Conversation
dependabot
bot
added
dependencies
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Lagoja
force-pushed
the
dependabot/github_actions/actions/cache-5
branch
from
852df76 to
b7b2130
Compare
Use commit SHA instead of version tag for improved supply chain security. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the composite action’s caching steps to use actions/cache v5 (pinned to a commit SHA), aligning cache behavior with the latest major release of the upstream action.
Changes:
- Bump
actions/cacherestore/save steps from v4 to v5 (using a pinned commit SHA). - Apply the v5 bump to both the Devbox CLI cache and the Nix store cache steps.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5 | ||
| with: |
There was a problem hiding this comment.
actions/cache@v5 runs on Node.js 24 and requires a minimum GitHub Actions Runner version (per upstream release notes). Switching this action’s internal cache steps to v5 can break consumers on older self-hosted runners / some GHES setups; consider documenting this requirement prominently (e.g., in the action description/README) and consider noting the exact cache release (e.g., v5.0.x) in the inline comment so the pinned SHA is auditable.
| if: inputs.refresh-cli == 'false' | ||
| id: cache-devbox-cli | ||
| uses: actions/cache/restore@v4 | ||
| uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5 |
There was a problem hiding this comment.
why not do actions/cache/restore@v5 ?
https://github.com/actions/cache/tree/main/restore#only-restore-cache
2 participants
Bumps actions/cache from 4 to 5.
Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
9255dc7Merge pull request #1686 from actions/cache-v5.0.1-release8ff5423chore: release v5.0.19233019Merge pull request #1685 from salmanmkc/node24-storage-blob-fixb975f2bfix: add peer property to package-lock.json for dependenciesd0a0e18fix: update license files for@actions/cache, fast-xml-parser, and strnum74de208fix: update@actions/cacheto ^5.0.1 for Node.js 24 punycode fixac7f115peerb0f846bfix: update@actions/cachewith storage-blob fix for Node.js 24 punycode depr...a783357Merge pull request #1684 from actions/prepare-cache-v5-release3bb0d78docs: highlight v5 runner requirement in releasesYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)