Bump the github-actions group across 1 directory with 8 updates by dependabot[bot] · Pull Request #118 · avelino/mcp

dependabot · 2026-10-12T09:05:55Z

Bumps the github-actions group with 8 updates in the / directory:

Package	From	To
actions/checkout	`5.1.0`	`7.0.1`
dtolnay/rust-toolchain	`7e38f4b43b4db5c8dd498af069a4f6196df1d067`	`683b588c487a69d01f6c6ddf40f036ff682cc2c8`
docker/setup-buildx-action	`3.12.0`	`4.4.1`
docker/build-push-action	`6.19.2`	`7.4.0`
actions/upload-artifact	`5.0.0`	`7.0.2`
actions/download-artifact	`5.0.0`	`8.0.2`
docker/setup-qemu-action	`3.7.0`	`4.4.0`
docker/login-action	`3.7.0`	`4.6.0`

Updates actions/checkout from 5.1.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to 683b588c487a69d01f6c6ddf40f036ff682cc2c8

Commits

683b588 Add 1.99.1 patch release
e2a55d2 Merge pull request #187 from dtolnay/pwn
6af9a09 Unify flags[@] and downgrade[@]
83d0610 Safely handle action inputs
See full diff in compare view

Updates docker/setup-buildx-action from 3.12.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

Skip BuildKit image pre-pulls for explicit endpoints by @crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

Use official Buildx releases for cloud driver by @crazy-max in docker/setup-buildx-action#606

Pull BuildKit image before builder creation by @crazy-max in docker/setup-buildx-action#609

Use shared error helpers for Buildx and Docker commands by @crazy-max in docker/setup-buildx-action#620

Bump @docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614

Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

Bump @docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600

Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585

Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598

Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-buildx-action#572

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-buildx-action#551

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/setup-buildx-action#557 docker/setup-buildx-action#580

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-buildx-action#573

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-buildx-action#576

Bump js-yaml from 4.1.1 to 5.2.0 in docker/setup-buildx-action#562

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-buildx-action#577

Bump tmp from 0.2.5 to 0.2.7 in docker/setup-buildx-action#556

Bump undici from 6.25.0 to 6.27.0 in docker/setup-buildx-action#570

Bump vite from 7.3.2 to 7.3.6 in docker/setup-buildx-action#569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

v4.1.0

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in docker/setup-buildx-action#489

Bump brace-expansion from 1.1.12 to 5.0.6 in docker/setup-buildx-action#547 docker/setup-buildx-action#508

Bump fast-xml-builder from 1.0.0 to 1.2.0 in docker/setup-buildx-action#540

Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/setup-buildx-action#496

Bump flatted from 3.3.3 to 3.4.2 in docker/setup-buildx-action#499

Bump glob from 10.3.12 to 13.0.6 in docker/setup-buildx-action#495

Bump handlebars from 4.7.8 to 4.7.9 in docker/setup-buildx-action#504

Bump lodash from 4.17.23 to 4.18.1 in docker/setup-buildx-action#523

Bump picomatch from 4.0.3 to 4.0.4 in docker/setup-buildx-action#503

Bump postcss from 8.5.6 to 8.5.10 in docker/setup-buildx-action#537

... (truncated)

Commits

f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
e700274 chore: update generated content
3061c91 skip BuildKit image pre-pulls for explicit endpoints
594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
bd6e702 chore: update generated content
6268c9d pull BuildKit image before builder creation
e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
533ed8e build(deps): bump the codeql-actions group with 2 updates
bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
d5079fb chore: update generated content
Additional commits viewable in compare view

Updates docker/build-push-action from 6.19.2 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

Use the shared error helper for Buildx commands by @crazy-max in docker/build-push-action#1620

Prevent workflow command injection in metadata logs by @crazy-max in docker/build-push-action#1617

Bump @docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592

Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613

Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615

Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611

Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606

Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577

Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

v7.3.0

Preserve names in esbuild bundle by @crazy-max in docker/build-push-action#1567

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/build-push-action#1545 docker/build-push-action#1572

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/build-push-action#1568

Bump js-yaml from 4.1.1 to 4.3.0 in docker/build-push-action#1566

Bump tmp from 0.2.5 to 0.2.7 in docker/build-push-action#1547

Bump undici from 6.24.1 to 6.27.0 in docker/build-push-action#1564

Bump vite from 7.3.2 to 7.3.6 in docker/build-push-action#1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

v7.2.0

Bump @actions/core from 3.0.0 to 3.0.1 in docker/build-push-action#1525

Bump @docker/actions-toolkit from 0.87.0 to 0.90.0 in docker/build-push-action#1517

Bump brace-expansion from 2.0.2 to 5.0.6 in docker/build-push-action#1534

Bump fast-xml-builder from 1.1.4 to 1.2.0 in docker/build-push-action#1529

Bump fast-xml-parser from 5.5.7 to 5.8.0 in docker/build-push-action#1521

Bump postcss from 8.5.6 to 8.5.10 in docker/build-push-action#1526

Bump tar from 6.2.1 to 7.5.15 in docker/build-push-action#1533

Full Changelog: docker/build-push-action@v7.1.0...v7.2.0

v7.1.0

Git context query format support by @crazy-max in docker/build-push-action#1505

Bump @docker/actions-toolkit from 0.79.0 to 0.87.0 by @crazy-max in docker/build-push-action#1505

Bump brace-expansion from 1.1.12 to 1.1.13 in docker/build-push-action#1500

Bump fast-xml-parser from 5.4.2 to 5.5.7 in docker/build-push-action#1489

Bump flatted from 3.3.3 to 3.4.2 in docker/build-push-action#1491

Bump glob from 10.3.12 to 10.5.0 in docker/build-push-action#1490

Bump handlebars from 4.7.8 to 4.7.9 in docker/build-push-action#1497

Bump lodash from 4.17.23 to 4.18.1 in docker/build-push-action#1510

Bump picomatch from 4.0.3 to 4.0.4 in docker/build-push-action#1496

Bump undici from 6.23.0 to 6.24.1 in docker/build-push-action#1486

Bump vite from 7.3.1 to 7.3.2 in docker/build-push-action#1509

... (truncated)

Commits

c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
459b674 [dependabot skip] chore: update generated content
4dedcb2 chore(deps): Bump @docker/actions-toolkit from 0.99.0 to 0.100.0
379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
9877975 chore: update generated content
7ed0556 use the shared Buildx error summary helper
91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
80dbc86 [dependabot skip] chore: update generated content
50cac3a chore(deps): Bump @docker/actions-toolkit from 0.98.0 to 0.99.0
03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
Additional commits viewable in compare view

Updates actions/upload-artifact from 5.0.0 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

... (truncated)

Commits

cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
c2acded chore: prepare v7.0.2 release
4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
8cbe1be Bump @actions/artifact to 6.3.1
043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
Additional commits viewable in compare view

Updates actions/download-artifact from 5.0.0 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

Update the readme by @danwkennedy in actions/download-artifact#473

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Update @actions/artifact to 6.3.1 by @tunc-d in actions/download-artifact#492

Prepare download-artifact v8.0.2 by @tunc-d in actions/download-artifact#493

New Contributors

@tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

v8.0.1

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in actions/download-artifact#471

Add a regression test for artifact name + content-type mismatches by @danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in actions/download-artifact#460

Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

... (truncated)

Commits

9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
e455989 Prepare download-artifact v8.0.2
a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
29bb7ce Update @actions/artifact to 6.3.1
484a0b5 Update the readme (#473)
3e5f45b Add regression tests for CJK characters (#471)
e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
f258da9 Add change docs
ccc058e Fix linting issues
Additional commits viewable in compare view

Updates docker/setup-qemu-action from 3.7.0 to 4.4.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

Use the shared error helper for Docker commands by @crazy-max in docker/setup-qemu-action#345

Bump @docker/actions-toolkit from 0.96.0 to 0.100.0 in docker/setup-qemu-action#344

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/setup-qemu-action#340

Bump js-yaml from 4.3.1 to 4.3.2 in docker/setup-qemu-action#342

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-qemu-action#337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

Bump @docker/actions-toolkit from 0.92.0 to 0.96.0 in docker/setup-qemu-action#336

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-qemu-action#316

Bump brace-expansion from 1.1.15 to 1.1.18 in docker/setup-qemu-action#332

Bump js-yaml from 4.2.0 to 4.3.1 in docker/setup-qemu-action#334

Bump postcss from 8.5.10 to 8.5.25 in docker/setup-qemu-action#331

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-qemu-action#317

Bump undici from 6.27.0 to 6.28.0 in docker/setup-qemu-action#333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-qemu-action#311

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-qemu-action#295

Bump @docker/actions-toolkit from 0.91.0 to 0.92.0 in docker/setup-qemu-action#315

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-qemu-action#312

Bump js-yaml from 4.1.1 to 4.2.0 in docker/setup-qemu-action#310

Bump tmp from 0.2.6 to 0.2.7 in docker/setup-qemu-action#304

Bump undici from 6.26.0 to 6.27.0 in docker/setup-qemu-action#308

Bump vite from 7.3.2 to 7.3.6 in docker/setup-qemu-action#307

Full Changelog: docker/setup-qemu-action@v4.1.0...v4.2.0

v4.1.0

Add reset input to uninstall current emulators by @crazy-max in docker/setup-qemu-action#21

Bump @docker/actions-toolkit from 0.77.0 to 0.91.0 in docker/setup-qemu-action#250 docker/setup-qemu-action#247

Bump brace-expansion from 1.1.12 to 1.1.15 in docker/setup-qemu-action#265

Bump fast-xml-builder from 1.0.0 to 1.2.0 in docker/setup-qemu-action#286

Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/setup-qemu-action#255

Bump flatted from 3.3.3 to 3.4.2 in docker/setup-qemu-action#257

Bump glob from 10.3.15 to 10.5.0 in docker/setup-qemu-action#254

Bump handlebars from 4.7.8 to 4.7.9 in docker/setup-qemu-action#262

Bump lodash from 4.17.23 to 4.18.1 in docker/setup-qemu-action#273

Bump postcss from 8.5.6 to 8.5.10 in docker/setup-qemu-action#285

Bump tar from 6.2.1 to 7.5.15 in docker/setup-qemu-action#287

Bump tmp from 0.2.5 to 0.2.6 in docker/setup-qemu-action#291

Bump undici from 6.23.0 to 6.26.0 in docker/setup-qemu-action#251

Bump vite from 7.3.1 to 7.3.2 in docker/setup-qemu-action#271

Full Changelog: docker/setup-qemu-action@v4.0.0...v4.1.0

... (truncated)

Commits

9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
a63df2f chore: update generated content
3e4165f use the shared error helper for Docker commands
18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
896cbed [dependabot skip] chore: update generated content
Additional commits viewable in compare view

Updates docker/login-action from 3.7.0 to 4.6.0

Release notes

Sourced from docker/login-action's releases.

v4.6.0

Harden buildx scoped config path handling by @crazy-max in docker/login-action#1059

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1095.0 in docker/login-action#1051

Bump js-yaml from 5.2.1 to 5.2.2 in docker/login-action#1057

Bump postcss from 8.5.10 to 8.5.22 in docker/login-action#1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Surface Docker Hub OIDC error responses by @crazy-max in docker/login-action#1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Support dhi.io as Docker Hub OIDC registry by @crazy-max in docker/login-action#1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Docker Hub OIDC login support by @crazy-max in docker/login-action#1048

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1091.0 in docker/login-action#1037

Bump @docker/actions-toolkit from 0.92.0 to 0.94.0 in docker/login-action#1044 docker/login-action#1050

Bump brace-expansion from 1.1.13 to 1.1.16 in docker/login-action#1046

Bump js-yaml from 5.2.0 to 5.2.1 in docker/login-action#1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Skip empty registry-auth secret mask by @crazy-max in docker/login-action#1035

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Preserve names in esbuild bundle by @crazy-max in docker/login-action#1022

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 docker/login-action#999 docker/login-action#1030

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027

Bump @sigstor... Description has been truncated

Bumps the github-actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `5.1.0` | `7.0.1` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `7e38f4b43b4db5c8dd498af069a4f6196df1d067` | `683b588c487a69d01f6c6ddf40f036ff682cc2c8` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.4.1` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.4.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5.0.0` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `5.0.0` | `8.0.2` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.7.0` | `4.4.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.6.0` | Updates `actions/checkout` from 5.1.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@fbc6f39...3d3c42e) Updates `dtolnay/rust-toolchain` from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to 683b588c487a69d01f6c6ddf40f036ff682cc2c8 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](dtolnay/rust-toolchain@7e38f4b...683b588) Updates `docker/setup-buildx-action` from 3.12.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@8d2750c...f87e599) Updates `docker/build-push-action` from 6.19.2 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@10e90e3...c3c9e26) Updates `actions/upload-artifact` from 5.0.0 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...cf430e0) Updates `actions/download-artifact` from 5.0.0 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@634f93c...9000827) Updates `docker/setup-qemu-action` from 3.7.0 to 4.4.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@c7c5346...9901266) Updates `docker/login-action` from 3.7.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@c94ce9f...dbcb813) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dtolnay/rust-toolchain dependency-version: e2a55d2ffb04f378e9626c28d38b36d230d1e12f dependency-type: direct:production dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-26T03:25:43Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 12, 2026

avelino mentioned this pull request Oct 14, 2026

deps: fix RustSec advisories, take over cargo group, add advisories gate #119

Merged

dependabot Bot force-pushed the dependabot/github_actions/github-actions-798bdaa410 branch 2 times, most recently from 3bfe8cc to 540f09d Compare October 19, 2026 03:27

dependabot Bot force-pushed the dependabot/github_actions/github-actions-798bdaa410 branch from 540f09d to 4b15467 Compare October 19, 2026 09:04

dependabot Bot closed this Oct 26, 2026

dependabot Bot deleted the dependabot/github_actions/github-actions-798bdaa410 branch October 26, 2026 03:25

Navigation Menu

Repository navigation

Bump the github-actions group across 1 directory with 8 updates - #118

Bump the github-actions group across 1 directory with 8 updates#118
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-798bdaa410

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

Uh oh!

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

v6.0.3

What's Changed

New Contributors

v6.0.2

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.4.1

v4.4.0

v4.3.0

v4.2.0

v4.1.0

v7.4.0

v7.3.0

v7.2.0

v7.1.0

v7.0.2

What's Changed

New Contributors

v7.0.1

What's Changed

v7.0.0

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v6.0.0

v6 - What's new

Node.js 24

v8.0.2

What's Changed

New Contributors

v8.0.1

What's Changed

v8.0.0

v8 - What's new

Direct downloads

Enforced checks (breaking)

ESM

What's Changed

v7.0.0

v7 - What's new

v4.4.0

v4.3.0

v4.2.0

v4.1.0

v4.6.0

v4.5.2

v4.5.1

v4.5.0

v4.4.0

v4.3.0

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects