Bump the github-actions group with 5 updates by dependabot[bot] · Pull Request #860 · HDFGroup/hdf4

dependabot · 2025-10-01T11:09:06Z

Bumps the github-actions group with 5 updates:

Package	From	To
actions/checkout	`4`	`5`
actions/download-artifact	`4.3.0`	`5.0.0`
actions/setup-java	`4`	`5`
aws-actions/configure-aws-credentials	`4`	`5`
softprops/action-gh-release	`2.3.2`	`2.3.3`

Updates actions/checkout from 4 to 5

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

Prepare v5.0.0 release by @salmanmkc in actions/checkout#2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

Prepare release v4.3.0 by @salmanmkc in actions/checkout#2237

New Contributors

@motss made their first contribution in actions/checkout#1971

@mouismail made their first contribution in actions/checkout#1977

@benwells made their first contribution in actions/checkout#2043

@nebuk89 made their first contribution in actions/checkout#2194

@salmanmkc made their first contribution in actions/checkout#2236

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

What's Changed

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

New Contributors

@Jcambass made their first contribution in actions/checkout#1919

Full Changelog: actions/checkout@v4.2.0...v4.2.1

... (truncated)

Commits

08c6903 Prepare v5.0.0 release (#2238)
9f26565 Update actions checkout to use node 24 (#2226)
See full diff in compare view

Updates actions/download-artifact from 4.3.0 to 5.0.0

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

Update README.md by @nebuk89 in actions/download-artifact#407

BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @GrantBirki in actions/download-artifact#416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

By name: name: my-artifact → extracted to path/ (direct)

By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

By name: name: my-artifact → extracted to path/ (unchanged)

By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

You download artifacts by name

You download multiple artifacts by ID

You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):
- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/
Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):
</tr></table> 

... (truncated)

Commits

634f93c Merge pull request #416 from actions/single-artifact-id-download-path
b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
e262cbe bundle dist
bff23f9 update docs
fff8c14 fix download path logic when downloading a single artifact by id
448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
47225c4 Update README.md
See full diff in compare view

Updates actions/setup-java from 4 to 5

Release notes

Sourced from actions/setup-java's releases.

v5.0.0

What's Changed

Breaking Changes

Upgrade to node 24 by @salmanmkc in actions/setup-java#888

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Upgrades

Upgrade Publish Immutable Action by @HarithaVattikuti in actions/setup-java#798

Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @dependabot[bot] in actions/setup-java#730

Upgrade undici from 5.28.5 to 5.29.0 by @dependabot[bot] in actions/setup-java#833

Upgrade form-data to bring in fix for critical vulnerability by @gowridurgad in actions/setup-java#887

Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in actions/setup-java#896

Bug Fixes

Prevent default installation of JetBrains pre-releases by @priyagupta108 in actions/setup-java#859

Improve Error Handling for Setup-Java Action to Help Debug Intermittent Failures by @gowridurgad in actions/setup-java#848

New Contributors

@gowridurgad made their first contribution in actions/setup-java#848

@salmanmkc made their first contribution in actions/setup-java#888

Full Changelog: actions/setup-java@v4...v5.0.0

v4.7.1

What's Changed

Documentation changes

Add Documentation to Recommend Using GraalVM JDK 17 Version to 17.0.12 to Align with GFTC License Terms by @aparnajyothi-y in actions/setup-java#704

Remove duplicated GraalVM section in documentation by @Marcono1234 in actions/setup-java#716

Dependency updates:

Upgrade @action/cache from 4.0.0 to 4.0.2 by @aparnajyothi-y in actions/setup-java#766

Upgrade @actions/glob from 0.4.0 to 0.5.0 by @dependabot in actions/setup-java#744

Upgrade ts-jest from 29.1.2 to 29.2.5 by @dependabot in actions/setup-java#743

Upgrade @action/cache to 4.0.3 by @aparnajyothi-y in actions/setup-java#773

Full Changelog: actions/setup-java@v4...v4.7.1

v4.7.0

What's Changed

Configure Dependabot settings by @HarithaVattikuti in actions/setup-java#722

README Update: Added a permissions section by @benwells in actions/setup-java#723

Upgrade cache from version 3.2.4 to 4.0.0 by @aparnajyothi-y in actions/setup-java#724

Upgrade @actions/http-client from 2.2.1 to 2.2.3 by @dependabot in actions/setup-java#728

Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @dependabot in actions/setup-java#727

Upgrade @types/jest from 29.5.12 to 29.5.14 by @dependabot in actions/setup-java#729

... (truncated)

Commits

dded088 Bump actions/checkout from 4 to 5 (#896)
0913e9a Upgrade to node 24 (#888)
e9343db Bumps form-data (#887)
ae2b61d Bump undici from 5.28.5 to 5.29.0 (#833)
c190c18 Bump eslint-plugin-jest from 27.9.0 to 29.0.1 (#730)
67aec00 Fix: prevent default installation of JetBrains pre-releases (#859)
ebb356c Improve Error Handling for Setup-Java Action to Help Debug Intermittent Failu...
f4f1212 Update publish-immutable-actions.yml (#798)
See full diff in compare view

Updates aws-actions/configure-aws-credentials from 4 to 5

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v5.0.0

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

Cleanup input handling. Changes invalid boolean input behavior (see #1445)

Features

add skip OIDC option (#1458) (8c45f6b)

Cleanup input handling. Changes invalid boolean input behavior (see #1445) (74b3e27)

support account id allowlist (#1456) (c4be498)

v4.3.1

4.3.1 (2025-08-04)

Bug Fixes

update readme to 4.3.1 (#1424) (be2e7ad)

v4.3.0

4.3.0 (2025-08-04)

NOTE: This release tag originally pointed to 59b441846ad109fa4a1549b73ef4e149c4bfb53b, but a critical bug was discovered shortly after publishing. We updated this tag to d0834ad3a60a024346910e522a81b0002bd37fea to prevent anyone using the 4.3.0 tag from encountering the bug, and we published 4.3.1 to allow workflows to auto update correctly.

Features

dependency update and feature cleanup (#1414) (59489ba), closes #1062 #1191

Optional environment variable output (c3b3ce6)

Bug Fixes

docs: readme samples versioning (5b3c895)

the wrong example region for China partition in README (37fe9a7)

properly set proxy environment variable (cbea708)

Miscellaneous Chores

release 4.3.0 (3f7c218)

v4.2.1

4.2.1 (2025-05-14)

Bug Fixes

... (truncated)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

4.3.1 (2025-08-04)

Bug Fixes

update readme to 4.3.1 (#1424) (be2e7ad)

4.3.0 (2025-08-04)

Features

depenency update and feature cleanup (#1414) (59489ba), closes #1062 #1191

Optional environment variable output (c3b3ce6)

Bug Fixes

docs: readme samples versioning (5b3c895)

the wrong example region for China partition in README (37fe9a7)

properly set proxy environment variable (cbea708)

Miscellaneous Chores

release 4.3.0 (3f7c218)

4.2.1 (2025-05-14)

Bug Fixes

ensure explicit inputs take precedence over environment variables (e56e6c4)

prioritize explicit inputs over environment variables (df9c8fe)

4.2.0 (2025-05-06)

Features

add Expiration field to Outputs (a4f3267)

Document role-duration-seconds range (5a0cf01)

support action inputs as environment variables (#1338) (2c168ad)

Bug Fixes

make sure action builds, also fix dependabot autoapprove (c401b8a)

role chaning on mulitple runs (#1340) (9e38641)

... (truncated)

Commits

a03048d chore(main): release 5.0.0 (#1451)
337f510 chore: Fix markdown link formatting in README.md (#1466)
f001d79 chore: update README with versioning (#1465)
cf5f2ac chore: Update dist
b394bdd chore(deps-dev): bump @aws-sdk/credential-provider-env (#1463)
b632c0b chore(deps-dev): bump memfs from 4.38.1 to 4.38.2 (#1462)
978e44a chore: Update dist
c4be498 feat: support account id allowlist (#1456)
c5a43c3 chore: Update dist
8c45f6b feat: add skip OIDC option (#1458)
Additional commits viewable in compare view

Updates softprops/action-gh-release from 2.3.2 to 2.3.3

Release notes

Sourced from softprops/action-gh-release's releases.

v2.3.3

What's Changed

Exciting New Features 🎉

feat: add input option overwrite_files by @asfernandes in softprops/action-gh-release#343

Other Changes 🔄

dependency updates

New Contributors

@asfernandes made their first contribution in softprops/action-gh-release#343

Full Changelog: softprops/action-gh-release@v2...v2.3.3

Changelog

Sourced from softprops/action-gh-release's changelog.

2.3.3

What's Changed

Exciting New Features 🎉

feat: add input option overwrite_files by @asfernandes in softprops/action-gh-release#343

Other Changes 🔄

dependency updates

Commits

6cbd405 release 2.3.3
fbadcc9 update to use actions/checkout@v5
4a84006 chore(deps): bump @types/node from 20.19.10 to 20.19.11 in the npm group (#648)
7191749 chore(deps): bump actions/checkout in the github-actions group (#649)
126b1e7 chore(deps): bump @types/node from 20.19.9 to 20.19.10 in the npm group (#647)
f82d31e chore(deps): bump the npm group with 3 updates (#643)
f2352b9 chore(deps): bump @types/node from 20.19.2 to 20.19.7 in the npm group (#640)
f0b3259 chore(deps): bump the npm group across 1 directory with 4 updates (#638)
f37a2f9 chore(deps): bump the npm group with 2 updates (#635)
db56014 chore(deps): bump brace-expansion from 2.0.1 to 2.0.2 (#634)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Important

Update GitHub Actions workflows to use the latest versions of actions/checkout, actions/download-artifact, actions/setup-java, aws-actions/configure-aws-credentials, and softprops/action-gh-release.

GitHub Actions Updates:
- Update actions/checkout from v4 to v5 in 20 workflows.
- Update actions/download-artifact from v4.3.0 to v5.0.0 in 15 workflows.
- Update actions/setup-java from v4 to v5 in cmake-bintest.yml, cmake-ctest.yml, cmake-script.yml, main-cmake.yml, and netcdf-cmake.yml.
- Update aws-actions/configure-aws-credentials from v4 to v5 in publish-branch.yml and publish-release.yml.
- Update softprops/action-gh-release from v2.3.2 to v2.3.3 in release-files.yml.

^{This description was created by}^{for f34aefc. You can customize this summary. It will automatically update as commits are pushed.}

Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `5` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `5.0.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `4` | `5` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `4` | `5` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.3.2` | `2.3.3` | Updates `actions/checkout` from 4 to 5 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v4...v5) Updates `actions/download-artifact` from 4.3.0 to 5.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...634f93c) Updates `actions/setup-java` from 4 to 5 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v4...v5) Updates `aws-actions/configure-aws-credentials` from 4 to 5 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@v4...v5) Updates `softprops/action-gh-release` from 2.3.2 to 2.3.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@v2.3.2...v2.3.3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 2.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 1, 2025

dependabot bot requested a review from lrknox as a code owner October 1, 2025 11:09

dependabot bot added the dependencies Pull requests that update a dependency file label Oct 1, 2025

dependabot bot requested review from byrnHDF, derobins and fortnern as code owners October 1, 2025 11:09

dependabot bot added the github_actions Pull requests that update GitHub Actions code label Oct 1, 2025

dependabot bot requested review from bmribler, brtnfld, glennsong09, jhendersonHDF, mattjala, schwehr and vchoi-hdfgroup as code owners October 1, 2025 11:09

lrknox approved these changes Oct 3, 2025

View reviewed changes

lrknox merged commit 31d3d83 into master Oct 3, 2025
103 of 105 checks passed

dependabot bot deleted the dependabot/github_actions/github-actions-0702b4a68b branch October 3, 2025 16:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the github-actions group with 5 updates#860

Bump the github-actions group with 5 updates#860
lrknox merged 1 commit intomasterfrom
dependabot/github_actions/github-actions-0702b4a68b

dependabot bot commented on behalf of github Oct 1, 2025 •

edited by ellipsis-dev bot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 1, 2025 • edited by ellipsis-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v4.3.0

What's Changed

New Contributors

v4.2.2

What's Changed

v4.2.1

What's Changed

New Contributors

v5.0.0

What's Changed

v5.0.0

🚨 Breaking Change

What Changed

Migration Guide

✅ No Action Needed If:

⚠️ Action Required If:

v5.0.0

What's Changed

Breaking Changes

Dependency Upgrades

Bug Fixes

New Contributors

v4.7.1

What's Changed

Documentation changes

Dependency updates:

v4.7.0

What's Changed

v5.0.0

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

Features

v4.3.1

4.3.1 (2025-08-04)

Bug Fixes

v4.3.0

4.3.0 (2025-08-04)

Features

Bug Fixes

Miscellaneous Chores

v4.2.1

4.2.1 (2025-05-14)

Bug Fixes

4.3.1 (2025-08-04)

Bug Fixes

4.3.0 (2025-08-04)

Features

Bug Fixes

Miscellaneous Chores

4.2.1 (2025-05-14)

Bug Fixes

4.2.0 (2025-05-06)

Features

Bug Fixes

v2.3.3

What's Changed

Exciting New Features 🎉

Other Changes 🔄

New Contributors

2.3.3

What's Changed

Exciting New Features 🎉

Other Changes 🔄

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Oct 1, 2025 •

edited by ellipsis-dev bot

Loading