Skip to content

build(deps): bump the actions-monthly group across 1 directory with 8 updates #1386

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
leofang merged 2 commits into from
Dec 18, 2025
Merged

build(deps): bump the actions-monthly group across 1 directory with 8 updates #1386

leofang merged 2 commits into from
Dec 18, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 16, 2025

Bumps the actions-monthly group with 8 updates in the / directory:

Package From To
actions/checkout 5.0.0 6.0.1
korthout/backport-action 3.4.1 4.0.1
astral-sh/setup-uv 6.8.0 7.1.6
github/codeql-action 3 4
actions/download-artifact 5.0.0 7.0.0
JamesIves/github-pages-deploy-action 4.7.4 4.7.6
actions/setup-python 5.6.0 6.1.0
actions/upload-artifact 4.6.2 6.0.0

Updates actions/checkout from 5.0.0 to 6.0.1

Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

Commits

Updates korthout/backport-action from 3.4.1 to 4.0.1

Release notes

Sourced from korthout/backport-action's releases.

Backport-action v4.0.1

What's Changed

This patch fixes a bug where environment variables were no longer passed to git since v4.0.0. For instance, this prevented the action to sign commits with GPG using variables like GNUPGHOME. With this fix, environment variables are provided to git again.

Full Changelog: korthout/backport-action@v4.0.0...v4.0.1

Backport-action v4.0.0

What's Changed

The action now requires Node 24 to run, which is a breaking change. Runner version 2.327.1 or higher is required from now on.

Other changes

Updated dependencies

Full Changelog: korthout/backport-action@v3.4.1...v4.0.0

Commits
  • c656f5d dist: release 4.0.1
  • 3202288 Merge pull request #527 from yafanasiev/fix-git-command-env
  • 386e43b fix: pass existing environment variables when executing git
  • 2e1ecda Merge pull request #525 from korthout/renovate/korthout-backport-action-4.x
  • 2c7404d Update korthout/backport-action action to v4
  • cb62ed3 dist: release 4.1.0-SNAPSHOT
  • 3634249 dist: release 4.0.0
  • e2a0749 Merge pull request #524 from korthout/korthout-release-v4
  • 3781259 docs: prepare for v4
  • d85d794 Merge pull request #523 from korthout/korthout-501-node-24
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 6.8.0 to 7.1.6

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.1.6 🌈 add OS version to cache key to prevent binary incompatibility

Changes

This release will invalidate your cache existing keys!

The os version e.g. ubuntu-22.04 is now part of the cache key. This prevents failing builds when a cache got populated with wheels built with different tools (e.g. glibc) than are present on the runner where the cache got restored.

🐛 Bug fixes

  • feat: add OS version to cache key to prevent binary incompatibility @​eifinger (#716)

🧰 Maintenance

⬆️ Dependency updates

v7.1.5 🌈 allow setting cache-local-path without enable-cache: true

Changes

astral-sh/setup-uv#612 fixed a faulty behavior where this action set UV_CACHE_DIR even though enable-cache was false. It also fixed the cases were the cache dir is already configured in a settings file like pyproject.toml or UV_CACHE_DIR was already set. Here the action shouldn't overwrite or set UV_CACHE_DIR.

These fixes introduced an unwanted behavior: You can still set cache-local-path but this action didn't do anything. This release fixes that.

You can now use cache-local-path to automatically set UV_CACHE_DIR even when enable-cache is false (or gets set to false by default e.g. on self-hosted runners)

- name: This is now possible
  uses: astral-sh/setup-uv@v7
  with:
    enable-cache: false
    cache-local-path: "/path/to/cache"

🐛 Bug fixes

🧰 Maintenance

... (truncated)

Commits
  • 681c641 Bump actions/checkout from 5.0.0 to 6.0.1 (#712)
  • 2e85713 Bump actions/setup-node from 6.0.0 to 6.1.0 (#715)
  • 58b6d7b fix: add OS version to cache key to prevent binary incompatibility (#716)
  • e8b52af chore: update known checksums for 0.9.17 (#714)
  • ed21f2f Bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 (#695)
  • 93202d8 bump dependencies (#709)
  • 5ce0900 set biome files.maxSize to 2MiB (#708)
  • 4180991 allow cache-local-path w/o enable-cache (#707)
  • 0439606 Bump github/codeql-action from 4.30.9 to 4.31.6 (#698)
  • 7dd56c1 chore: update known checksums for 0.9.16 (#706)
  • Additional commits viewable in compare view

Updates github/codeql-action from 3 to 4

Release notes

Sourced from github/codeql-action's releases.

v3.31.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.8 - 11 Dec 2025

  • Update default CodeQL bundle version to 2.23.8. #3354

See the full CHANGELOG.md for more information.

v3.31.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.7 - 05 Dec 2025

  • Update default CodeQL bundle version to 2.23.7. #3343

See the full CHANGELOG.md for more information.

v3.31.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.31.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.5 - 24 Nov 2025

  • Update default CodeQL bundle version to 2.23.6. #3321

See the full CHANGELOG.md for more information.

v3.31.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.4 - 18 Nov 2025

... (truncated)

Commits
  • c4efbda Overlay: Check database metadata for overlayBaseSpecifier
  • dd89143 CodeQL: Add resolveDatabase method
  • 78357d3 Merge pull request #3341 from github/mbg/ci/update-cs-config-cli-tests
  • d61a6fa Update CLI config test to account for overlay db changes on PRs
  • ce27e95 Rebuild
  • 43224eb Bump @​eslint/eslintrc from 3.3.1 to 3.3.3 in the npm-minor group
  • f0ac9bf Merge pull request #3337 from github/mergeback/v4.31.6-to-main-fe4161a2
  • c1ca379 Rebuild
  • c3455c5 Update changelog and version after v4.31.6
  • fe4161a Merge pull request #3336 from github/update-v4.31.6-ecec1f887
  • Additional commits viewable in compare view

Updates actions/download-artifact from 5.0.0 to 7.0.0

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/download-artifact@v5...v6.0.0

Commits
  • 37930b1 Merge pull request #452 from actions/download-artifact-v7-release
  • 72582b9 doc: update readme
  • 0d2ec9d chore: release v7.0.0 for Node.js 24 support
  • fd7ae8f Merge pull request #451 from actions/fix-storage-blob
  • d484700 chore: restore minimatch.dep.yml license file
  • 03a8080 chore: remove obsolete dependency license files
  • 56fe6d9 chore: update @​actions/artifact license file to 5.0.1
  • 8e3ebc4 chore: update package-lock.json with @​actions/artifact@​5.0.1
  • 1e3c4b4 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
  • 458627d chore: use local @​actions/artifact package for Node.js 24 testing
  • Additional commits viewable in compare view

Updates JamesIves/github-pages-deploy-action from 4.7.4 to 4.7.6

Release notes

Sourced from JamesIves/github-pages-deploy-action's releases.

v4.7.6

What's Changed

Build 🔧

Full Changelog: JamesIves/github-pages-deploy-action@v4...v4.7.6

v4.7.5

What's Changed

Bug Fixes 🐛

Build 🔧

Full Changelog: JamesIves/github-pages-deploy-action@v4...v4.7.5

Commits
  • 9d877ee Deploy Production Code for Commit 5ad124cd797fc1553b9810f7cb262a32d1432d1d 🚀
  • 5ad124c Merge branch 'dev' into releases/v4
  • 83e989f fix: additional fixes for stripping git configs
  • 286f4ba build(deps): bump typescript-eslint in the typescript group (#1930)
  • 4ef313c Deploy Production Code for Commit f58e95ea79869a93f918a2f71af6035e58be1fae 🚀
  • f58e95e Merge branch 'dev' into releases/v4
  • f33629c build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#1927)
  • 771d2b1 build(deps): bump typescript-eslint in the typescript group (#1925)
  • 1d137fd fix: cross-repo deployment with actions/checkout@v6 includeIf credentials (#1...
  • f43d9b3 build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#1926)
  • Additional commits viewable in compare view

Updates actions/setup-python from 5.6.0 to 6.1.0

Release notes

Sourced from actions/setup-python's releases.

v6.1.0

What's Changed

Enhancements:

Dependency and Documentation updates:

New Contributors

Full Changelog: actions/setup-python@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-python@v5...v6.0.0

Commits
  • 83679a8 Bump @​types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ...
  • bfc4944 Bump prettier from 3.5.3 to 3.6.2 (#1234)
  • 97aeb3e Bump requests from 2.32.2 to 2.32.4 in /tests/data (#1130)
  • 443da59 Bump actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pi...
  • cfd55ca graalpy: add graalpy early-access and windows builds (#880)
  • bba65e5 Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md (#1094)
  • 18566f8 Improve wording and "fix example" (remove 3.13) on testing against pre-releas...
  • 2e3e4b1 Add support for pip-install input (#1201)
  • 4267e28 Bump urllib3 from 1.26.19 to 2.5.0 in /tests/data and document breaking c...
  • e797f83 Upgrade to node 24 (#1164)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4.6.2 to 6.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/upload-artifact@v4...v5.0.0

Commits
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • ddc45ed docs: update README to correct action name for Node.js 24 support
  • 615b319 chore: release v6.0.0 for Node.js 24 support
  • 017748b Merge pull request #744 from actions/fix-storage-blob
  • 38d4c79 chore: rebuild dist
  • 7d27270 chore: add missing license cache files for @​actions/core, @​actions/io, and mi...
  • 5f643d3 chore: update license files for @​actions/artifact@​5.0.1 dependencies
  • 1df1684 chore: update package-lock.json with @​actions/artifact@​5.0.1
  • b5b1a91 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the actions-monthly group across 1 directory with 8…
8deaadc 
… updates

Bumps the actions-monthly group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `5.0.0` | `6.0.1` |
| [korthout/backport-action](https://github.com/korthout/backport-action) | `3.4.1` | `4.0.1` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.8.0` | `7.1.6` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `5.0.0` | `7.0.0` |
| [JamesIves/github-pages-deploy-action](https://github.com/jamesives/github-pages-deploy-action) | `4.7.4` | `4.7.6` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `6.1.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `6.0.0` |



Updates `actions/checkout` from 5.0.0 to 6.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v5...v6.0.1)

Updates `korthout/backport-action` from 3.4.1 to 4.0.1
- [Release notes](https://github.com/korthout/backport-action/releases)
- [Commits](korthout/backport-action@d074166...c656f5d)

Updates `astral-sh/setup-uv` from 6.8.0 to 7.1.6
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@d0cc045...681c641)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](github/codeql-action@v3...v4)

Updates `actions/download-artifact` from 5.0.0 to 7.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@634f93c...37930b1)

Updates `JamesIves/github-pages-deploy-action` from 4.7.4 to 4.7.6
- [Release notes](https://github.com/jamesives/github-pages-deploy-action/releases)
- [Commits](JamesIves/github-pages-deploy-action@v4.7.4...9d877ee)

Updates `actions/setup-python` from 5.6.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...83679a8)

Updates `actions/upload-artifact` from 4.6.2 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...b7c566a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-monthly
- dependency-name: korthout/backport-action
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-monthly
- dependency-name: astral-sh/setup-uv
  dependency-version: 7.1.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-monthly
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-monthly
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-monthly
- dependency-name: JamesIves/github-pages-deploy-action
  dependency-version: 4.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-monthly
- dependency-name: actions/setup-python
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-monthly
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-monthly
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Dec 16, 2025
@copy-pr-bot
Copy link
Contributor

copy-pr-bot bot commented Dec 16, 2025

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@leofang
Copy link
Member

leofang commented Dec 16, 2025

/ok to test 8deaadc

@github-actions

This comment has been minimized.

Sign in to view
@leofang
Copy link
Member

leofang commented Dec 16, 2025

It might be a good idea to cut a release before updating the infra, since this contains multiple major updates. But I don't feel strongly and it can go either way.

@kkraus14
Copy link
Collaborator

kkraus14 commented Dec 16, 2025

+1 to waiting until after cuda.core 0.5.0 release

@leofang
Copy link
Member

leofang commented Dec 18, 2025

/ok to test aac1191

@leofang leofang enabled auto-merge (squash) December 18, 2025 18:59
@leofang leofang merged commit 9b73e78 into main Dec 18, 2025
80 checks passed
@leofang leofang deleted the dependabot/github_actions/actions-monthly-495ab8beed branch December 18, 2025 20:02
@github-actions
Copy link

github-actions bot commented Dec 18, 2025

Doc Preview CI
Preview removed because the pull request was closed or merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leofang leofang leofang approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@leofang @kkraus14