Skip to content

chore(deps): bump the github-actions-dependencies group with 13 updates#12

Merged
JerrettDavis merged 2 commits into
mainfrom
dependabot/github_actions/github-actions-dependencies-2d323ad161
Jun 16, 2026
Merged

chore(deps): bump the github-actions-dependencies group with 13 updates#12
JerrettDavis merged 2 commits into
mainfrom
dependabot/github_actions/github-actions-dependencies-2d323ad161

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions-dependencies group with 13 updates:

Package From To
actions/checkout 4 6
actions/setup-dotnet 4 5
actions/upload-artifact 4 7
marocchino/sticky-pull-request-comment 2 3
codecov/codecov-action 5 7
gittools/actions 1 4
softprops/action-gh-release 2 3
github/codeql-action 3 4
advanced-security/component-detection-dependency-submission-action 0.1.0 0.1.1
actions/download-artifact 4.1.3 8.0.1
actions/configure-pages 4 6
actions/upload-pages-artifact 3 5
actions/deploy-pages 4 5

Updates actions/checkout from 4 to 6

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

... (truncated)

Commits
  • df4cb1c Update changelog for v6.0.3 (#2446)
  • 1cce339 Fix checkout init for SHA-256 repositories (#2439)
  • 900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
  • 0c366fd Update changelog (#2357)
  • de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
  • 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
  • 8e8c483 Clarify v6 README (#2328)
  • 033fa0d Add worktree support for persist-credentials includeIf (#2327)
  • c2d88d3 Update all references from v5 and v4 to v6 (#2314)
  • 1af3b93 update readme/changelog for v6 (#2311)
  • Additional commits viewable in compare view

Updates actions/setup-dotnet from 4 to 5

Release notes

Sourced from actions/setup-dotnet's releases.

v5.0.0

What's Changed

Breaking Changes

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Updates

Bug Fixes

New Contributors

Full Changelog: actions/setup-dotnet@v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: actions/setup-dotnet@v4...v4.3.1

v4.3.0

What's Changed

New Contributors

... (truncated)

Commits
  • 9a946fd Add rollForward note in README, improve proxy health check in e2e tests and b...
  • 98af08b Support global.json's rollForward latest* variants (#538)
  • 8404272 Update install scripts to v2026.05.19 (#736)
  • f1970f5 Don't download releases-index.json to resolve major version (#560)
  • af9211b Add dotnet-version: latest support with dotnet-channel input (#730)
  • df991ae chore: bump @actions/* and fast-xml-parser dependencies (#728)
  • a66eefa CI: remove manual PowerShell install from test-proxy job (e2e-tests.yml) (#703)
  • c2fa09f Bump minimatch from 3.1.2 to 3.1.5 (#705)
  • 02574b1 Add support for optional architecture input for cross-architecture .NET insta...
  • 16c7b3c Bump fast-xml-parser from 4.4.1 to 5.3.6 (#671)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates marocchino/sticky-pull-request-comment from 2 to 3

Release notes

Sourced from marocchino/sticky-pull-request-comment's releases.

v3.0.0

What's Changed

  • Update node to 24
  • Update deps

New Contributors

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.4...v3.0.0

v2.9.4

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.3...v2.9.4

v2.9.3

What's Changed

  • Update deps (including security issues)
  • Test with vitest instead of jest
  • Use biome

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.2...v2.9.3

v2.9.2

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.1...v2.9.2

v2.9.1

What's Changed

... (truncated)

Commits
  • d4d6b09 📦️ Build
  • 3868baa build(deps-dev): Bump typescript from 5.9.3 to 6.0.2 (#1670)
  • 26f73b0 build(deps): Bump brace-expansion (#1678)
  • f6e304e build(deps-dev): Bump @​biomejs/biome from 2.4.7 to 2.4.10 (#1675)
  • a7709b6 build(deps-dev): Bump @​types/node from 25.5.0 to 25.5.2 (#1677)
  • 0746c6f build(deps-dev): Bump rollup from 4.59.0 to 4.60.1 (#1676)
  • 2a4b1c3 build(deps-dev): Bump vitest from 4.1.0 to 4.1.2 (#1674)
  • 1ab42d2 build(deps): Bump picomatch from 4.0.3 to 4.0.4 (#1673)
  • 5a61de7 build(deps-dev): Bump @​biomejs/biome from 2.4.6 to 2.4.7 (#1666)
  • 7cb1e16 Add number_force that overrides pull_request number (#1652)
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 5 to 7

Release notes

Sourced from codecov/codecov-action's releases.

v7.0.0

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v6.0.2

This is a copy of the v7.0.0 release to make updates easier

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v5.5.5

This release only contains the keybase.io change as described here.

Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5

v5.5.4

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Updates gittools/actions from 1 to 4

Release notes

Sourced from gittools/actions's releases.

v4.0.0

As part of this release we had 168 commits which resulted in 10 issues being closed.

Breaking changes

Bugs

  • [#1434](GitTools/actions#1434) [ISSUE]: Allow customization of version variable set in $(Build.BuildNumber) for Azure DevOps GitVersion task
  • [#1493](GitTools/actions#1493) [ISSUE]: Azure DevOps Release pipeline throws the error on GitVersion updatebuildnumber

Documentation

Improvements

  • !1627 Potential fix for code scanning alert no. 11: Incomplete string escaping or encoding
  • [#1659](GitTools/actions#1659) [ISSUE]: Unable to fetch GitVersion.Tool

SHA256 Hashes of the release artifacts

  • 1ee9cc45adbd18a72f67cff6789bb9a7cc6b5a1aba2ad9b703df959ee316ec46 - gittools.gittools-4.0.0.25063007.vsix

v3.2.1

As part of this release we had 50 commits which resulted in 1 issue being closed.

Improvements

  • !1586 updates GitVersion and GitReleaseManager versions

SHA256 Hashes of the release artifacts

  • 1d446034a454176807f7c3846983ec4b8a4efef0e2e10cabef19f7ea1f428e33 - gittools.gittools-3.2.1.25042514.vsix

v3.2.0

As part of this release we had 147 commits which resulted in 6 issues being closed.

Bugs

  • [#1400](GitTools/actions#1400) [ISSUE]: Azure DevOps task v3.1.1 fails with 'Overwriting readonly variable is not permitted'
  • [#1515](GitTools/actions#1515) [ISSUE]: gitVersion execute task not immediately available after gitVersion setup task
  • !1554 Normalizes target path in dotnet tool

... (truncated)

Commits
  • bc6623a ci(github): add delay before triggering update examples
  • ace732b feat(github): add workflow automation prompts and git-commit skill
  • 462062f Merge pull request #2031 from GitTools/dependabot/github_actions/gittools/cicd-2
  • cd5bba8 (github-actions): Bump gittools/cicd from 1 to 2
  • 300b335 Merge pull request #2030 from GitTools/dependabot/npm_and_yarn/vite-3932ebd7b6
  • e99f495 (npm): Bump vite from 8.0.6 to 8.0.7 in the vite group
  • 081cd6f dist update
  • cc3b3f3 Merge pull request #1994 from GitTools/dependabot/npm_and_yarn/vite-555ff24f4a
  • ce57e8e build(vite): migrate to oxc and native tsconfig path resolution
  • e600a39 (npm): Bump the vite group across 1 directory with 3 updates
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 2 to 3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.6.2

v2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

v2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

0.1.13

  • fix issue with multiple runs concatenating release bodies #145
Commits

Updates github/codeql-action from 3 to 4

Release notes

Sourced from github/codeql-action's releases.

v3.36.2

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

v3.36.1

No user facing changes.

v3.36.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

v3.35.5

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without not...

    Description has been truncated

@dependabot
chore(deps): bump the github-actions-dependencies group with 13 updates
1957a62 
Bumps the github-actions-dependencies group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `6` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4` | `5` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) | `2` | `3` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5` | `7` |
| [gittools/actions](https://github.com/gittools/actions) | `1` | `4` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2` | `3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |
| [advanced-security/component-detection-dependency-submission-action](https://github.com/advanced-security/component-detection-dependency-submission-action) | `0.1.0` | `0.1.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.3` | `8.0.1` |
| [actions/configure-pages](https://github.com/actions/configure-pages) | `4` | `6` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3` | `5` |
| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4` | `5` |


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

Updates `actions/setup-dotnet` from 4 to 5
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@v4...v5)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `marocchino/sticky-pull-request-comment` from 2 to 3
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)
- [Commits](marocchino/sticky-pull-request-comment@v2...v3)

Updates `codecov/codecov-action` from 5 to 7
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5...v7)

Updates `gittools/actions` from 1 to 4
- [Release notes](https://github.com/gittools/actions/releases)
- [Commits](GitTools/actions@v1...v4)

Updates `softprops/action-gh-release` from 2 to 3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2...v3)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

Updates `advanced-security/component-detection-dependency-submission-action` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/advanced-security/component-detection-dependency-submission-action/releases)
- [Commits](advanced-security/component-detection-dependency-submission-action@v0.1.0...v0.1.1)

Updates `actions/download-artifact` from 4.1.3 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4.1.3...v8.0.1)

Updates `actions/configure-pages` from 4 to 6
- [Release notes](https://github.com/actions/configure-pages/releases)
- [Commits](actions/configure-pages@v4...v6)

Updates `actions/upload-pages-artifact` from 3 to 5
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@v3...v5)

Updates `actions/deploy-pages` from 4 to 5
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/setup-dotnet
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: marocchino/sticky-pull-request-comment
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: codecov/codecov-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: gittools/actions
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: advanced-security/component-detection-dependency-submission-action
  dependency-version: 0.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/configure-pages
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/upload-pages-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/deploy-pages
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 16, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Jun 16, 2026

Copy link
Copy Markdown

Code Coverage

Summary
  Generated on: 06/16/2026 - 02:24:22
  Coverage date: 06/16/2026 - 02:24:20
  Parser: Cobertura
  Assemblies: 0
  Classes: 0
  Files: 0
  Line coverage: 
  Covered lines: 0
  Uncovered lines: 0
  Coverable lines: 0
  Total lines: 0
  Covered branches: 0
  Total branches: 0
  Method coverage: 
  Full method coverage: 
  Covered methods: 0
  Fully covered methods: 0
  Total methods: 0
No assemblies have been covered.

@JerrettDavis JerrettDavis merged commit d458639 into main Jun 16, 2026
5 checks passed
@JerrettDavis JerrettDavis deleted the dependabot/github_actions/github-actions-dependencies-2d323ad161 branch June 16, 2026 02:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JerrettDavis