chore(deps): bump the github-actions group across 1 directory with 3 updates by dependabot[bot] · Pull Request #1913 · flanksource/duty

dependabot · 2026-04-20T11:13:07Z

Bumps the github-actions group with 3 updates in the / directory: actions/checkout, actions/setup-go and actions/cache.

Updates actions/checkout from 5.0.0 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

update readme/changelog for v6 by @ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

... (truncated)

Commits

de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
8e8c483 Clarify v6 README (#2328)
033fa0d Add worktree support for persist-credentials includeIf (#2327)
c2d88d3 Update all references from v5 and v4 to v6 (#2314)
1af3b93 update readme/changelog for v6 (#2311)
71cf226 v6-beta (#2298)
069c695 Persist creds to a separate file (#2286)
ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
See full diff in compare view

Updates actions/setup-go from 6.0.0 to 6.4.0

Release notes

Sourced from actions/setup-go's releases.

v6.4.0

What's Changed

Enhancement

Add go-download-base-url input for custom Go distributions by @gdams in actions/setup-go#721

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-go#727

Documentation update

Rearrange README.md, add advanced-usage.md by @priyagupta108 in actions/setup-go#724

Fix Microsoft build of Go link by @gdams in actions/setup-go#734

New Contributors

@gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

Update default Go module caching to use go.mod by @priyagupta108 in actions/setup-go#705

Fix golang download url to go.dev by @178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

Enhancements

Example for restore-only cache in documentation by @aparnajyothi-y in actions/setup-go#696

Update Node.js version in action.yml by @ccoVeille in actions/setup-go#691

Documentation update of actions/checkout by @deining in actions/setup-go#683

Dependency updates

Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot in actions/setup-go#682

Upgrade @actions/cache to v5 by @salmanmkc in actions/setup-go#695

Upgrade actions/checkout from 5 to 6 by @dependabot in actions/setup-go#686

Upgrade qs from 6.14.0 to 6.14.1 by @dependabot in actions/setup-go#703

New Contributors

@ccoVeille made their first contribution in actions/setup-go#691

@deining made their first contribution in actions/setup-go#683

Full Changelog: actions/setup-go@v6...v6.2.0

v6.1.0

What's Changed

Enhancements

Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by @nicholasngai in actions/setup-go#665

Add support for .tool-versions file and update workflow by @priya-kinthali in actions/setup-go#673

Add comprehensive breaking changes documentation for v6 by @mahabaleshwars in actions/setup-go#674

... (truncated)

Commits

See full diff in compare view

Updates actions/cache from 4.2.0 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
6682284 Merge pull request #1738 from actions/prepare-v5.0.4
e340396 Update RELEASES
8a67110 Add licenses
1865903 Update dependencies & patch security vulnerabilities
5656298 Merge pull request #1722 from RyPeck/patch-1
4e380d1 Fix cache key in examples.md for bun.lock
Additional commits viewable in compare view

github-actions · 2026-04-20T11:13:28Z

Benchstat (Other)

Base: 7ce008ee0d2d314e61d5334a17b385650e718f0c
Head: 098df9699cf7ec526bdcd54e02f9912463c720a2

✅ 3 improvement(s)

Benchmark	Base	Head	Change	p-value
`ResourceSelectorConfigs/name-4`	193.9µ	190.8µ	-1.63%	0.041
`UpdateOfConfigsWithProperties-4`	7.108m	7.028m	-1.12%	0.002
`ResourceSelectorQueryBuild/name_and_type-4`	58.34µ	58.13µ	-0.36%	0.041

Full benchstat output

goos: linux
goarch: amd64
pkg: github.com/flanksource/duty/bench
cpu: AMD EPYC 9V74 80-Core Processor                
                                                       │ bench-base.txt │           bench-head.txt           │
                                                       │     sec/op     │    sec/op     vs base              │
InsertionForRowsWithAliases/external_users.aliases-4      517.0µ ±  11%   518.5µ ±  7%       ~ (p=0.699 n=6)
InsertionForRowsWithAliases/config_items.external_id-4    1.032m ±  11%   1.009m ± 14%       ~ (p=0.818 n=6)
InsertionOfConfigsWithProperties-4                        3.268m ±   2%   3.252m ±  1%       ~ (p=0.065 n=6)
UpdateOfConfigsWithProperties-4                           7.108m ±   1%   7.028m ±  0%  -1.12% (p=0.002 n=6)
ResourceSelectorConfigs/name-4                            193.9µ ±   3%   190.8µ ±  3%  -1.63% (p=0.041 n=6)
ResourceSelectorConfigs/name_and_type-4                   215.3µ ±   4%   210.8µ ±  5%       ~ (p=0.132 n=6)
ResourceSelectorConfigs/tags-4                            31.83m ± 172%   58.01m ± 50%       ~ (p=0.699 n=6)
ResourceSelectorQueryBuild/name-4                         39.56µ ±   0%   39.54µ ±  1%       ~ (p=0.667 n=6)
ResourceSelectorQueryBuild/name_and_type-4                58.34µ ±   1%   58.13µ ±  0%  -0.36% (p=0.041 n=6)
ResourceSelectorQueryBuild/tags-4                         15.50µ ±  13%   15.47µ ±  9%       ~ (p=0.394 n=6)
geomean                                                   475.4µ          500.7µ        +5.33%

github-actions · 2026-04-20T11:13:30Z

Benchstat (RLS)

Base: 7ce008ee0d2d314e61d5334a17b385650e718f0c
Head: 098df9699cf7ec526bdcd54e02f9912463c720a2

⚠️ 2 regression(s) detected (threshold: >5%)

Benchmark	Base	Head	Change	p-value
`RLS/Sample-15000/config_types/Without_RLS-4`	2.646m	2.988m	+12.94% 🔴	0.002
`RLS/Sample-15000/config_names/With_RLS-4`	85.14m	86.02m	+1.03%	0.015

✅ 7 improvement(s)

Benchmark	Base	Head	Change	p-value
`RLS/Sample-15000/change_types/With_RLS-4`	4.348m	3.685m	-15.26%	0.009
`RLS/Sample-15000/config_changes/Without_RLS-4`	3.724m	3.450m	-7.35%	0.009
`RLS/Sample-15000/analysis_types/With_RLS-4`	2.764m	2.662m	-3.69%	0.002
`RLS/Sample-15000/catalog_changes/With_RLS-4`	90.84m	88.73m	-2.33%	0.002
`RLS/Sample-15000/config_changes/With_RLS-4`	90.05m	88.14m	-2.12%	0.002
`RLS/Sample-15000/analyzer_types/Without_RLS-4`	2.518m	2.487m	-1.22%	0.004
`RLS/Sample-15000/config_classes/With_RLS-4`	85.50m	84.46m	-1.22%	0.002

Failed: 1 benchmark(s) regressed by more than 5%:
RLS/Sample-15000/config_types/Without_RLS-4: 2.646m -> 2.988m (+12.94%)

Full benchstat output

goos: linux
goarch: amd64
pkg: github.com/flanksource/duty/bench
cpu: AMD EPYC 9V74 80-Core Processor                
                                               │ bench-base.txt │           bench-head.txt            │
                                               │     sec/op     │    sec/op     vs base               │
RLS/Sample-15000/catalog_changes/Without_RLS-4     3.422m ±  6%   3.557m ±  2%        ~ (p=0.065 n=6)
RLS/Sample-15000/catalog_changes/With_RLS-4        90.84m ±  2%   88.73m ±  0%   -2.33% (p=0.002 n=6)
RLS/Sample-15000/config_changes/Without_RLS-4      3.724m ±  7%   3.450m ±  5%   -7.35% (p=0.009 n=6)
RLS/Sample-15000/config_changes/With_RLS-4         90.05m ±  0%   88.14m ±  2%   -2.12% (p=0.002 n=6)
RLS/Sample-15000/config_detail/Without_RLS-4       2.651m ±  2%   2.642m ±  2%        ~ (p=0.394 n=6)
RLS/Sample-15000/config_detail/With_RLS-4          84.74m ±  1%   84.97m ±  1%        ~ (p=0.180 n=6)
RLS/Sample-15000/config_names/Without_RLS-4        9.280m ±  3%   9.323m ±  3%        ~ (p=1.000 n=6)
RLS/Sample-15000/config_names/With_RLS-4           85.14m ±  1%   86.02m ±  3%   +1.03% (p=0.015 n=6)
RLS/Sample-15000/config_summary/Without_RLS-4      43.91m ±  3%   44.16m ±  3%        ~ (p=1.000 n=6)
RLS/Sample-15000/config_summary/With_RLS-4         495.1m ±  1%   496.5m ±  3%        ~ (p=0.310 n=6)
RLS/Sample-15000/configs/Without_RLS-4             5.387m ±  4%   5.296m ±  5%        ~ (p=0.310 n=6)
RLS/Sample-15000/configs/With_RLS-4                83.90m ±  0%   83.90m ±  0%        ~ (p=0.818 n=6)
RLS/Sample-15000/analysis_types/Without_RLS-4      2.618m ±  1%   2.631m ±  1%        ~ (p=0.310 n=6)
RLS/Sample-15000/analysis_types/With_RLS-4         2.764m ±  1%   2.662m ±  2%   -3.69% (p=0.002 n=6)
RLS/Sample-15000/analyzer_types/Without_RLS-4      2.518m ±  1%   2.487m ±  1%   -1.22% (p=0.004 n=6)
RLS/Sample-15000/analyzer_types/With_RLS-4         2.568m ±  1%   2.580m ±  3%        ~ (p=0.937 n=6)
RLS/Sample-15000/change_types/Without_RLS-4        3.624m ± 10%   3.817m ± 10%        ~ (p=0.394 n=6)
RLS/Sample-15000/change_types/With_RLS-4           4.348m ±  8%   3.685m ± 10%  -15.26% (p=0.009 n=6)
RLS/Sample-15000/config_classes/Without_RLS-4      2.195m ±  2%   2.192m ±  1%        ~ (p=0.699 n=6)
RLS/Sample-15000/config_classes/With_RLS-4         85.50m ±  0%   84.46m ±  1%   -1.22% (p=0.002 n=6)
RLS/Sample-15000/config_types/Without_RLS-4        2.646m ±  1%   2.988m ±  5%  +12.94% (p=0.002 n=6)
RLS/Sample-15000/config_types/With_RLS-4           84.75m ±  0%   84.41m ±  1%        ~ (p=0.132 n=6)
geomean                                            13.34m         13.26m         -0.58%

…updates Bumps the github-actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-go](https://github.com/actions/setup-go) and [actions/cache](https://github.com/actions/cache). Updates `actions/checkout` from 5.0.0 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...de0fac2) Updates `actions/setup-go` from 6.0.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...4a36011) Updates `actions/cache` from 4.2.0 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4.2.0...27d5ce7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-04T11:47:14Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 20, 2026

dependabot Bot changed the title ~~chore(deps): bump the github-actions group with 3 updates~~ chore(deps): bump the github-actions group across 1 directory with 3 updates Apr 21, 2026

dependabot Bot force-pushed the dependabot/github_actions/github-actions-7c47b7b828 branch 4 times, most recently from e032e11 to 836b6e8 Compare April 27, 2026 11:26

dependabot Bot force-pushed the dependabot/github_actions/github-actions-7c47b7b828 branch 3 times, most recently from 3311eba to 3cf2d43 Compare April 30, 2026 09:44

dependabot Bot force-pushed the dependabot/github_actions/github-actions-7c47b7b828 branch from 3cf2d43 to 098df96 Compare May 1, 2026 11:08

dependabot Bot closed this May 4, 2026

dependabot Bot deleted the dependabot/github_actions/github-actions-7c47b7b828 branch May 4, 2026 11:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the github-actions group across 1 directory with 3 updates#1913

chore(deps): bump the github-actions group across 1 directory with 3 updates#1913
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-7c47b7b828

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.2

What's Changed

v6.0.1

What's Changed

v6.0.0

What's Changed

v6-beta

What's Changed

v5.0.1

What's Changed

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

v6.3.0

What's Changed

v6.2.0

What's Changed

Enhancements

Dependency updates

New Contributors

v6.1.0

What's Changed

Enhancements

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

v.5.0.2

v5.0.2

What's Changed

v5.0.1

v5.0.1

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

Uh oh!

github-actions Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchstat (Other)

Uh oh!

github-actions Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchstat (RLS)

⚠️ 2 regression(s) detected (threshold: >5%)

Uh oh!

dependabot Bot commented on behalf of github May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

github-actions Bot commented Apr 20, 2026 •

edited

Loading

github-actions Bot commented Apr 20, 2026 •

edited

Loading