Skip to content

chore(deps): Bump the github-actions group across 1 directory with 9 updates#1308

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/github-actions-69a14a383a
Open

chore(deps): Bump the github-actions group across 1 directory with 9 updates#1308
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/github-actions-69a14a383a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the github-actions group with 9 updates in the / directory:

Package From To
actions/checkout 6.0.2 6.0.3
shivammathur/setup-php 2.37.1 2.37.2
actions/github-script 7.0.1 9.0.0
github/codeql-action 4.36.0 4.36.2
actions/setup-node 6.2.0 6.4.0
cypress-io/github-action 7.3.0 7.4.0
LizardByte/actions 2026.524.145234 2026.605.34721
codecov/codecov-action 6.0.1 7.0.0
actions/download-artifact 7.0.0 8.0.1

Updates actions/checkout from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

... (truncated)

Commits

Updates shivammathur/setup-php from 2.37.1 to 2.37.2

Release notes

Sourced from shivammathur/setup-php's releases.

2.37.2

Changelog

  • Fixed macOS setup by marking shivammathur/php and shivammathur/extensions as trusted taps.

  • Switched to Visual Studio 18 (vs18) builds for PHP 8.6 on Windows.

  • Improved looking up environment variables.

  • Tightened security in internal GitHub action workflows.

  • Updated Node.js dependencies.

For the complete list of changes, please refer to the Full Changelog

Commits

Updates actions/github-script from 7.0.1 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

... (truncated)

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates github/codeql-action from 4.36.0 to 4.36.2

Release notes

Sourced from github/codeql-action's releases.

v4.36.2

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

  • Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
  • Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
  • Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits
  • 8aad20d Merge pull request #3949 from github/update-v4.36.2-dcb947ce1
  • f521b08 Add additional changelog notes
  • 8aeff0f Update changelog for v4.36.2
  • dcb947c Merge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6
  • c251bce Add changelog note
  • 62953c1 Update default bundle to codeql-bundle-v2.25.6
  • 423b570 Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...
  • c35d1b1 Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...
  • cb1a588 Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoff
  • ba47406 Merge pull request #3943 from github/henrymercer/cache-cli-version-info
  • Additional commits viewable in compare view

Updates actions/setup-node from 6.2.0 to 6.4.0

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

Commits

Updates cypress-io/github-action from 7.3.0 to 7.4.0

Release notes

Sourced from cypress-io/github-action's releases.

v7.4.0

7.4.0 (2026-06-01)

Features

Changelog

Sourced from cypress-io/github-action's changelog.

Changelog

This document gives an overview of changes to the Cypress GitHub JavaScript Action cypress-io/github-action.

See Releases for full details of changes.

Version Changes
v7.4.0 Examples remove Node.js 25. End of support for Node.js 25.
v7.3.0 Add parameter expose for Cypress.expose() support
v7.2.0 Examples remove Node.js 20. End of support for Node.js 20.
v7.1.0 Add parameter package-manager-cache
v7.0.0 Action runs under Node.js 24 instead of Node.js 20
v6.10.0 Examples remove Node.js 23. End of support for Node.js 23.
v6.9.0 Add parameter validation for command
v6.8.0 Examples remove Node.js 18. End of support for Node.js 18.
v6.7.10 Examples updated to Cypress 14
v6.7.9 Migrate to @actions/cache@4.0.0 for continued access to GitHub Actions caching services
v6.7.0 Examples remove Node.js 21. End of support for Node.js 21.
v6.6.0 Add parameter summary-title
v6.5.0 Examples remove Node.js 16. End of support for Node.js 16.
v6.4.0 Action adds PR number and URL if available when recording
v6.3.0 v6 is recommended action version
v6.2.0 Examples updated to Cypress 13
v6.1.0 Examples for Cypress 9 archived in action's v5 branch
v6.0.0 Action runs under Node.js 20 instead of Node.js 16
v5.8.1 Examples remove Node.js 19. End of support for Node.js 19
v5.8.0 Add GitHub step output resultsUrl. Deprecate dashboardUrl.
v5.7.0 Add basic Yarn Modern Plug'n'Play support
v5.6.2 Examples add Node.js 20. End of support and removal of Node.js 14 examples.
v5.6.0 Add check for lockfile presence
v5.5.0 Examples add Yarn Modern
v5.4.0 Examples add Yarn Classic
v5.3.0 Add parameter publish-summary (default true)
v5.2.0 Examples add Node.js 19
v5.1.0 Add parameter auto-cancel-after-failures
v5.0.0 Examples add Node.js 18 and remove Node.js 12
v4.2.2 Dependency on GitHub set-output workflow command removed
v4.2.0 Support for pnpm added
v4.0.0 Support for Cypress 10 and later versions added
v3 Action runs under Node.js 16 instead of Node.js 12
v2 Cypress runs using the Module API
v1 This version is no longer runnable in GitHub due to security changes.
Commits
  • 948d67d feat(deps): remove Node.js 25 (#1781)
  • 2b7e08a chore(deps): update dependency node to v24.16.0 (#1777)
  • 69a0c7c test: complete cypress@15.16.0 update (#1778)
  • e487d96 chore(deps): update node.js to v24.16.0 (#1770)
  • 5cfba34 chore(deps): update dependency webpack to ^5.107.0 (#1771)
  • 65ccb9f chore: add minimum release age and vulnerability alerts to renovate config (#...
  • 5130fef chore(deps): update dependency cypress to v15.16.0 (#1773)
  • e910707 test: exclude Cypress from Yarn Modern npmMinimalAgeGate (#1774)
  • 984bd80 chore(deps): update yarn to v4.15.0 (#1768)
  • 1c3bb66 chore(deps): update dependency vite to ^8.0.14 (#1769)
  • Additional commits viewable in compare view

Updates LizardByte/actions from 2026.524.145234 to 2026.605.34721

Release notes

Sourced from LizardByte/actions's releases.

v2026.605.34721

What's Changed

Full Changelog: LizardByte/actions@v2026.524.145234...v2026.605.34721

Contributors

Commits
  • 200eaeb ci(more_space): remove windows-2022 (#221)
  • 0bdcbf3 fix(release_homebrew): Allow test-bot to manage Homebrew env vars (#220)
  • b52ff77 chore(deps): update astral-sh/setup-uv action to v8.2.0 (#219)
  • 06ad32b chore(deps): update official github actions to v6.0.3 (#218)
  • 6ce344a test(release_homebrew): Add session cleanup for homebrew fork repo (#216)
  • 5390529 style(screenshot): fix sonar warning (#215)
  • 15d8aca chore: add dependency lock files (#214)
  • 638aa37 fix(release_homebrew): auto trust tap (#213)
  • b787bb5 fix(release_homebrew): Setup Homebrew action & refactor formula (#212)
  • 86261d6 chore(deps): update dependency eslint to v10.4.1 (#211)
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 6.0.1 to 7.0.0

Release notes

Sourced from codecov/codecov-action's releases.

v7.0.0

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v6.0.2

This is a copy of the v7.0.0 release to make updates easier

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Updates actions/download-artifact from 7.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Jun 11, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: 3. to review, feature: dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot force-pushed the dependabot/github_actions/github-actions-69a14a383a branch from d4f9110 to ba42202 Compare June 12, 2026 04:17
@dependabot dependabot Bot changed the title chore(deps): bump the github-actions group across 1 directory with 9 updates build(deps): bump the github-actions group across 1 directory with 9 updates Jun 12, 2026
@dependabot dependabot Bot force-pushed the dependabot/github_actions/github-actions-69a14a383a branch from ba42202 to 0391900 Compare June 12, 2026 18:07
@dependabot
chore(deps): Bump the github-actions group across 1 directory with 9 …
43cab1f 
…updates

Bumps the github-actions group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` |
| [shivammathur/setup-php](https://github.com/shivammathur/setup-php) | `2.37.1` | `2.37.2` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `9.0.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.4.0` |
| [cypress-io/github-action](https://github.com/cypress-io/github-action) | `7.3.0` | `7.4.0` |
| [LizardByte/actions](https://github.com/lizardbyte/actions) | `2026.524.145234` | `2026.605.34721` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.1` | `7.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` |



Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

Updates `shivammathur/setup-php` from 2.37.1 to 2.37.2
- [Release notes](https://github.com/shivammathur/setup-php/releases)
- [Commits](shivammathur/setup-php@7c071df...f3e473d)

Updates `actions/github-script` from 7.0.1 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v7.0.1...3a2844b)

Updates `github/codeql-action` from 4.36.0 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@7211b7c...8aad20d)

Updates `actions/setup-node` from 6.2.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6.2.0...48b55a0)

Updates `cypress-io/github-action` from 7.3.0 to 7.4.0
- [Release notes](https://github.com/cypress-io/github-action/releases)
- [Changelog](https://github.com/cypress-io/github-action/blob/master/CHANGELOG.md)
- [Commits](cypress-io/github-action@dace029...948d67d)

Updates `LizardByte/actions` from 2026.524.145234 to 2026.605.34721
- [Release notes](https://github.com/lizardbyte/actions/releases)
- [Commits](LizardByte/actions@25babf9...200eaeb)

Updates `codecov/codecov-action` from 6.0.1 to 7.0.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@e79a696...fb8b358)

Updates `actions/download-artifact` from 7.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@37930b1...3e5f45b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: cypress-io/github-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: LizardByte/actions
  dependency-version: 2026.605.34721
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: shivammathur/setup-php
  dependency-version: 2.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the github-actions group across 1 directory with 9 updates chore(deps): Bump the github-actions group across 1 directory with 9 updates Jun 14, 2026
@dependabot dependabot Bot force-pushed the dependabot/github_actions/github-actions-69a14a383a branch from 0391900 to 43cab1f Compare June 14, 2026 18:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants