Skip to content

Bump the github-actions group with 15 updates#6342

Merged
lrknox merged 3 commits intodevelopfrom
dependabot/github_actions/github-actions-3c384a7285
Apr 8, 2026
Merged

Bump the github-actions group with 15 updates#6342
lrknox merged 3 commits intodevelopfrom
dependabot/github_actions/github-actions-3c384a7285

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 2, 2026

Updates the requirements on actions/checkout, actions/download-artifact, actions/cache, lukka/get-cmake, actions/setup-java, EndBug/add-and-commit, github/codeql-action, advanced-security/filter-sarif, codespell-project/actions-codespell, azure/trusted-signing-action, vmactions/freebsd-vm, julia-actions/setup-julia, msys2/setup-msys2, vmactions/openbsd-vm and softprops/action-gh-release to permit the latest version.
Updates actions/checkout from 6.0.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits
  • de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
  • 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
  • See full diff in compare view

Updates actions/download-artifact from 8.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

Commits

Updates actions/cache from 5.0.3 to 5.0.4

Release notes

Sourced from actions/cache's releases.

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

Updates lukka/get-cmake from 4.2.3 to 4.3.1

Release notes

Sourced from lukka/get-cmake's releases.

CMake v4.3.0

The get-cmake action downloads and caches CMake and Ninja on your workflows. Versions can be specified using semantic versioning ranges using cmakeVersion and ninjaVersion inputs.

Changes:

  • latest is now using CMake version v4.3.0, use this one-liner e.g.: uses: lukka/get-cmake@latest

Enjoy!

Commits
  • ea83089 New CMake version(s): cmake-v4.3.1
  • b783061 New CMake version(s): cmake-v4.3.0
  • 9004e45 Migrate to Node 24
  • 6e70939 New CMake version(s): cmake-rc-v4.3.0-rc3 (#242)
  • 9cd6c6b New CMake version(s): cmake-rc-v4.3.0-rc2 (#241)
  • 7697ef7 Bump actions/upload-artifact from 6 to 7 (#239)
  • 54f69bf Bump actions/download-artifact from 7 to 8 (#240)
  • b9a171a Bump actions/upload-artifact from 5 to 6 (#227)
  • 2b80711 Bump actions/download-artifact from 6 to 7 (#228)
  • 30c1a5f Bump minimatch from 3.1.2 to 3.1.5 (#238)
  • Additional commits viewable in compare view

Updates actions/setup-java from 5.1.0 to 5.2.0

Release notes

Sourced from actions/setup-java's releases.

v5.2.0

What's Changed

Enhancement

Documentation Changes

Dependency Updates

New Contributors

Full Changelog: actions/setup-java@v5...v5.2.0

Commits

Updates EndBug/add-and-commit from 9.1.4 to 10.0.0

Release notes

Sourced from EndBug/add-and-commit's releases.

v10.0.0

What's Changed

... (truncated)

Commits
  • 290ea2c 10.0.0
  • 5190a0a docs: prepare for v10
  • 9ac3878 chore: npm audit fix
  • 7b015bd docs: add CodeReaper as a contributor for maintenance (#723)
  • 300836d chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#722)
  • f6e20ed feat!: use node version 24 (#720)
  • 6280653 chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (#721)
  • 1539a6a chore(deps): bump @​actions/core from 2.0.2 to 3.0.0 (#716)
  • af611dd chore(deps): bump minimatch (#718)
  • 2df77c1 chore(deps-dev): bump eslint-plugin-prettier from 5.5.4 to 5.5.5 (#712)
  • Additional commits viewable in compare view

Updates github/codeql-action to 89a39a4e59826350b863aa6b6252a07ad50cf83e

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

4.34.1 - 20 Mar 2026

  • Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

  • Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
  • We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
  • Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

  • Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

    To opt out of this change:

    • Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
  • Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

  • The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

  • Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

  • Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

  • A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

4.32.6 - 05 Mar 2026

  • Update default CodeQL bundle version to 2.24.3. #3548

4.32.5 - 02 Mar 2026

  • Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507
  • Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487

... (truncated)

Commits

Updates advanced-security/filter-sarif from 1.0.1 to 1.1

Release notes

Sourced from advanced-security/filter-sarif's releases.

v1.1

What's Changed

New Contributors

Full Changelog: advanced-security/filter-sarif@v1...v1.1

Commits
  • 2da736f Merge pull request #17 from advanced-security/copilot/add-severity-filter-option
  • b82026b Remove [DEBUG] print statements from production code
  • f15e3e4 Update action.yml
  • f74eb20 Refactor collect_rule_severities to streamline rule processing and enhance de...
  • da97499 Fix severity filter: results no longer incorrectly filtered when level is mis...
  • be31281 Initial plan for severity filter bug fix
  • 4bddfd6 Address code review: use env var for shell safety, fix double strip
  • e304681 Add optional severity filter for SARIF alerts
  • 36dc0ce Initial plan
  • 59d0a64 Merge pull request #14 from aibaars/patch-1
  • Additional commits viewable in compare view

Updates codespell-project/actions-codespell from bca0a5887de255a8903221c67b6478c7501c5edc to cf810cf4cbd6cdefe6ef86e55b64d524a16654a7

Commits

Updates azure/trusted-signing-action from 1.1.0 to 1.2.0

Release notes

Sourced from azure/trusted-signing-action's releases.

v1.2.0

What's Changed

New Contributors

Full Changelog: Azure/artifact-signing-action@v1.1.0...v1.2.0

Commits
  • b443cf8 Update internal actions/cache to v5.0.4 (#126)
  • 6c581eb refactor: disable az credential types by default except cli and env vars (#122)
  • dd27d98 docs: update examples to remove azps session (#123)
  • See full diff in compare view

Updates vmactions/freebsd-vm from 1.4.2 to 1.4.4

Release notes

Sourced from vmactions/freebsd-vm's releases.

v1.4.4

add 14.4

v1.4.3

use node24

Commits

Updates julia-actions/setup-julia from 2.6.1 to 2.7.0

Release notes

Sourced from julia-actions/setup-julia's releases.

v2.7.0

Documentation

Dependencies

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 2, 2026
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 2, 2026
@dependabot dependabot bot added the github_actions Pull requests that update GitHub Actions code label Apr 2, 2026
@dependabot dependabot bot requested review from brtnfld and mattjala as code owners April 2, 2026 03:23
@github-project-automation github-project-automation bot moved this to To be triaged in HDF5 - TRIAGE & TRACK Apr 2, 2026
hyoklee
hyoklee previously approved these changes Apr 2, 2026
Comment thread .github/workflows/openbsd.yml Outdated
Comment thread .github/workflows/openbsd.yml Outdated
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Build and test on OpenBSD
uses: vmactions/openbsd-vm@9004791062e748d95cc87e499e77485f91888ce1 # v1.3.8
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm beginning to think this is a problem on our side with the way the workflow is setup and may need fixing. I don't see any similar issue reports on vmactions/openbsd-vm that suggest anything

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you want to hold merging this PR for fixing it or merge it with the older vmactions/openbsd-vm and pursue the fix afterward? It passes all tests now.

Copy link
Copy Markdown
Member

@hyoklee hyoklee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mattjala , please update OpenBSD 7.5 to 7.8 in CI Action.

dependabot bot and others added 2 commits April 6, 2026 13:43
Updates the requirements on [actions/checkout](https://github.com/actions/checkout), [actions/download-artifact](https://github.com/actions/download-artifact), [actions/cache](https://github.com/actions/cache), [lukka/get-cmake](https://github.com/lukka/get-cmake), [actions/setup-java](https://github.com/actions/setup-java), [EndBug/add-and-commit](https://github.com/endbug/add-and-commit), [github/codeql-action](https://github.com/github/codeql-action), [advanced-security/filter-sarif](https://github.com/advanced-security/filter-sarif), [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell), [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action), [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm), [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia), [msys2/setup-msys2](https://github.com/msys2/setup-msys2), [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release) to permit the latest version.

Updates `actions/checkout` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@8e8c483...de0fac2)

Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@70fc10c...3e5f45b)

Updates `actions/cache` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@cdf6c1f...6682284)

Updates `lukka/get-cmake` from 4.2.3 to 4.3.1
- [Release notes](https://github.com/lukka/get-cmake/releases)
- [Changelog](https://github.com/lukka/get-cmake/blob/main/RELEASE_PROCESS.md)
- [Commits](lukka/get-cmake@f176ccd...ea83089)

Updates `actions/setup-java` from 5.1.0 to 5.2.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v5.1.0...be666c2)

Updates `EndBug/add-and-commit` from 9.1.4 to 10.0.0
- [Release notes](https://github.com/endbug/add-and-commit/releases)
- [Commits](EndBug/add-and-commit@a94899b...290ea2c)

Updates `github/codeql-action` to 89a39a4e59826350b863aa6b6252a07ad50cf83e
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/commits/89a39a4e59826350b863aa6b6252a07ad50cf83e)

Updates `advanced-security/filter-sarif` from 1.0.1 to 1.1
- [Release notes](https://github.com/advanced-security/filter-sarif/releases)
- [Commits](advanced-security/filter-sarif@f3b8118...2da736f)

Updates `codespell-project/actions-codespell` from bca0a5887de255a8903221c67b6478c7501c5edc to cf810cf4cbd6cdefe6ef86e55b64d524a16654a7
- [Release notes](https://github.com/codespell-project/actions-codespell/releases)
- [Commits](codespell-project/actions-codespell@bca0a58...cf810cf)

Updates `azure/trusted-signing-action` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/azure/trusted-signing-action/releases)
- [Commits](https://github.com/azure/trusted-signing-action/compare/87c2e83e6868da99d3380aa309851b32ed9a8346...b443cf8ea4124818d2ea9f043cba29fc3ec47b16)

Updates `vmactions/freebsd-vm` from 1.4.2 to 1.4.4
- [Release notes](https://github.com/vmactions/freebsd-vm/releases)
- [Commits](vmactions/freebsd-vm@c9f815b...7ca82f7)

Updates `julia-actions/setup-julia` from 2.6.1 to 2.7.0
- [Release notes](https://github.com/julia-actions/setup-julia/releases)
- [Commits](julia-actions/setup-julia@5c9647d...4c0cb0f)

Updates `msys2/setup-msys2` from 2.30.0 to 2.31.0
- [Release notes](https://github.com/msys2/setup-msys2/releases)
- [Changelog](https://github.com/msys2/setup-msys2/blob/main/CHANGELOG.md)
- [Commits](msys2/setup-msys2@4f806de...cafece8)

Updates `vmactions/openbsd-vm` from 1.3.4 to 1.3.8
- [Release notes](https://github.com/vmactions/openbsd-vm/releases)
- [Commits](vmactions/openbsd-vm@271a1ba...9004791)

Updates `softprops/action-gh-release` from 2.5.0 to 2.6.1
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@a06a81a...153bb8e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: lukka/get-cmake
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: EndBug/add-and-commit
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 89a39a4e59826350b863aa6b6252a07ad50cf83e
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: advanced-security/filter-sarif
  dependency-version: '1.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codespell-project/actions-codespell
  dependency-version: cf810cf4cbd6cdefe6ef86e55b64d524a16654a7
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: azure/trusted-signing-action
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: vmactions/freebsd-vm
  dependency-version: 1.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: julia-actions/setup-julia
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: msys2/setup-msys2
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: vmactions/openbsd-vm
  dependency-version: 1.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@lrknox lrknox force-pushed the dependabot/github_actions/github-actions-3c384a7285 branch from d27d96f to 1a58f33 Compare April 6, 2026 18:44
@lrknox lrknox merged commit c1fa9a9 into develop Apr 8, 2026
371 of 372 checks passed
@github-project-automation github-project-automation bot moved this from To be triaged to Done in HDF5 - TRIAGE & TRACK Apr 8, 2026
@dependabot dependabot bot deleted the dependabot/github_actions/github-actions-3c384a7285 branch April 8, 2026 02:55
brtnfld pushed a commit to brtnfld/hdf5 that referenced this pull request Apr 17, 2026
Updates the requirements on [actions/checkout](https://github.com/actions/checkout), [actions/download-artifact](https://github.com/actions/download-artifact), [actions/cache](https://github.com/actions/cache), [lukka/get-cmake](https://github.com/lukka/get-cmake), [actions/setup-java](https://github.com/actions/setup-java), [EndBug/add-and-commit](https://github.com/endbug/add-and-commit), [github/codeql-action](https://github.com/github/codeql-action), [advanced-security/filter-sarif](https://github.com/advanced-security/filter-sarif), [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell), [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action), [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm), [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia), [msys2/setup-msys2](https://github.com/msys2/setup-msys2), [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release) to permit the latest version.

* Keep vmactions/openbsd-vm@271a1ba # v1.3.4 until ssh doesn't fail with newer version.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants