Update github-actions (major) - #101
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
June 24, 2026 08:54
e49fcbd to
faed12a
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
July 21, 2026 01:44
faed12a to
b02075e
Compare
| egress-policy: audit | ||
|
|
||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| egress-policy: audit | ||
|
|
||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
July 21, 2026 19:36
b02075e to
5cb4a77
Compare
renovate
Bot
changed the title
|
|
||
| - name: Install the latest version of uv | ||
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | ||
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 |
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
2 times, most recently
from
August 14, 2026 17:08
16ddf74 to
5fa5f26
Compare
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
August 26, 2026 07:13
5fa5f26 to
339d045
Compare
| - name: Generate changelog | ||
| id: changelog | ||
| uses: metcalfc/changelog-generator@0440d0932f9a0dd1cc9ecd8412830761351323bd # v4.7.0 | ||
| uses: metcalfc/changelog-generator@031a6408a9ad7fa6dcda49b7222ab2b54110a680 # v5.0.1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v6.0.3→v7.0.1v8.2.0→v10.0.1v4.7.0→v5.0.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
astral-sh/setup-uv (astral-sh/setup-uv)
v10.0.1: 🌈 Tolerate transient manifest timeoutsCompare Source
Changes
Thank you @arguile- for making this action more resilient.
🐛 Bug fixes
🧰 Maintenance
📚 Documentation
v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL featuresCompare Source
Changes
Another breaking release, directly after v9.0.0 but we think the added security justifies that.
Extra security by default
If you use the default
enable-cache: autothis will now DISABLE THE CACHE to protect against cache poisoning for the following events:pull_request_targetworkflow_runreleaseYou can read the full reasoning in #984
version: latest-knownThis will now install the latest version with a checksum that is known by this action. The known
uvchecksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.Read python version from
.tool-versionsWill now also set the python version if it is defined in
.tool-versions. You can read the details in the docs🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v9.0.0Compare Source
v8.3.2Compare Source
v8.3.1Compare Source
v8.3.0Compare Source
metcalfc/changelog-generator (metcalfc/changelog-generator)
v5.0.1Compare Source
5.0.1Base the changelog on the previous release of the same line, and assert it (#​479)fix: return the modified changelog as a real multiline output (#​478)v5.0.0Compare Source
Breaking change: commit subjects render as literal text
Every changelog line now wraps the commit subject in an inline-code span.
A commit subject is untrusted input. Anyone whose pull request you merge
chooses that text, and this action pastes it directly into your release notes.
Rendered as active Markdown, a subject could contribute links, images,
@mentions, issue references, raw HTML, or additional changelog entries to arelease it had no business editing. Rendering it as literal text closes that
off.
What this costs you. Subjects render monospace, and
#123,GH-123, barecommit SHAs, and
:emoji:inside a subject no longer autolink. BecauseGitHub's squash merge appends
(#​123)to the subject by default, most linesin a typical repository lose that link. The generated commit link at the start
of each line is unaffected. Control characters, line and paragraph separators,
and bidirectional-control characters are replaced with spaces, so a subject can
never span more than its own line.
No inputs or outputs changed, and the
No Changes.sentinel is unchanged.Staying on the previous format
v4.9.0
carries every security and dependency fix in this release -- including undici
7.29.0, which closes 12 advisories -- with the v4 output format untouched. Pin
metcalfc/changelog-generator@v4to stay there. Thev4tag will keep movingon the maintenance line.
What is in this release
Relative to v4.9.0, v5.0.0 adds only the escaping change. Both releases share
everything else:
bump:workflowrewriting pinned actions' provenance comments (#477)@vercel/ncc(#470),eslint(#472),globals(#471),codeql-action(#469)Full history: v4.8.0...v5.0.0
v5Compare Source
v4.9.1Compare Source
Patch release for the v4 line
Documentation and CI only.
dist/is byte-identical tov4.9.0,
so there is no functional change for consumers; this release exists so the
v4tag points at a commit whose docs are correct.
The README's "Simple output modifications" recipe percent-encoded newlines as
%0A, which the long-removed::set-outputcommand decoded.$GITHUB_OUTPUTdoes not, so anyone who copied that snippet got a single line with literal
%0Ain it. It now uses the heredoc form, with a random delimiter because thevalue is built from commit subjects.
The changelog output format remains unchanged from v4.8.0. See
v5.0.0
for the breaking change that renders commit subjects as literal text.
v4.9.0Compare Source
Maintenance release for the v4 line
Security and dependency fixes only. The changelog output format is unchanged
from v4.8.0 -- verified byte-identical -- so tracking
@v4is safe.the published bundle is now verified against a rebuild before attestation
@vercel/ncc0.45.0 and dev-dependency bumpsv5.0.0
contains these same fixes plus a breaking change: commit subjects render as
literal text, so a merged pull request's subject can no longer inject links or
mentions into your release notes. That change also stops
#123autolinkinginside subjects, which is why it is not on the v4 line.
v4.8.0Compare Source
Highlights
Failed changelog generation now fails the step
If the changelog could not be generated — an unresolvable ref, any git error — the action printed an
::error::annotation and then exited 0. The step went green,outputs.changelogwas never set, and downstream steps consumed an empty string without anything indicating a problem.It now exits non-zero.
fetch: trueno longer intermittently fails on shallow checkoutsThe default fetch path chained two
git fetch --depth=1calls ahead ofgit fetch --unshallow. Each rewrites.git/shallowwhile the next has already read it, so git would intermittently abort with:Because
fetch: trueis the default and the exit code was being discarded, this produced a silently empty changelog rather than a visible failure. It was happening in this repository's own CI.Now a single fetch, requesting
--unshallowonly when the checkout is actually shallow.Testing
make testpreviously rannpm test || echo "no tests available", wherenpm testwasexit 1— it reported success unconditionally. The project now has a real suite coveringchangelog.shagainst live git fixtures, ref validation, the release scripts, and the builtdist/bundle as the runner executes it. Both fixes above were found by adding it.Full changelog
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.