Skip to content

chore(ci): bump the actions group with 6 updates#1455

Open
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/github_actions/actions-b5ddefc879
Open

chore(ci): bump the actions group with 6 updates#1455
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/github_actions/actions-b5ddefc879

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 30, 2026

Bumps the actions group with 6 updates:

Package From To
dorny/paths-filter 3.0.2 4.0.1
codecov/codecov-action 4.6.0 6.0.0
denoland/setup-deno 2.0.3 2.0.4
sigstore/cosign-installer 4.1.0 4.1.1
actions/setup-python 5.3.0 6.2.0
rhysd/actionlint 1.7.7 1.7.11

Updates dorny/paths-filter from 3.0.2 to 4.0.1

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.1

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v4.0.0...v4.0.1

v4.0.0

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3.0.3...v4.0.0

v3.0.3

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3...v3.0.3

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.0

v3.0.3

v3.0.2

v3.0.1

v3.0.0

v2.11.1

v2.11.0

v2.10.2

v2.10.1

v2.10.0

v2.9.3

v2.9.2

v2.9.1

v2.9.0

... (truncated)

Commits
  • fbd0ab8 feat: add merge_group event support
  • efb1da7 feat: add dist/ freshness check to PR workflow
  • d8f7b06 Merge pull request #302 from dorny/issue-299
  • addbc14 Update README for v4
  • 9d7afb8 Update CHANGELOG for v4.0.0
  • 782470c Merge branch 'releases/v3'
  • d1c1ffe Update CHANGELOG for v3.0.3
  • ce10459 Merge pull request #294 from saschabratton/master
  • 5f40380 feat: update action runtime to node24
  • 668c092 Merge pull request #279 from wardpeet/patch-1
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 4.6.0 to 6.0.0

Release notes

Sourced from codecov/codecov-action's releases.

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v5.5.4

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

v5.5.3

What's Changed

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

v5.5.2

What's Changed

New Contributors

Full Changelog: codecov/codecov-action@v5.5.1...v5.5.2

v5.5.1

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Updates denoland/setup-deno from 2.0.3 to 2.0.4

Commits

Updates sigstore/cosign-installer from 4.1.0 to 4.1.1

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.1

What's Changed

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

Commits

Updates actions/setup-python from 5.3.0 to 6.2.0

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

Full Changelog: actions/setup-python@v6...v6.2.0

v6.1.0

What's Changed

Enhancements:

Dependency and Documentation updates:

New Contributors

Full Changelog: actions/setup-python@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

... (truncated)

Commits
  • a309ff8 Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)
  • bfe8cc5 Upgrade @​actions dependencies to Node 24 compatible versions (#1259)
  • 4f41a90 Bump urllib3 from 2.5.0 to 2.6.0 in /tests/data (#1253)
  • 83679a8 Bump @​types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ...
  • bfc4944 Bump prettier from 3.5.3 to 3.6.2 (#1234)
  • 97aeb3e Bump requests from 2.32.2 to 2.32.4 in /tests/data (#1130)
  • 443da59 Bump actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pi...
  • cfd55ca graalpy: add graalpy early-access and windows builds (#880)
  • bba65e5 Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md (#1094)
  • 18566f8 Improve wording and "fix example" (remove 3.13) on testing against pre-releas...
  • Additional commits viewable in compare view

Updates rhysd/actionlint from 1.7.7 to 1.7.11

Release notes

Sourced from rhysd/actionlint's releases.

v1.7.11

  • Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @​heppu) 
    env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
  • Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @​hugovk and @​muzimuzhi)
  • Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @​takaram) 
    $ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!
The following 1 attestation matched the policy criteria

Attestation #1

Build repo:..... rhysd/actionlint
Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
Signer repo:.... rhysd/actionlint
Signer workflow: .github/workflows/release.yaml@refs/tags/v1.7.11
  • Report path filters with ./ as error because they never match anything. (#521) 
    on:
  push:
    paths:
      # ERROR: This never matches anything. `foo/bar.txt` is correct.
      - ./foo/bar.txt
  • Fix comparing matrix items when an item is a super set of another item. (#523, #613, thanks @​michaelgruenewald)
  • Fix stack overflow crash by a recursive anchor in matrix items. (#610)
  • Fix an unassigned variable false positive from shellcheck by disabling SC2153 rule. (#573)
  • Reduce the number of memory allocations on resolving anchors.
  • Update the popular actions data set to the latest.
  • Update Go dependencies to the latest.

    • ... (truncated)

    Changelog

    Sourced from rhysd/actionlint's changelog.

    v1.7.11 - 2026-02-14

    • Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @​heppu) 
      env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
    • Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @​hugovk and @​muzimuzhi)
    • Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @​takaram) 
      $ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!
The following 1 attestation matched the policy criteria

Attestation #1

Build repo:..... rhysd/actionlint
Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
Signer repo:.... rhysd/actionlint
Signer workflow: .github/workflows/release.yaml@refs/tags/v1.7.11
  • Report path filters with ./ because they never match anything. (#521) 
    on:
  push:
    paths:
      # ERROR: This never matches anything. `foo/bar.txt` is correct.
      - ./foo/bar.txt
  • Fix comparing matrix items when an item is a super set of another item. (#523, #613, thanks @​michaelgruenewald)
  • Fix stack overflow crash by a recursive anchor in matrix items. (#610)
  • Fix a unassigned variable false positive from shellcheck by disabling SC2153 rule. (#573)
  • Reduce the number of memory allocations on resolving anchors.

    • ... (truncated)

    Commits
    • 393031a bump up version to v1.7.11
    • 63589e8 add link to the release note of the version in playground heading
    • 58a2626 remove legacy Homebrew formula
    • d22c104 fix test script for download script to check error case failures
    • 50d2134 describe how to download and verify artifact using gh (fix #617)
    • 226bb4a update playground npm deps including jsdom v28
    • 1e85edb disable SC2153 shellcheck rule to avoid unassigned variable false positive (f...
    • 8776d64 Merge pull request #619 from takaram/patch-1
    • e3eb8cb reduce memory allocations on resolving anchors
    • db08cec Fix variable name in release workflow
    • Additional commits viewable in compare view

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

    @dependabot
    chore(ci): bump the actions group with 6 updates
    75133ca 
    Bumps the actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) | `3.0.2` | `4.0.1` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `4.6.0` | `6.0.0` |
| [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.3` | `2.0.4` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.0` | `4.1.1` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.3.0` | `6.2.0` |
| [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.7` | `1.7.11` |


Updates `dorny/paths-filter` from 3.0.2 to 4.0.1
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](dorny/paths-filter@de90cc6...fbd0ab8)

Updates `codecov/codecov-action` from 4.6.0 to 6.0.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@b9fd7d1...57e3a13)

Updates `denoland/setup-deno` from 2.0.3 to 2.0.4
- [Release notes](https://github.com/denoland/setup-deno/releases)
- [Commits](denoland/setup-deno@v2.0.3...667a34c)

Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@ba7bc0a...cad07c2)

Updates `actions/setup-python` from 5.3.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@0b93645...a309ff8)

Updates `rhysd/actionlint` from 1.7.7 to 1.7.11
- [Release notes](https://github.com/rhysd/actionlint/releases)
- [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md)
- [Commits](rhysd/actionlint@03d0035...393031a)

---
updated-dependencies:
- dependency-name: dorny/paths-filter
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: denoland/setup-deno
  dependency-version: 2.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: rhysd/actionlint
  dependency-version: 1.7.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot dependabot bot added the dependencies External packages and dependencies label Mar 30, 2026
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    No reviews

    Assignees

    No one assigned

    Labels

    dependencies External packages and dependencies

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    1 participant

    @jaypatrick