4.37.7 4.38.0
github/codeql-action/analyze 4.37.7 4.38.0
docker/setup-buildx-action 4.3.0 4.4.1
docker/build-push-action 7.3.0 7.4.0
cachix/cachix-action f495f3ffa2f3810a92e5cc0abc2c5d6a2a07ec82 38b082610b782e7e93e209c35fd730d399dee866
DeterminateSystems/determinate-nix-action 3.21.9 3.22.4
DeterminateSystems/update-flake-lock 6eeac1e86e13a9256682f930c4c7568acc43f047 da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3
actions-rust-lang/setup-rust-toolchain 1.17.0 2.0.0
github/codeql-action/upload-sarif 4.37.7 4.38.0

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates pnpm/action-setup from 4 to 6

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.0

Added support for pnpm v11.

v5.0.0

Updated the action to use Node.js 24.

v4.4.0

Updated the action to use Node.js 24.

v4.3.0

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v4.2.0...v4.3.0

v4.2.0

When there's a .npmrc file at the root of the repository, pnpm will be fetched from the registry that is specified in that .npmrc file #179

v4.1.0

Add support for package.yaml #156.

Commits
  • 0977fd9 docs: Update README to include devEngines.packageManager (#273)
  • 48261ac fix: update pnpm to v11.19.0 (#283)
  • 75677f7 ci: use pnpm 11 for pr-check (#284)
  • 769ae71 refactor: introduce restore keys for cache (#280)
  • 6fed91f docs(README): point users to the successor pnpm/setup action (#282)
  • 0ebf471 fix: update pnpm to v11.7.0 (#267)
  • 0e279bb fix: update pnpm to 11.1.1 (#248)
  • 3e83581 fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)
  • 551b42e docs(README): fix cache_dependency_path type (#257)
  • 739bfe4 fix: self-update bootstrap to packageManager-pinned version (#233) (#256)
  • Additional commits viewable in compare view

Updates actions/setup-node from 4 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates actions/setup-java from 4 to 6

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

... (truncated)

Commits
  • de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
  • 134912a Fix import-safe checks when scripts are run from a path with symlinks (#1265)
  • 0781fc6 Fix alpine failures by switching default back to only warn on verification fa...
  • 4889c4a Fix Temurin EA E2E signature verification (#1260)
  • 8fd3240 [WIP] Fix failing GitHub Actions job for temurin 17 (#1259)
  • 2732291 chore(deps-dev): update eslint and globals (#1256)
  • 1a8f22b chore: streamline Dependabot updates (#1255)
  • 85030b7 docs: complete v6 release highlights (#1254)
  • dd06d9c Prepare documentation for v6 release (#1253)
  • 59b3450 chore(deps): combine open Dependabot npm updates (#1252)
  • Additional commits viewable in compare view

Updates android-actions/setup-android from 3 to 4

Release notes

Sourced from android-actions/setup-android's releases.

v4.0.0

Hello,

The long awaited update of setup-android.

  • Migrate action to Node24 (by @​TWiStErRob)
  • Add and default to cmdline-tools version 20.0 ( 14742923 )
  • Update CI runners (by @​TWiStErRob)
  • Update README.md (by @​vil02)
  • Update npm dependencies to solve CVE's

Incrementing major version to safeguard incase node upgrade or default cmdline-tools upgrade breaks something downstream.

v3.2.2

Add support for cmdline-tools versions 12, 13, and 16 by @​warting in android-actions/setup-android#493 .

Updated npm dependencies

v3.2.1

Updated dependencies

v3.2.0

Implement 'packages' input argument, which allows choosing which packages to install from Android SDK

v3.1.0

Allow installing different Android SDK versions. Allow silent license agreement.

Commits
  • be39fa8 Update README.md with version 15859902 (22.0)
  • 1f87d5b Add version 15859902 (22.0), default it and update macOS url for it.
  • 138b5fb Update dependencies in README.md
  • 5ed5266 README.md Update other GitHub Actions in code samples
  • ca5c9e0 Upgrade Typescript to v6. Update other deps.
  • 927cbf9 Update npm dependencies
  • 76ffd60 Bump actions/checkout from 6 to 7
  • 7731365 Fix #537: stop installing the deprecated tools package
  • 4d90f94 [2/2] Update setup-android version in README.md
  • 40fd30f Update setup-android version in README.md
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/attest-build-provenance from 2 to 4

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.0.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v3.2.0...v4.0.0

v3.2.0

What's Changed

Full Changelog: actions/attest-build-provenance@v3.1.0...v3.2.0

v3.1.0

What's Changed

New Contributors

Full Changelog: actions/attest-build-provenance@v3...v3.1.0

v3.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1 Release Notes

Make sure your runner is updated to this version or newer to use this release.

... (truncated)

Commits

Updates github/codeql-action/init from 4.37.7 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advan...

    Description has been truncated

@dependabot
chore(deps): bump the github-actions group across 1 directory with 16…
32a3734 
… updates

Bumps the github-actions group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4` | `6` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4` | `7` |
| [actions/setup-java](https://github.com/actions/setup-java) | `4` | `6` |
| [android-actions/setup-android](https://github.com/android-actions/setup-android) | `3` | `4` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2` | `4` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.7` | `4.38.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.7` | `4.38.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.3.0` | `4.4.1` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` |
| [cachix/cachix-action](https://github.com/cachix/cachix-action) | `f495f3ffa2f3810a92e5cc0abc2c5d6a2a07ec82` | `38b082610b782e7e93e209c35fd730d399dee866` |
| [DeterminateSystems/determinate-nix-action](https://github.com/determinatesystems/determinate-nix-action) | `3.21.9` | `3.22.4` |
| [DeterminateSystems/update-flake-lock](https://github.com/determinatesystems/update-flake-lock) | `6eeac1e86e13a9256682f930c4c7568acc43f047` | `da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3` |
| [actions-rust-lang/setup-rust-toolchain](https://github.com/actions-rust-lang/setup-rust-toolchain) | `1.17.0` | `2.0.0` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.7` | `4.38.0` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v7)

Updates `pnpm/action-setup` from 4 to 6
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v4...v6)

Updates `actions/setup-node` from 4 to 7
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v7)

Updates `actions/setup-java` from 4 to 6
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v4...v6)

Updates `android-actions/setup-android` from 3 to 4
- [Release notes](https://github.com/android-actions/setup-android/releases)
- [Commits](android-actions/setup-android@v3...v4)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `actions/attest-build-provenance` from 2 to 4
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Commits](actions/attest-build-provenance@v2...v4)

Updates `github/codeql-action/init` from 4.37.7 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff2f1c6...b96794f)

Updates `github/codeql-action/analyze` from 4.37.7 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff2f1c6...b96794f)

Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.1
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@37fe631...f87e599)

Updates `docker/build-push-action` from 7.3.0 to 7.4.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@53b7df9...c3c9e26)

Updates `cachix/cachix-action` from f495f3ffa2f3810a92e5cc0abc2c5d6a2a07ec82 to 38b082610b782e7e93e209c35fd730d399dee866
- [Release notes](https://github.com/cachix/cachix-action/releases)
- [Changelog](https://github.com/cachix/cachix-action/blob/master/RELEASE.md)
- [Commits](cachix/cachix-action@f495f3f...38b0826)

Updates `DeterminateSystems/determinate-nix-action` from 3.21.9 to 3.22.4
- [Release notes](https://github.com/determinatesystems/determinate-nix-action/releases)
- [Commits](DeterminateSystems/determinate-nix-action@61cbfe2...58b42ef)

Updates `DeterminateSystems/update-flake-lock` from 6eeac1e86e13a9256682f930c4c7568acc43f047 to da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3
- [Release notes](https://github.com/determinatesystems/update-flake-lock/releases)
- [Commits](DeterminateSystems/update-flake-lock@6eeac1e...da03c0f)

Updates `actions-rust-lang/setup-rust-toolchain` from 1.17.0 to 2.0.0
- [Release notes](https://github.com/actions-rust-lang/setup-rust-toolchain/releases)
- [Changelog](https://github.com/actions-rust-lang/setup-rust-toolchain/blob/main/CHANGELOG.md)
- [Commits](actions-rust-lang/setup-rust-toolchain@166cdcf...ecabd13)

Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff2f1c6...b96794f)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pnpm/action-setup
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: android-actions/setup-android
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/attest-build-provenance
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: cachix/cachix-action
  dependency-version: 38b082610b782e7e93e209c35fd730d399dee866
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: DeterminateSystems/determinate-nix-action
  dependency-version: 3.22.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: DeterminateSystems/update-flake-lock
  dependency-version: da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: actions-rust-lang/setup-rust-toolchain
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 20, 2026
@dependabot
dependabot Bot requested a review from ZHINFINITY as a code owner September 20, 2026 05:41
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 20, 2026
@coderabbitai

coderabbitai Bot commented Sep 20, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6875b92a-048d-4f41-99d1-b22c64a9dfa5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ZHINFINITY ZHINFINITY Awaiting requested review from ZHINFINITY ZHINFINITY is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants