Skip to content

ci: bump the github-actions group across 1 directory with 7 updates#50

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-77bb9c0c1b
Closed

ci: bump the github-actions group across 1 directory with 7 updates#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-77bb9c0c1b

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026 •
edited
Loading

Bumps the github-actions group with 7 updates in the / directory:

Package From To
gradle/actions 6.0.1 6.1.0
actions/upload-artifact 7.0.0 7.0.1
lewagon/wait-on-check-action 1.6.0 1.6.1
actions/attest-build-provenance 2.2.3 4.1.0
softprops/action-gh-release 2.6.1 3.0.0
anchore/scan-action 6.5.1 7.4.0
aquasecurity/trivy-action 0.24.0 0.35.0

Updates gradle/actions from 6.0.1 to 6.1.0

Release notes

Sourced from gradle/actions's releases.

v6.1.0

New: Basic Cache Provider

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

  • Built on @actions/cache -- fully open source
  • Caches ~/.gradle/caches and ~/.gradle/wrapper directories
  • Cache key derived from build files (*.gradle*, gradle-wrapper.properties, etc.)
  • Clean cache on build file changes (no restore keys, preventing stale entry accumulation)

Limitations vs Enhanced Caching: No cache cleanup, no deduplication of cached content, cached content is fixed unless build files change.

Revamped Licensing & Distribution Documentation

  • New DISTRIBUTION.md documents the licensing of each component (particularly Basic Caching vs Enhanced Caching)
  • Simplified licensing notices in README, docs, and runtime log output
  • Clear usage tiers: Enhanced Caching is free for public repos and in Free Preview for private repos

What's Changed

Full Changelog: gradle/actions@v6.0.1...v6.1.0

Commits
  • 50e97c2 Link to docs for caching providers
  • f2e6298 Restructure caching documentation for basic and enhanced providers (#934)
  • b294b1e Really fix integ-test-full
  • 83d3189 Revise license details for gradle-actions-caching
  • 1d5db06 Update license link for gradle-actions-caching component
  • 1c80961 Fix license link for Enhanced Caching component
  • 9e99920 Fix integ-test-full workflow
  • bb8aaaf Fix workflow permissions
  • f5dfb43 [bot] Update dist directory
  • ff9ae24 Add open-source 'basic' cache provider and revamp licensing documentation (#930)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • See full diff in compare view

Updates lewagon/wait-on-check-action from 1.6.0 to 1.6.1

Release notes

Sourced from lewagon/wait-on-check-action's releases.

v1.6.1

Added

  • Pin the ruby/setup-ruby version (#143)
Changelog

Sourced from lewagon/wait-on-check-action's changelog.

Changelog

Unreleased

v1.6.1 - 2026-04-06

Added

  • Pin the ruby/setup-ruby version

v1.6.0 - 2026-03-29

Added

  • Add checks-discovery-timeout option

v1.5.0 - 2026-01-25

Added

  • Add fail-on-no-checks option

Fixed

  • Bump rexml to 3.4.2

v1.4.1 - 2025-09-21

Fixed

  • Linux ARM64 support

v1.4.0 - 2025-06-27

Added

  • Add class docs
  • Add frozen_string_literal comments

Removed

  • Remove OpenStruct instances
  • Remove Double quotes
  • Remove Double assertions
  • Remove allow_any uses

Fixed

  • Fix spelling mistakes
  • Fix CI gem caching

... (truncated)

Commits

Updates actions/attest-build-provenance from 2.2.3 to 4.1.0

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.1.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.0.0...v4.1.0

v4.0.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v3.2.0...v4.0.0

v3.2.0

What's Changed

Full Changelog: actions/attest-build-provenance@v3.1.0...v3.2.0

v3.1.0

What's Changed

New Contributors

... (truncated)

Commits
  • a2bbfa2 bump actions/attest from 4.0.0 to 4.1.0 (#838)
  • 0856891 update RELEASE.md docs (#836)
  • e4d4f7c prepare v4 release (#835)
  • 02a49bd Bump github/codeql-action in the actions-minor group (#824)
  • 7c757df Bump the npm-development group with 2 updates (#825)
  • c44148e Bump github/codeql-action in the actions-minor group (#818)
  • 3234352 Bump @​types/node from 25.0.10 to 25.2.0 in the npm-development group (#819)
  • 18db129 Bump tar from 7.5.6 to 7.5.7 (#816)
  • 90fadfa Bump @​actions/core from 2.0.1 to 2.0.2 in the npm-production group (#799)
  • 57db8ba Bump the npm-development group across 1 directory with 3 updates (#808)
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 2.6.1 to 3.0.0

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.6.2

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

2.6.2

What's Changed

Other Changes 🔄

2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Commits
  • b430933 release: cut v3.0.0 for Node 24 upgrade (#670)
  • c2e35e0 chore(deps): bump the npm group across 1 directory with 7 updates (#783)
  • 3bb1273 release 2.6.2
  • c34030f chore: bump node to 24.14.1
  • 8975bd0 chore(deps): bump vite from 8.0.0 to 8.0.5 (#781)
  • f71937f chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 (#777)
  • 3f0d239 chore(deps): bump picomatch from 4.0.3 to 4.0.4 (#775)
  • See full diff in compare view

Updates anchore/scan-action from 6.5.1 to 7.4.0

Release notes

Sourced from anchore/scan-action's releases.

v7.4.0

⬆️ Dependencies

v7.3.2

⬆️ Dependencies

v7.3.1

⬆️ Dependencies

v7.3.0

New in scan-action v7.3.0

⬆️ Dependencies

v7.2.3

New in scan-action v7.2.3

... (truncated)

Commits
  • e116508 chore: bump fast-xml-parser from 5.5.6 to 5.5.7 + setup-node (#631)
  • 382a23a chore(deps): update Grype to v0.110.0 (#618)
  • 2898213 chore: update to node 24 (#629)
  • 4e1eb5b chore: update to modules and bump all deps (required for new @​actions librari...
  • 8ed60d1 chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 (#617)
  • 5a271d2 chore(deps-dev): bump lint-staged from 16.3.1 to 16.3.2 (#619)
  • 6d37af2 chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (#625)
  • 50a8160 chore(deps-dev): bump tar from 7.5.10 to 7.5.11 (#620)
  • daeb723 chore(deps): bump undici from 6.23.0 to 6.24.1 (#622)
  • 6471a7e chore(deps): bump fast-xml-parser from 5.3.6 to 5.5.6 (#626)
  • Additional commits viewable in compare view

Updates aquasecurity/trivy-action from 0.24.0 to 0.35.0

Release notes

Sourced from aquasecurity/trivy-action's releases.

Release: 0.35.0

What's Changed

Full Changelog: aquasecurity/trivy-action@0.34.2...0.35.0

Release: v0.35.0

This release is a duplicate of 0.35.0 which was not compromised.

As part of our response to the recent supply chain attack, we have migrated all tags to use the v prefix (e.g., v0.35.0 instead of 0.35.0). Going forward, all new releases will use the v prefix convention.

We have intentionally kept the 0.35.0 tag intact to avoid breaking existing workflows that depend on it.

If you are currently using 0.35.0, your workflows are safe — no action is required.

Release: v0.34.0

Full Changelog: aquasecurity/trivy-action@v0.33.1...v0.34.0

Release: v0.33.1

What's Changed

Full Changelog: aquasecurity/trivy-action@v0.33.0...v0.33.1

Release: v0.33.0

What's Changed

New Contributors

Full Changelog: aquasecurity/trivy-action@v0.32.0...v0.33.0

Release: v0.32.0

What's Changed

Full Changelog: aquasecurity/trivy-action@v0.31.0...v0.32.0

Release: v0.31.0

What's Changed

... (truncated)

Commits
  • 57a97c7 chore(deps): Update trivy to v0.69.3 (#519)
  • 97e0b38 chore: bump Trivy version to v0.69.2 in test workflow and README (#515)
  • 4c61e63 chore: bump default Trivy version to v0.69.2 (#513)
  • 1bd0625 Merge pull request #508 from nikpivkin/feat/pass-yaml-ignore-file
  • bce3086 remove unused init-cache target
  • 5a9fbb1 supress progress bar when download db
  • 1615450 update trivyignores input description
  • df85774 add comment about fd3
  • 56c8dae remove unused variable
  • e368e32 ci(test): add zizmor security linter for GitHub Actions (#502)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci: bump the github-actions group across 1 directory with 7 updates
179c088 
Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [gradle/actions](https://github.com/gradle/actions) | `6.0.1` | `6.1.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [lewagon/wait-on-check-action](https://github.com/lewagon/wait-on-check-action) | `1.6.0` | `1.6.1` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.2.3` | `4.1.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.1` | `3.0.0` |
| [anchore/scan-action](https://github.com/anchore/scan-action) | `6.5.1` | `7.4.0` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.24.0` | `0.35.0` |



Updates `gradle/actions` from 6.0.1 to 6.1.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@39e147c...50e97c2)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `lewagon/wait-on-check-action` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/lewagon/wait-on-check-action/releases)
- [Changelog](https://github.com/lewagon/wait-on-check-action/blob/master/CHANGELOG.md)
- [Commits](lewagon/wait-on-check-action@a08fbe2...78dd4dd)

Updates `actions/attest-build-provenance` from 2.2.3 to 4.1.0
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@c074443...a2bbfa2)

Updates `softprops/action-gh-release` from 2.6.1 to 3.0.0
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@153bb8e...b430933)

Updates `anchore/scan-action` from 6.5.1 to 7.4.0
- [Release notes](https://github.com/anchore/scan-action/releases)
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md)
- [Commits](anchore/scan-action@1638637...e116508)

Updates `aquasecurity/trivy-action` from 0.24.0 to 0.35.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@6e7b7d1...57a97c7)

---
updated-dependencies:
- dependency-name: gradle/actions
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: lewagon/wait-on-check-action
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: anchore/scan-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added ci CI/CD changes dependencies Dependency updates labels Apr 13, 2026
@github-actions github-actions Bot added docs Documentation and removed dependencies Dependency updates labels Apr 13, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 13, 2026

This is a major version update. Auto-merge is disabled for major updates — please review manually.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 20, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 20, 2026
@dependabot dependabot Bot deleted the dependabot/github_actions/github-actions-77bb9c0c1b branch April 20, 2026 01:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ci CI/CD changes docs Documentation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants