Skip to content

ci(deps): bump the github-actions group across 1 directory with 7 updates - #629

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/github_actions/github-actions-05ac03cd85
Open

ci(deps): bump the github-actions group across 1 directory with 7 updates#629
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/github_actions/github-actions-05ac03cd85

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the github-actions group with 7 updates in the / directory:

Package From To
actions/checkout 4.2.2 7.0.1
aws-actions/configure-aws-credentials 4.1.0 6.2.3
astral-sh/setup-uv 8.2.0 9.0.0
amannn/action-semantic-pull-request 5.5.3 6.1.1
python-semantic-release/python-semantic-release 9.21.0 10.6.1
ossf/scorecard-action 2.4.3 2.4.4
github/codeql-action/upload-sarif 4.36.0 4.37.6

Updates actions/checkout from 4.2.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates aws-actions/configure-aws-credentials from 4.1.0 to 6.2.3

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.2.3

6.2.3 (2026-07-22)

Bug Fixes

  • attach git credentials before Tag Major Version push (#1877) (9ae780b)
  • PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

v6.2.2

6.2.2 (2026-07-07)

Miscellaneous Chores

v6.2.1

6.2.1 (2026-06-26)

Bug Fixes

  • enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

v6.2.0

6.2.0 (2026-06-01)

Features

Bug Fixes

  • skip credential check on output-env-credentials: false (#1778) (58e7c47)
  • assumeRole failing from session tag size too large (#1808) (d6f5dc3)

v6.1.3

6.1.3 (2026-05-27)

Bug Fixes

v6.1.2

... (truncated)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.2.3 (2026-07-22)

Bug Fixes

  • attach git credentials before Tag Major Version push (#1877) (9ae780b)
  • PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

6.2.2 (2026-07-07)

Miscellaneous Chores

6.2.1 (2026-06-26)

Bug Fixes

  • enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

Bug Fixes

  • skip credential check on output-env-credentials: false (#1778) (58e7c47)
  • assumeRole failing from session tag size too large (#1808) (d6f5dc3)

6.1.3 (2026-05-28)

Bug Fixes

  • fix: allow kubelet token symlink in #1805

6.1.2 (2026-05-26)

... (truncated)

Commits
  • e6de054 chore(main): release 6.2.3 (#1878)
  • ab3b2ba chore: Update dist
  • fa8d6a5 fix: PackedPolicyTooLarge detection in STS tags (#1899)
  • 42e118a chore(deps-dev): bump markdownlint-cli from 0.49.0 to 0.49.1 (#1896)
  • d86ddfc chore: Update dist
  • 874aaac chore(deps): bump @​aws-sdk/client-sts from 3.1086.0 to 3.1091.0 (#1892)
  • d4341b6 chore: Update dist
  • fe51823 chore(deps-dev): bump @​aws-sdk/credential-provider-env (#1894)
  • a8be382 chore(deps-dev): bump @​biomejs/biome from 2.5.3 to 2.5.4 (#1893)
  • e000376 chore: Update dist
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 8.2.0 to 9.0.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v9.0.0 🌈 Change prune-cache default to false

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes

🐛 Bug fixes

  • fix: fall back to distribution ID when os-release has no version field @​cxzhong (#961)

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v8.3.2 🌈 update known checksums for 0.11.28

Changes

Just a maintenance release

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

... (truncated)

Commits
  • c771a70 chore(deps): roll up Dependabot updates (#970)
  • 2f537ca chore: update known checksums for 0.11.30 (#968)
  • 2269552 Speed up version client by partial response reads (#807)
  • 47a7f4f Change prune-cache default to false (#967)
  • 71966ef chore(deps): roll up Dependabot updates (#962)
  • f12b1f0 fix: fall back to distribution ID when os-release has no version field (#961)
  • ecd24dd chore: update known checksums for 0.11.29 (#960)
  • 6a19136 docs: update version references to v8.3.2 (#949)
  • 11f9893 chore: roll up Dependabot updates (#948)
  • f798556 docs: update version references to v8.3.1 (#946)
  • Additional commits viewable in compare view

Updates amannn/action-semantic-pull-request from 5.5.3 to 6.1.1

Release notes

Sourced from amannn/action-semantic-pull-request's releases.

v6.1.1

6.1.1 (2025-08-22)

Bug Fixes

  • Parse headerPatternCorrespondence properly (#295) (800da4c)

v6.1.0

6.1.0 (2025-08-19)

Features

Bug Fixes

  • Remove trailing whitespace from "unknown release type" error message (#291) (afa4edb)

v6.0.1

6.0.1 (2025-08-13)

Bug Fixes

v6.0.0

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

  • Upgrade action to use Node.js 24 and ESM (#287)

Features

  • Upgrade action to use Node.js 24 and ESM (#287) (bc0c9a7)
Changelog

Sourced from amannn/action-semantic-pull-request's changelog.

Changelog

6.1.1 (2025-08-22)

Bug Fixes

  • Parse headerPatternCorrespondence properly (#295) (800da4c)

6.1.0 (2025-08-19)

Features

Bug Fixes

  • Remove trailing whitespace from "unknown release type" error message (#291) (afa4edb)

6.0.1 (2025-08-13)

Bug Fixes

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

  • Upgrade action to use Node.js 24 and ESM (#287)

Features

  • Upgrade action to use Node.js 24 and ESM (#287) (bc0c9a7)

5.5.3 (2024-06-28)

Bug Fixes

5.5.2 (2024-04-24)

Bug Fixes

5.5.1 (2024-04-24)

... (truncated)

Commits
  • 48f2562 chore: Release 6.1.1 [skip ci]
  • 800da4c fix: Parse headerPatternCorrespondence properly (#295)
  • 677b895 test: Fix broken test
  • 24e6f01 ci: Fix permissions for tagger
  • 7f33ba7 chore: Release 6.1.0 [skip ci]
  • afa4edb fix: Remove trailing whitespace from "unknown release type" error message (#291)
  • a30288b feat: Support providing regexps for types (#292)
  • a46a7c8 build: Move Vitest to devDependencies (#290)
  • fdd4d3d chore: Release 6.0.1 [skip ci]
  • 58e4ab4 fix: Actually execute action (#289)
  • Additional commits viewable in compare view

Updates python-semantic-release/python-semantic-release from 9.21.0 to 10.6.1

Release notes

Sourced from python-semantic-release/python-semantic-release's releases.

v10.6.1 (2026-07-06)

This release is published under the MIT License.

🪲 Bug Fixes

  • changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

  • cmd-version: Fix non-styled error msg when strict & no new version (PR#1437, 5e8f94c)

  • config: Eliminate .git/ in parent dir warnings for monorepos configured with .. (PR#1444, 7a1f822)

📖 Documentation

  • CHANGELOG: Add v9.21.2 changelog details for website (a4115cf)

  • configuration: Document repo_dir config option (PR#1444, 7a1f822)

⚙️ Build System

  • deps: Expand python-gitlab dependency range to include v8.0.0+ (PR#1451, a4b9a43)

  • deps: Expand tomlkit dependency range to include v0.14.0+ & v0.15.0+ (028d539)

  • deps: Extend click dependency range to include v8.2+ (01707ea)

✅ Resolved Issues

  • #1418: Extrenous "Found .git/ in higher parent directory" warning in monorepo setup

  • #1423: Misformated error message

Detailed Changes: v10.6.0...v10.6.1

Installable artifacts are available from:

v10.6.0 (2026-07-04)

This release is published under the MIT License.

✨ Features

... (truncated)

Changelog

Sourced from python-semantic-release/python-semantic-release's changelog.

.. _changelog:

========= CHANGELOG

.. _changelog-v10.6.1:

v10.6.1 (2026-07-06)

🪲 Bug Fixes

  • changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

  • cmd-version: Fix non-styled error msg when strict & no new version, closes [#1423](https://github.com/python-semantic-release/python-semantic-release/issues/1423)_ (PR#1437, 5e8f94c)

  • config: Eliminate .git/ in parent dir warnings for monorepos configured with .., closes [#1418](https://github.com/python-semantic-release/python-semantic-release/issues/1418)_ (PR#1444, 7a1f822)

📖 Documentation

  • CHANGELOG: Add v9.21.2 changelog details for website (a4115cf_)

  • configuration: Document repo_dir config option (PR#1444, 7a1f822)

⚙️ Build System

  • deps: Expand python-gitlab dependency range to include v8.0.0+ (PR#1451, a4b9a43)

  • deps: Expand tomlkit dependency range to include v0.14.0+ & v0.15.0+ (028d539_)

  • deps: Extend click dependency range to include v8.2+ (01707ea_)

.. _#1418: python-semantic-release/python-semantic-release#1418 .. _#1423: python-semantic-release/python-semantic-release#1423 .. _01707ea: python-semantic-release/python-semantic-release@01707ea .. _028d539: python-semantic-release/python-semantic-release@028d539 .. _5e8f94c: python-semantic-release/python-semantic-release@5e8f94c .. _7a1f822: python-semantic-release/python-semantic-release@7a1f822 .. _a4115cf: python-semantic-release/python-semantic-release@a4115cf .. _a4b9a43: python-semantic-release/python-semantic-release@a4b9a43 .. _d95e46e: python-semantic-release/python-semantic-release@d95e46e .. _PR#1437: python-semantic-release/python-semantic-release#1437

... (truncated)

Commits
  • 39dd205 chore: release v10.6.1
  • 7a1f822 fix(config): eliminate .git/ in parent dir warnings for monorepos configure...
  • 5fa2df5 style: fix configuration docs with alphabetical options
  • be11d3f style: adjust formatting for clearer test implementations
  • 5e8f94c fix(cmd-version): fix non-styled error msg when strict & no new version (#1437)
  • 81527c6 style: adjust implementation & tests to suppress warnings & type errors
  • 45f0f27 test: adjust style to match expected pytest environment & type-checker
  • 0ef2d0c build(deps-dev): expand pytest dependency range to include v9.0.0
  • ceb4e97 style(mypy-config): remove specified 3.8 compiler from config - defaults to a...
  • 725e16b ci(validate): adjust lint job to use Python 3.8 instead
  • Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.4.3 to 2.4.4

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.4

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

Commits
  • 2d11466 Bump action tag for v2.4.4 release (#1688)
  • 1bd3285 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
  • 913edce 🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#1671)
  • 0957b8f 🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (#1680)
  • f0061eb 🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#1687)
  • 20ee732 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#1685)
  • 9f295ef 🌱 Bump the github-actions group with 6 updates (#1686)
  • 69bf556 🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (#1681)
  • 94e8b96 🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#1673)
  • c7a1b37 🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#1675)
  • Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.36.0 to 4.37.6

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.6

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format tha...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 3, 2026
@dependabot
ci(deps): bump the github-actions group across 1 directory with 7 upd…
c444a87 
…ates

Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.1` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `4.1.0` | `6.2.3` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.2.0` | `9.0.0` |
| [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request) | `5.5.3` | `6.1.1` |
| [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `9.21.0` | `10.6.1` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.0` | `4.37.6` |



Updates `actions/checkout` from 4.2.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.2.2...3d3c42e)

Updates `aws-actions/configure-aws-credentials` from 4.1.0 to 6.2.3
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@ececac1...e6de054)

Updates `astral-sh/setup-uv` from 8.2.0 to 9.0.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@fac544c...c771a70)

Updates `amannn/action-semantic-pull-request` from 5.5.3 to 6.1.1
- [Release notes](https://github.com/amannn/action-semantic-pull-request/releases)
- [Changelog](https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md)
- [Commits](amannn/action-semantic-pull-request@0723387...48f2562)

Updates `python-semantic-release/python-semantic-release` from 9.21.0 to 10.6.1
- [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases)
- [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst)
- [Commits](python-semantic-release/python-semantic-release@26bb37c...39dd205)

Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@4eaacf0...2d11466)

Updates `github/codeql-action/upload-sarif` from 4.36.0 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@7211b7c...5595cca)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: amannn/action-semantic-pull-request
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: python-semantic-release/python-semantic-release
  dependency-version: 10.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title ci(deps): bump the github-actions group with 7 updates ci(deps): bump the github-actions group across 1 directory with 7 updates Aug 13, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-05ac03cd85 branch from 3e62d8d to c444a87 Compare August 13, 2026 08:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants