Skip to content

ci(deps): bump the all-actions group across 1 directory with 3 updates#2297

Merged
dyoshikawa merged 1 commit into
mainfrom
dependabot/github_actions/all-actions-d507122439
Jul 17, 2026
Merged

ci(deps): bump the all-actions group across 1 directory with 3 updates#2297
dyoshikawa merged 1 commit into
mainfrom
dependabot/github_actions/all-actions-d507122439

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-actions group with 3 updates in the / directory: jdx/mise-action, anomalyco/opencode/github and softprops/action-gh-release.

Updates jdx/mise-action from 4.2.0 to 4.2.1

Release notes

Sourced from jdx/mise-action's releases.

v4.2.1: Signed checksums and PATH export fix

A small patch release with two user-facing fixes: mise downloads are now verified against minisign-signed release checksums by default, and the env input no longer leaks the runner's PATH into subsequent steps.

Fixed

Verify mise downloads with signed checksums (#548) by @​jdx

The action now embeds mise's minisign public key and verifies SHASUMS256.txt.minisig before trusting any release checksums, then checks the downloaded mise binary's SHA256 against the verified list. This applies to both GitHub release archives (verified before extraction) and the default mise.jdx.dev CDN path (verified against the signed checksum for the matching release asset). If a CDN download fails verification, the action warns and falls back to the signed GitHub release asset instead of installing an unverified binary.

  • The existing sha256 input still works as an explicit override.
  • Pinned mise versions older than 2024.12.24 (which predate minisign checksums) get a warning and skip signed verification rather than failing.
  • Because tar installs now extract from a verified file on disk, the previous streaming download | tar fast path is replaced with a download-then-verify-then-extract flow.

Thanks to @​potiuk for the detailed threat-model writeup in #547.

Exclude PATH from environment export (#556) by @​jdx

The env input has always documented that "PATH modifications are not part of this", but since the switch to mise env --json in #252 (needed for redaction support), the action was exporting every string value returned by mise — including the computed PATH — into GITHUB_ENV. That effectively snapshotted the runner's entire PATH into subsequent steps and let [env] _.path entries in mise.toml leak past the action's own PATH management.

exportMiseEnv now skips PATH (case-insensitive) when exporting JSON env vars, restoring the documented behavior. Normal mise env vars are still exported, and PATH continues to be managed by the action's own setup (e.g. add_shims_to_path). Fixes #555.

Full Changelog: jdx/mise-action@v4.2.0...v4.2.1

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

4.2.1 - 2026-07-16

🐛 Bug Fixes

🔍 Other Changes

⚙️ Miscellaneous Tasks

4.2.0 - 2026-06-17

🚀 Features

🐛 Bug Fixes

📚 Documentation

⚙️ Miscellaneous Tasks

4.1.0 - 2026-06-04

🚀 Features

🐛 Bug Fixes

... (truncated)

Commits
  • dad1bfd chore: release v4.2.1 (#530)
  • 1e7bfbb chore(ci): automate weekly releases (#557)
  • b107e20 fix: exclude PATH from environment export (#556)
  • d538618 chore(deps): update dependency prettier to v3.9.4 (#553)
  • 99eca4c chore(deps): update github/codeql-action action to v4.36.3 (#552)
  • 43d01e6 chore(deps): update dependency typescript-eslint to v8.62.1 (#551)
  • d44584d chore(deps): update dependency js-yaml to v5.2.1 (#550)
  • 4b4b9b2 chore(release): skip ai reviews for release prs (#549)
  • 0f03c79 fix: verify mise downloads with signed checksums (#548)
  • 6bd511f chore(deps): update dependency js-yaml to v5.2.0 (#546)
  • Additional commits viewable in compare view

Updates anomalyco/opencode/github from 1.17.18 to 1.18.3

Release notes

Sourced from anomalyco/opencode/github's releases.

v1.18.3

Core

Improvements

  • Added an Up Arrow shortcut to close the subagent picker when the first item is selected.

Desktop

Bugfixes

  • Fixed home page scrolling so sticky headers and the session list behave correctly.
  • Fixed startup readiness so WSL server loading is included before the desktop app reports ready.
  • Removed the inactive help button from the app layout.
  • Fixed custom agent selector visibility when custom agents are available.

Improvements

  • Home page command palette search can now find and open sessions.

v1.18.2

Core

Bugfixes

  • Stopped subagents from launching nested subagents by default, with a configurable subagent_depth limit when needed.
  • Improved default reasoning depth for Meta models.

Desktop

Improvements

  • Added Mod+N as another shortcut for opening a new tab.

Bugfixes

  • Restored the Help button in release builds.
  • Kept sessions with null archive times visible instead of dropping them from the home list.
  • Hid the drawer close button on Windows where it conflicts with the window chrome.

Thank you to 1 community contributor:

v1.18.1

Desktop

Bugfixes

  • Fixed spacing between model provider sections in Settings.

v1.18.0

Desktop

Improvements

  • Completed the Desktop v2 migration, including upgrade handling for the new layout and first-launch onboarding.

... (truncated)

Commits

Updates softprops/action-gh-release from 3.0.1 to 3.0.2

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

3.0.1

  • maintenance release with updated dependencies

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. v2.6.2 was the final Node 20-compatible release and is no longer maintained or supported.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; freeze v2 at the final v2.6.2 release

... (truncated)

Commits
  • 3d0d988 release 3.0.2 (#818)
  • 7e13ed4 fix: clarify release creation 404 errors (#817)
  • e6c70a5 fix: replace existing release assets on Gitea (#816)
  • f345337 fix: publish existing draft releases as prereleases (#801)
  • d8a89a2 fix: upload small checksum assets reliably (#815)
  • 45ece40 chore(deps): remove unused TypeScript tooling (#814)
  • f6b913c feat: improve release error reporting and test coverage (#813)
  • 15f193d chore(deps): upgrade TypeScript to 7 (#812)
  • cc8268d chore(deps): bump actions/checkout in the github-actions group (#810)
  • fd0ed1e chore(deps): bump the npm group with 3 updates (#811)
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, ci. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This was referenced Jul 17, 2026
Closed
Merged
@dependabot
ci(deps): bump the all-actions group across 1 directory with 3 updates
b8277a0 
Bumps the all-actions group with 3 updates in the / directory: [jdx/mise-action](https://github.com/jdx/mise-action), [anomalyco/opencode/github](https://github.com/anomalyco/opencode) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release).


Updates `jdx/mise-action` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](jdx/mise-action@e6a8b39...dad1bfd)

Updates `anomalyco/opencode/github` from 1.17.18 to 1.18.3
- [Release notes](https://github.com/anomalyco/opencode/releases)
- [Commits](anomalyco/opencode@b1fc811...127bdb3)

Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@718ea10...3d0d988)

---
updated-dependencies:
- dependency-name: anomalyco/opencode/github
  dependency-version: 1.18.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: jdx/mise-action
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title ci(deps): bump the all-actions group with 3 updates ci(deps): bump the all-actions group across 1 directory with 3 updates Jul 17, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/all-actions-d507122439 branch from 70d4782 to b8277a0 Compare July 17, 2026 11:28
@dyoshikawa
dyoshikawa merged commit d78813f into main Jul 17, 2026
8 checks passed
@dyoshikawa

dyoshikawa commented Jul 17, 2026

Copy link
Copy Markdown
Owner

All checks passed; merged as-is. Thanks, Dependabot!

@dyoshikawa
dyoshikawa deleted the dependabot/github_actions/all-actions-d507122439 branch July 17, 2026 11:53
@dyoshikawa dyoshikawa mentioned this pull request Jul 17, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@dyoshikawa dyoshikawa

@cm-dyoshikawa cm-dyoshikawa

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dyoshikawa @cm-dyoshikawa