Skip to content

Bump the gha-deps group across 1 directory with 14 updates #22800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Bump the gha-deps group across 1 directory with 14 updates #22800

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 24, 2025 •
edited
Loading

Bumps the gha-deps group with 14 updates in the / directory:

Package From To
actions/checkout 3 5
actions/setup-node 3 6
actions/github-script 6 8
actions/setup-python 5 6
actions/setup-go 5 6
arduino/setup-protoc 2.0.0 3.0.0
actions/upload-artifact 4 5
actions/attest-build-provenance 2 3
slackapi/slack-github-action 1.24.0 2.1.1
dawidd6/action-send-mail 3.8.0 3.12.0
mheap/github-action-required-labels 4.0.0 5.5.1
actions/download-artifact 4 6
actions/setup-java 4 5
actions/first-interaction 1 3

Updates actions/checkout from 3 to 5

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

What's Changed

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.2.0...v4.2.1

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Updates actions/setup-node from 3 to 6

Release notes

Sourced from actions/setup-node's releases.

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

... (truncated)

Commits

Updates actions/github-script from 6 to 8

Release notes

Sourced from actions/github-script's releases.

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

New Contributors

Full Changelog: actions/github-script@v7...v7.1.0

... (truncated)

Commits
  • ed59741 Merge pull request #653 from actions/sneha-krip/readme-for-v8
  • 2dc352e Bold minimum Actions Runner version in README
  • 01e118c Update README for Node 24 runtime requirements
  • 8b222ac Apply suggestion from @​salmanmkc
  • adc0eea README for updating actions/github-script from v7 to v8
  • 20fe497 Merge pull request #637 from actions/node24
  • e7b7f22 update licenses
  • 2c81ba0 Update Node.js version support to 24.x
  • f28e40c Merge pull request #610 from actions/nebuk89-patch-1
  • 1ae9958 Update README.md
  • Additional commits viewable in compare view

Updates actions/setup-python from 5 to 6

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

What's Changed

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

What's Changed

Enhancements:

Bug fixes:

... (truncated)

Commits
  • e797f83 Upgrade to node 24 (#1164)
  • 3d1e2d2 Revert "Enhance cache-dependency-path handling to support files outside the w...
  • 65b0712 Clarify pythonLocation behavior for PyPy and GraalPy in environment variables...
  • 5b668cf Bump actions/checkout from 4 to 5 (#1181)
  • f62a0e2 Change missing cache directory error to warning (#1182)
  • 9322b3c Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIn...
  • fbeb884 Bump form-data to fix critical vulnerabilities #182 & #183 (#1163)
  • 03bb615 Bump idna from 2.9 to 3.7 in /tests/data (#843)
  • 36da51d Add version parsing from Pipfile (#1067)
  • 3c6f142 update documentation (#1156)
  • Additional commits viewable in compare view

Updates actions/setup-go from 5 to 6

Release notes

Sourced from actions/setup-go's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-go@v5...v6.0.0

v5.5.0

What's Changed

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-go@v5...v5.5.0

v5.4.0

What's Changed

Dependency updates :

... (truncated)

Commits

Updates arduino/setup-protoc from 2.0.0 to 3.0.0

Release notes

Sourced from arduino/setup-protoc's releases.

v3.0.0

What's Changed

New Contributors

Full Changelog: arduino/setup-protoc@v2.1.0...v3.0.0

v2.1.0

What's Changed

New Contributors

Full Changelog: arduino/setup-protoc@v2.0.0...v2.1.0

Commits

Updates actions/upload-artifact from 4 to 5

Release notes

Sourced from actions/upload-artifact's releases.

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/upload-artifact@v4...v5.0.0

v4.6.2

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.1

v4.6.0

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.0

v4.5.0

What's Changed

New Contributors

... (truncated)

Commits
  • 330a01c Merge pull request #734 from actions/danwkennedy/prepare-5.0.0
  • 03f2824 Update github.dep.yml
  • 905a1ec Prepare v5.0.0
  • 2d9f9cd Merge pull request #725 from patrikpolyak/patch-1
  • 9687587 Merge branch 'main' into patch-1
  • 2848b2c Merge pull request #727 from danwkennedy/patch-1
  • 9b51177 Spell out the first use of GHES
  • cd231ca Update GHES guidance to include reference to Node 20 version
  • de65e23 Merge pull request #712 from actions/nebuk89-patch-1
  • 8747d8c Update README.md
  • Additional commits viewable in compare view

Updates actions/attest-build-provenance from 2 to 3

Release notes

Sourced from actions/attest-build-provenance's releases.

v3.0.0

What's Changed

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 24, 2025
@sureshjoshi
Copy link
Member

@benjyw @tdyas @cburroughs

Do we still do this? I don't recall getting an email about this anytime recently - but maybe I'm just not cool enough.

{
                    "name": "Announce to pants-devel",
                    "uses": action("action-send-mail"),
                    "with": {
                        # Note: Email is sent from the dedicated account [email protected].
                        # The EMAIL_CONNECTION_URL should be of the form:
                        # smtp+starttls://[email protected]:[email protected]:465
                        # (i.e., should use gmail's raw SMTP server), and the password
                        # should be a Google account "app password" set up for this purpose
                        # (not the Google account's regular password).
                        # And, of course, that account must have permission to post to pants-devel.
                        "connection_url": f"{gha_expr('secrets.EMAIL_CONNECTION_URL')}",
                        "secure": True,
                        "subject": "file://${{ runner.temp }}/email_announcement_subject.txt",
                        "to": "[email protected]",
                        "from": "Pants Announce",
                        "body": "file://${{ runner.temp }}/email_announcement_body.md",
                        "convert_markdown": True,
                    },
                },

@sureshjoshi sureshjoshi self-assigned this Oct 25, 2025
@sureshjoshi sureshjoshi self-requested a review October 25, 2025 17:26
@dependabot dependabot bot force-pushed the dependabot/github_actions/gha-deps-a64d51e2df branch from 5fd628a to 6c11b30 Compare October 25, 2025 18:54
@cburroughs
Copy link
Contributor

Aren't those the release announcements?

image

@dependabot dependabot bot force-pushed the dependabot/github_actions/gha-deps-a64d51e2df branch 4 times, most recently from 012166e to 0df1fdd Compare October 28, 2025 21:45
@dependabot
Bump the gha-deps group across 1 directory with 14 updates
a7e9f2e 
Bumps the gha-deps group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `3` | `5` |
| [actions/setup-node](https://github.com/actions/setup-node) | `3` | `6` |
| [actions/github-script](https://github.com/actions/github-script) | `6` | `8` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5` | `6` |
| [arduino/setup-protoc](https://github.com/arduino/setup-protoc) | `2.0.0` | `3.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `5` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2` | `3` |
| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `1.24.0` | `2.1.1` |
| [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail) | `3.8.0` | `3.12.0` |
| [mheap/github-action-required-labels](https://github.com/mheap/github-action-required-labels) | `4.0.0` | `5.5.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `6` |
| [actions/setup-java](https://github.com/actions/setup-java) | `4` | `5` |
| [actions/first-interaction](https://github.com/actions/first-interaction) | `1` | `3` |



Updates `actions/checkout` from 3 to 5
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v5)

Updates `actions/setup-node` from 3 to 6
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v3...v6)

Updates `actions/github-script` from 6 to 8
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v6...v8)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v6)

Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v6)

Updates `arduino/setup-protoc` from 2.0.0 to 3.0.0
- [Release notes](https://github.com/arduino/setup-protoc/releases)
- [Commits](arduino/setup-protoc@9b1ee5b...c65c819)

Updates `actions/upload-artifact` from 4 to 5
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v5)

Updates `actions/attest-build-provenance` from 2 to 3
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@v2...v3)

Updates `slackapi/slack-github-action` from 1.24.0 to 2.1.1
- [Release notes](https://github.com/slackapi/slack-github-action/releases)
- [Commits](slackapi/slack-github-action@v1.24.0...v2.1.1)

Updates `dawidd6/action-send-mail` from 3.8.0 to 3.12.0
- [Release notes](https://github.com/dawidd6/action-send-mail/releases)
- [Commits](dawidd6/action-send-mail@v3.8.0...v3.12.0)

Updates `mheap/github-action-required-labels` from 4.0.0 to 5.5.1
- [Release notes](https://github.com/mheap/github-action-required-labels/releases)
- [Commits](mheap/github-action-required-labels@v4.0.0...v5.5.1)

Updates `actions/download-artifact` from 4 to 6
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v6)

Updates `actions/setup-java` from 4 to 5
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v4...v5)

Updates `actions/first-interaction` from 1 to 3
- [Release notes](https://github.com/actions/first-interaction/releases)
- [Commits](actions/first-interaction@v1...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/github-script
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: arduino/setup-protoc
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/upload-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/attest-build-provenance
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: slackapi/slack-github-action
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: dawidd6/action-send-mail
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-deps
- dependency-name: mheap/github-action-required-labels
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/download-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/setup-java
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/first-interaction
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/github_actions/gha-deps-a64d51e2df branch from 0df1fdd to a7e9f2e Compare November 1, 2025 04:20
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 3, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Nov 3, 2025
@dependabot dependabot bot deleted the dependabot/github_actions/gha-deps-a64d51e2df branch November 3, 2025 12:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sureshjoshi sureshjoshi Awaiting requested review from sureshjoshi

Assignees

@sureshjoshi sureshjoshi

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sureshjoshi @cburroughs