chore: bump the actions group with 5 updates by dependabot[bot] · Pull Request #53 · alexbrndl/crypte

dependabot · 2026-09-01T23:19:19Z

Bumps the actions group with 5 updates:

Package	From	To
voidzero-dev/setup-vp	`1.17.0`	`1.18.0`
actions/cache	`4.3.0`	`6.1.0`
actions/upload-artifact	`5.0.0`	`7.0.1`
actions/download-artifact	`5.0.0`	`8.0.1`
changesets/action	`1.9.0`	`2.1.1`

Updates voidzero-dev/setup-vp from 1.17.0 to 1.18.0

Release notes

Sourced from voidzero-dev/setup-vp's releases.

v1.18.0

What's Changed

chore(deps): update vite-plus to v0.2.9 by @renovate[bot] in voidzero-dev/setup-vp#125

chore(deps): update pnpm/action-setup action to v6.0.10 by @renovate[bot] in voidzero-dev/setup-vp#124

feat: pin the install script to the requested version by @fengmk2 in voidzero-dev/setup-vp#127

docs: clarify automatic Node.js resolution by @fengmk2 in voidzero-dev/setup-vp#130

ci: add GitLab end-to-end testing by @fengmk2 in voidzero-dev/setup-vp#132

feat: resolve Vite+ executable paths from VpDirs by @fengmk2 in voidzero-dev/setup-vp#131

chore: release v1.18.0 by @fengmk2 in voidzero-dev/setup-vp#133

Full Changelog: voidzero-dev/setup-vp@v1.17.0...v1.18.0

Commits

1b32467 chore: release v1.18.0 (#133)
a8f9aba feat: resolve Vite+ executable paths from VpDirs (#131)
92568af ci: add GitLab end-to-end testing (#132)
e8f4d95 docs: clarify automatic Node.js resolution (#130)
06b723b feat: pin the install script to the requested version (#127)
f388e2f chore(deps): update pnpm/action-setup action to v6.0.10 (#124)
7c86ca2 chore(deps): update vite-plus to v0.2.9 (#125)
See full diff in compare view

Updates actions/cache from 4.3.0 to 6.1.0

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

Bump @actions/cache to v6.1.0 - handle read-only cache access by @jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Update packages, migrate to ESM by @Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Bump @actions/cache to v5.1.0 - handle read-only cache access by @jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token

Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2

Migrated to ESM module system

Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

55cc834 Merge pull request #1768 from jasongin/readonly-cache
d8cd72f Bump @actions/cache to v6.1.0 - handle cache write error due to RO token
2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
e9b91fd Prettier fixes
e4884b8 Rebuild dist
10baf01 Fixed licenses
e39b386 Fix test mock return order
b692820 PR feedback
6074912 Rebuild dist bundles as ESM to match type:module
5a912e8 Fix lint and jest issues
Additional commits viewable in compare view

Updates actions/upload-artifact from 5.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in actions/upload-artifact#719

fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in actions/upload-artifact#744

prepare release v6.0.0 for Node.js 24 support by @salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
02a8460 Add proxy integration test
b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
e516bc8 docs: correct description of Node.js 24 support in README
Additional commits viewable in compare view

Updates actions/download-artifact from 5.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in actions/download-artifact#471

Add a regression test for artifact name + content-type mismatches by @danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in actions/download-artifact#460

Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

... (truncated)

Commits

3e5f45b Add regression tests for CJK characters (#471)
e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
f258da9 Add change docs
ccc058e Fix linting issues
bd7976b Add a setting to specify what to do on hash mismatch and default it to error
ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
15999bf Add note about package bumps
974686e Bump the version to v8 and add release notes
fbe48b1 Update test names to make it clearer what they do
Additional commits viewable in compare view

Updates changesets/action from 1.9.0 to 2.1.1

Release notes

Sourced from changesets/action's releases.

v2.1.1

Patch Changes

#721 da1ea29 Thanks @KEBABSELLER6! - Fixed typo in renamed inputs from v1 to v2

v2.1.0

Minor Changes

#718 3b7c71c Thanks @bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

#716 6f58ba3 Thanks @bluwy! - Update pr-status message to link to the new faq page

v2.0.0

Major Changes

#692 cb3f011 Thanks @Andarist! - Release commits and tags are now pushed using the GitHub API by default.

Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

#680 ca57073 Thanks @bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

#657 4f718b5 Thanks @Andarist! - Removed compatibility support for old Changesets v1.

#681 7359107 Thanks @bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

Inputs:

version -> version-script

publish -> publish-script

commit -> commit-message

title -> pr-title

branch -> pr-base-branch

Outputs:

pull-request-number -> pr-number

#674 164652b Thanks @bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

#659 5649ff4 Thanks @bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.

#673 823cf74 Thanks @bluwy! - Update to Changesets v3 packages

#695 469993c Thanks @bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@changesets/action

2.1.1

Patch Changes

#721 da1ea29 Thanks @KEBABSELLER6! - Fixed typo in renamed inputs from v1 to v2

2.1.0

Minor Changes

#718 3b7c71c Thanks @bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

#716 6f58ba3 Thanks @bluwy! - Update pr-status message to link to the new faq page

2.0.0

Major Changes

#692 cb3f011 Thanks @Andarist! - Release commits and tags are now pushed using the GitHub API by default.

Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

#680 ca57073 Thanks @bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

#657 4f718b5 Thanks @Andarist! - Removed compatibility support for old Changesets v1.

#681 7359107 Thanks @bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

Inputs:

version -> version-script

publish -> publish-script

commit -> commit-message

title -> pr-title

branch -> pr-base-branch

Outputs:

pull-request-number -> pr-number

#674 164652b Thanks @bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

... (truncated)

Commits

8488615 v2.1.1
d7669c8 Version Packages (#722)
da1ea29 Fix typo in renamed inputs (#721)
7545547 Version Packages (#719)
3043070 Prevent test warning annotations (#720)
3b7c71c Add back cwd input (#718)
6f58ba3 Update pr-status message links to new faq (#716)
e52ce9e Version Packages (#715)
78fdc6b Exit pre mode (#714)
187a104 Update deps for stable (#709)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [voidzero-dev/setup-vp](https://github.com/voidzero-dev/setup-vp) | `1.17.0` | `1.18.0` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5.0.0` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `5.0.0` | `8.0.1` | | [changesets/action](https://github.com/changesets/action) | `1.9.0` | `2.1.1` | Updates `voidzero-dev/setup-vp` from 1.17.0 to 1.18.0 - [Release notes](https://github.com/voidzero-dev/setup-vp/releases) - [Commits](voidzero-dev/setup-vp@313600b...1b32467) Updates `actions/cache` from 4.3.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...55cc834) Updates `actions/upload-artifact` from 5.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...043fb46) Updates `actions/download-artifact` from 5.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@634f93c...3e5f45b) Updates `changesets/action` from 1.9.0 to 2.1.1 - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](changesets/action@a45c4d5...8488615) --- updated-dependencies: - dependency-name: voidzero-dev/setup-vp dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: changesets/action dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-01T23:22:44Z

Tests et couverture

1 test échoue sur 744, dans 47 fichiers.

React Compiler, déclaré par le projet transforme le composant que la preview sert

⚠️ Couverture non mesurée : le lancement s’est arrêté avant.

_{Mesuré sur 5922738.}

alexbrndl · 2026-09-07T17:41:48Z

Quatre des cinq montées sont sur main depuis #55, avec la forme SHA conservée : setup-vp v1.18.0, cache v6.1.0, upload-artifact v7.0.1, download-artifact v8.0.1.

La cinquième, changesets/action v1.9.0 → v2, est sortie du périmètre : v2 renomme toutes les entrées que ce dépôt utilise (version → version-script, title → pr-title, commit → commit-message), donc notre bloc serait accepté sans erreur et entièrement ignoré. Elle est suivie à part, avec un essai par workflow_dispatch avant fusion.

require-review.yml exempte désormais les branches dependabot/*, ce qui débloque cette pull request et les suivantes.

@dependabot rebase

dependabot · 2026-09-07T17:42:54Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026

alexbrndl mentioned this pull request Sep 7, 2026

ci: let Dependabot pull requests through the review gate #55

Merged

dependabot Bot closed this Sep 7, 2026

dependabot Bot deleted the dependabot/github_actions/actions-51d9adca45 branch September 7, 2026 17:42

Navigation Menu

chore: bump the actions group with 5 updates - #53

chore: bump the actions group with 5 updates#53
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-51d9adca45

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

alexbrndl commented Sep 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.18.0

What's Changed

v6.1.0

What's Changed

v6.0.0

What's Changed

v5.1.0

What's Changed

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

Releases

How to prepare a release

Changelog

6.1.0

6.0.0

5.0.4

5.0.3

5.0.2

v7.0.1

What's Changed

v7.0.0

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v6.0.0

v6 - What's new

Node.js 24

What's Changed

v8.0.1

What's Changed

v8.0.0

v8 - What's new

Direct downloads

Enforced checks (breaking)

ESM

What's Changed

v7.0.0

v7 - What's new

Node.js 24

What's Changed

v2.1.1

Patch Changes

v2.1.0

Minor Changes

Patch Changes

v2.0.0

Major Changes

@​changesets/action

2.1.1

Patch Changes

2.1.0

Minor Changes

Patch Changes

2.0.0

Major Changes

Uh oh!

github-actions Bot commented Sep 1, 2026

Tests et couverture

Uh oh!

alexbrndl commented Sep 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

`@changesets/action`