build(deps): bump the actions group across 1 directory with 12 updates by dependabot[bot] · Pull Request #47 · JacobCoffee/debug-toolbar

dependabot · 2026-03-23T07:28:01Z

Bumps the actions group with 12 updates in the / directory:

Package	From	To
actions/checkout	`6.0.1`	`6.0.2`
orhun/git-cliff-action	`4.7.0`	`4.7.1`
zizmorcore/zizmor-action	`0.3.0`	`0.5.2`
astral-sh/setup-uv	`7.1.6`	`7.6.0`
actions/setup-python	`6.1.0`	`6.2.0`
astral-sh/ruff-action	`3.5.1`	`3.6.1`
codecov/codecov-action	`5.5.2`	`5.5.3`
dorny/paths-filter	`3.0.2`	`4.0.1`
rossjrw/pr-preview-action	`1.6.3`	`1.8.1`
actions/upload-artifact	`6.0.0`	`7.0.0`
actions/download-artifact	`7.0.0`	`8.0.1`
softprops/action-gh-release	`2.5.0`	`2.6.1`

Updates actions/checkout from 6.0.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

... (truncated)

Commits

de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
See full diff in compare view

Updates orhun/git-cliff-action from 4.7.0 to 4.7.1

Commits

c93ef52 chore(version): update git-cliff to 2.12.0
2032a55 docs(readme): add an example how to execute arbitrary git-cliff commands (#70)
See full diff in compare view

Updates zizmorcore/zizmor-action from 0.3.0 to 0.5.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.2

What's Changed

zizmor 1.23.1 is now the default used by this action.

Full Changelog: zizmorcore/zizmor-action@v0.5.1...v0.5.2

v0.5.1

What's Changed

zizmor 1.23.0 is now the default used by this action.

Full Changelog: zizmorcore/zizmor-action@v0.5.0...v0.5.1

v0.5.0

What's Changed

Expose output-file as an output when advanced-security: true by @unlobito in zizmorcore/zizmor-action#87

New Contributors

@unlobito made their first contribution in zizmorcore/zizmor-action#87

Full Changelog: zizmorcore/zizmor-action@v0.4.1...v0.5.0

v0.4.1

This version fixes an error in the 0.4.0 release that prevented non-relative use of the action.

What's Changed

Fix version file path by @woodruffw in zizmorcore/zizmor-action#83

Full Changelog: zizmorcore/zizmor-action@v0.4.0...v0.4.1

v0.4.0

This new version of zizmor-action brings two major changes:

The new fail-on-no-inputs option can be used to control whether zizmor-action fails if no inputs were collected by zizmor. The default remains true, reflecting the pre-existing behavior.

The action's use of the official zizmor Docker images is now fully hash-checked internally, preventing accidental or malicious modification to the images. This also means that subsequent releases of zizmor will induce a release of this action, rather than the action always picking up the latest version by default.

What's Changed

docs: extended permissions required for internal repos by @AntoineSebert in zizmorcore/zizmor-action#61

docs: clarify description of "token" to indicate it is only used for online audits by @rmuir in zizmorcore/zizmor-action#63

... (truncated)

Commits

71321a2 Sync zizmor versions (#96)
5ed31db Bump pins (#95)
195d10a Sync zizmor versions (#94)
c65bc88 chore(deps): bump github/codeql-action in the github-actions group (#93)
c2c887f chore(deps): bump zizmorcore/zizmor-action in the github-actions group (#91)
5507ab0 Bump pins in README (#90)
0dce257 chore(deps): bump peter-evans/create-pull-request (#88)
fb94974 Expose output-file as an output when advanced-security: true (#87)
867562a chore(deps): bump the github-actions group with 2 updates (#85)
7462f07 Bump pins in README (#84)
Additional commits viewable in compare view

Updates astral-sh/setup-uv from 7.1.6 to 7.6.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.6.0 🌈 Fetch uv from Astral's mirror by default

Changes

We now default to download uv from releases.astral.sh. This means by default we don't hit the GitHub API at all and shouldn't see any rate limits and timeouts any more.

🚀 Enhancements

Fetch uv from Astral's mirror by default @zsol (#809)

🧰 Maintenance

Switch to ESM for source and test, use CommonJS for dist @eifinger (#806)

chore: update known checksums for 0.10.10 @github-actions[bot] (#804)

⬆️ Dependency updates

chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 @dependabot[bot] (#808)

Bump deps @eifinger (#805)

v7.5.0 🌈 Use astral-sh/versions as version provider

No more rate-limits

This release addresses a long-standing source of timeouts and rate-limit failures in setup-uv.

Previously, the action resolved version identifiers like 0.5.x by iterating over available uv releases via the GitHub API to find the best match. In contrast, latest and exact versions such as 0.5.0 skipped version resolution entirely and downloaded uv directly.

The manifest-file input was an earlier attempt to improve this. It allows providing an url to a file that lists available versions, checksums, and even custom download URLs. The action also shipped with such a manifest. However, because that bundled file could become outdated whenever new uv releases were published, the action still had to fall back to the GitHub API in many cases.

This release solves the problem by sourcing version data from Astral’s versions repository via the raw content endpoint:

https://raw.githubusercontent.com/astral-sh/versions/refs/heads/main/v1/uv.ndjson

By using the raw endpoint instead of the GitHub API, version resolution no longer depends on API authentication and is much less likely to run into rate limits or timeouts.

[!TIP] The next section is only interesting for users of the manifest-file input

The manifest-file input lets you override that source with your own URL, for example to test custom uv builds or alternate download locations.

The manifest file must be in NDJSON format, where each line is a JSON object representing a version and its artifacts. For example:
{"version":"0.10.7","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]}
{"version":"0.10.6","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]}

... (truncated)

Commits

37802ad Fetch uv from Astral's mirror by default (#809)
9f00d18 chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#808)
fd8f376 Switch to ESM for source and test, use CommonJS for dist (#806)
f9070de Bump deps (#805)
cadb67b chore: update known checksums for 0.10.10 (#804)
e06108d Use astral-sh/versions as primary version provider (#802)
0f6ec07 docs: replace copilot instructions with AGENTS.md (#794)
821e5c9 docs: add cross-client dependabot rollup skill (#793)
6ee6290 chore(deps): bump versions (#792)
9f332a1 Add riscv64 architecture support to platform detection (#791)
Additional commits viewable in compare view

Updates actions/setup-python from 6.1.0 to 6.2.0

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

Upgrade dependencies to Node 24 compatible versions by @salmanmkc in actions/setup-python#1259

Upgrade urllib3 from 2.5.0 to 2.6.3 in /__tests__/data by @dependabot in actions/setup-python#1253 and actions/setup-python#1264

Full Changelog: actions/setup-python@v6...v6.2.0

Commits

a309ff8 Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)
bfe8cc5 Upgrade @actions dependencies to Node 24 compatible versions (#1259)
4f41a90 Bump urllib3 from 2.5.0 to 2.6.0 in /tests/data (#1253)
See full diff in compare view

Updates astral-sh/ruff-action from 3.5.1 to 3.6.1

Release notes

Sourced from astral-sh/ruff-action's releases.

v3.6.1 🌈 fix automatic minor tag updates

Changes

This is just a bugfix release for the release process

fix: persist credentials for git push in update-major-minor-tags workflow @eifinger-bot (#312)

🧰 Maintenance

ci: add zizmor security linting @eifinger-bot (#313)

Commits

4919ec5 fix: persist credentials for git push in update-major-minor-tags workflow (#312)
1977806 ci: add zizmor security linting (#313)
aedff8d Bump dependencies and actions (#311)
191187a Bump actions/checkout from 5.0.0 to 6.0.1 (#278)
ecac2cc Bump github/codeql-action from 3.30.5 to 4.31.10 (#294)
ddb8c29 Bump actions/setup-node from 6.0.0 to 6.2.0 (#296)
5eee2a4 search in parent dir (#306)
1d756c4 chore: update known checksums for 0.14.13/0.14.14 (#297)
fde82cb Fix CI: Pin ruff version to stable 0.13.x in test fixture (#305)
deb6320 ignore environment markers in dep specs (#295)
Additional commits viewable in compare view

Updates codecov/codecov-action from 5.5.2 to 5.5.3

Release notes

Sourced from codecov/codecov-action's releases.

v5.5.3

What's Changed

build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in codecov/codecov-action#1874

chore(release): bump to 5.5.3 by @thomasrockhu-codecov in codecov/codecov-action#1922

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

fix: overwrite pr number on fork by @thomasrockhu-codecov in codecov/codecov-action#1871

build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @app/dependabot in codecov/codecov-action#1868

build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by @app/dependabot in codecov/codecov-action#1867

fix: update to use local app/ dir by @thomasrockhu-codecov in codecov/codecov-action#1872

docs: fix typo in README by @datalater in codecov/codecov-action#1866

Document a codecov-cli version reference example by @webknjaz in codecov/codecov-action#1774

build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by @app/dependabot in codecov/codecov-action#1861

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @app/dependabot in codecov/codecov-action#1833

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

feat: upgrade wrapper to 0.2.4 by @jviall in codecov/codecov-action#1864

Pin actions/github-script by Git SHA by @martincostello in codecov/codecov-action#1859

fix: check reqs exist by @joseph-sentry in codecov/codecov-action#1835

fix: Typo in README by @spalmurray in codecov/codecov-action#1838

docs: Refine OIDC docs by @spalmurray in codecov/codecov-action#1837

build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @app/dependabot in codecov/codecov-action#1829

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by @app/dependabot in codecov/codecov-action#1822

fix: OIDC on forks by @joseph-sentry in codecov/codecov-action#1823

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

1af5884 chore(release): bump to 5.5.3 (#1922)
c143300 build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#1874)
See full diff in compare view

Updates dorny/paths-filter from 3.0.2 to 4.0.1

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.1

What's Changed

Support merge queue by @masaru-iritani in dorny/paths-filter#255

New Contributors

@masaru-iritani made their first contribution in dorny/paths-filter#255

Full Changelog: dorny/paths-filter@v4.0.0...v4.0.1

v4.0.0

What's Changed

feat: update action runtime to node24 by @saschabratton in dorny/paths-filter#294

New Contributors

@saschabratton made their first contribution in dorny/paths-filter#294

Full Changelog: dorny/paths-filter@v3.0.3...v4.0.0

v3.0.3

What's Changed

Add missing predicate-quantifier by @wardpeet in dorny/paths-filter#279

New Contributors

@wardpeet made their first contribution in dorny/paths-filter#279

Full Changelog: dorny/paths-filter@v3...v3.0.3

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.0

Update action runtime to node24

v3.0.3

Add missing predicate-quantifier

v3.0.2

Add config parameter for predicate quantifier

v3.0.1

Compare base and ref when token is empty

v3.0.0

Update to Node.js 20

Update all dependencies

v2.11.1

Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output

Document need for pull-requests: read permission

Updating to actions/checkout@v3

v2.11.0

Set list-files input parameter as not required

Update Node.js

Fix incorrect handling of Unicode characters in exec()

Use Octokit pagination

Updates real world links

v2.10.2

Fix getLocalRef() returns wrong ref

v2.10.1

Improve robustness of change detection

v2.10.0

Add ref input parameter

Fix change detection in PR when pullRequest.changed_files is incorrect

v2.9.3

Fix change detection when base is a tag

v2.9.2

Fix fetching git history

v2.9.1

Fix fetching git history + fallback to unshallow repo

v2.9.0

... (truncated)

Commits

fbd0ab8 feat: add merge_group event support
efb1da7 feat: add dist/ freshness check to PR workflow
d8f7b06 Merge pull request #302 from dorny/issue-299
addbc14 Update README for v4
9d7afb8 Update CHANGELOG for v4.0.0
782470c Merge branch 'releases/v3'
d1c1ffe Update CHANGELOG for v3.0.3
ce10459 Merge pull request #294 from saschabratton/master
5f40380 feat: update action runtime to node24
668c092 Merge pull request #279 from wardpeet/patch-1
Additional commits viewable in compare view

Updates rossjrw/pr-preview-action from 1.6.3 to 1.8.1

Release notes

Sourced from rossjrw/pr-preview-action's releases.

v1.8.1

Changes

QR codes (added in 1.8.0) are now enabled by default. Add qr-code: false to disable it.

If you have feedback about QR codes e.g. you strongly feel they should be disabled by default, please leave your thoughts on this issue: rossjrw/pr-preview-action#130

v1.8.0

Features

Add option to add QR code to comment by @lredoban in rossjrw/pr-preview-action#98

New input parameter qr-code, default false, that toggles the behaviour and can also be used to set the QR code provider

qr.rossjrw.com (https://github.com/rossjrw/qrcode-worker) created as the default QR code provider

Bugfixes

Adjusted the timeouts for the wait-for-pages-deployment option - re-increased time for Pages build to start from 90s to 180s

v1.7.3

Bugfixes

Enable GitHub API requests to work with GHES by @Googlom in rossjrw/pr-preview-action#126

v1.7.2

Bugfixes

Adjusted the timeouts for the wait-for-pages-deployment option

Wait for Pages build to start: 180s -> 90s

Wait for Pages build to complete: 180s -> 1800s

v1.7.1

Bugfixes

Increased the timeouts for the wait-for-pages-deployment option, suggested by @eliodinino

Wait for Pages build to start: 60s -> 180s

Wait for Pages build to complete: 60s -> 180s

v1.7.0

Features

Support passing through overrides for the commit author by @FasterSpeeding in rossjrw/pr-preview-action#32

Adds two new input parameters: git-config-name and git-config-email

Add customisable commit messages for deploy and destroy actions by @bengeois in rossjrw/pr-preview-action#120

Adds two new input parameters: deploy-commit-message and remove-commit-message

Add option to wait for deploy to finish by @rossjrw in rossjrw/pr-preview-action#121, reported by @vincerubinetti in #25

Adds a new input parameter: wait-for-pages-deployment, boolean, default false (may be true in a future version)

Internal changes

Add automated integration testing by @rossjrw in rossjrw/pr-preview-action#122

Commits

ffa7509 Merge pull request #129 from rossjrw/enable-qr
5b9cf5d Move QR provider determination to comment generator
5bc2014 Enable default provider when qr-code is true
520ebf3 Enable QR codes by default
7eb2064 Automate readme screenshots
5fd5f8e Reincrease page build start timeout
b4a20f5 Update preview image
74401f0 Use QR code internally
8d0e59d Merge pull request #98 from lredoban/qr-code
66ce60d Tweak intro to mention important setup stuff
Additional commits viewable in compare view

Updates actions/upload-artifact from 6.0.0 to 7.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

Commits

bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
02a8460 Add proxy integration test
See full diff in compare view

Updates actions/download-artifact from 7.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in actions/download-artifact#471

Add a regression test for artifact name + content-type mismatches by @danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in actions/download-artifact#460

Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits

3e5f45b Add regression tests for CJK characters (#471)
e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
f258da9 Add change docs
ccc058e Fix linting issues
bd7976b Add a setting to specify what to do on hash mismatch and default it to error
ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
15999bf Add note about package bumps
974686e Bump the version to v8 and add release notes
fbe48b1 Update test names to make it clearer what they do
Additional commits viewable in compare view

Updates softprops/action-gh-release from 2.5.0 to 2.6.1

Release notes

Sourced from softprops/action-gh-release's releases.

v2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

fix: preserve discussion category on publish by @chenrui333 in softprops/action-gh-release#765

v2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Exciting New Features 🎉

feat: support previous_tag for generate_release_notes by @pocesar in softprops/action-gh-release#372

Bug fixes 🐛

fix: recover concurrent asset metadata 404s by @chenrui333 in softprops/action-gh-release#760

Other Changes 🔄

docs: clarify reused draft release behavior by @chenrui333 in softprops/action-gh-release#759

docs: clarify working_directory input by @chenrui333 in softprops/action-gh-release#761

ci: verify dist bundle freshness by @chenrui333 in softprops/action-gh-release#762

fix: clarify immutable prerelease uploads by @chenrui333 in softprops/action-gh-release#763

v2.5.3

2.5.3 is a patch release focused on the remaining path-handling and release-selection bugs uncovered after 2.5.2. It fixes [#639](https://github.com/softprops/action-gh-release/issues/639), [#571](https://github.com/softprops/action-gh-release/issues/571), [#280](https://github.com/softprops/action-gh-release/issues/280), [#614](https://github.com/softprops/action-gh-release/issues/614), [#311](https://github.com/softprops/action-gh-release/issues/311), [#403](https://github.com/softprops/action-gh-release/issues/403), and [#368](https://github.com/softprops/action-gh-release/issues/368). It also adds documentation clarifications for [#541](https://github.com/softprops/action-gh-release/issues/541), [#645](https://github.com/softprops/action-gh-release/issues/645), [#542](https://github.com/softprops/action-gh-release/issues/542), [#393](https://github.com/softprops/action-gh-release/issues/393), and [#411](https://github.com/softprops/action-gh-release/issues/411), where the current behavior is either usage-sensitive or constrained by GitHub platform limits rather than an action-side runtime bug.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

fix: preserve discussion category on publish by @chenrui333 in softprops/action-gh-release#765

2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Exciting New Features 🎉

feat: support previous_tag for generate_release_notes by @pocesar in softprops/action-gh-release#372

Bug fixes 🐛

fix: recover concurrent asset metadata 404s by @chenrui333 in softprops/action-gh-release#760

Other Changes 🔄

docs: clarify reused draft release behavior by @chenrui333 in softprops/action-gh-release#759

docs: clarify working_directory input by @chenrui333 in

Bumps the actions group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.1` | `6.0.2` | | [orhun/git-cliff-action](https://github.com/orhun/git-cliff-action) | `4.7.0` | `4.7.1` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.3.0` | `0.5.2` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.1.6` | `7.6.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.1.0` | `6.2.0` | | [astral-sh/ruff-action](https://github.com/astral-sh/ruff-action) | `3.5.1` | `3.6.1` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.2` | `5.5.3` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `3.0.2` | `4.0.1` | | [rossjrw/pr-preview-action](https://github.com/rossjrw/pr-preview-action) | `1.6.3` | `1.8.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.5.0` | `2.6.1` | Updates `actions/checkout` from 6.0.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@8e8c483...de0fac2) Updates `orhun/git-cliff-action` from 4.7.0 to 4.7.1 - [Release notes](https://github.com/orhun/git-cliff-action/releases) - [Commits](orhun/git-cliff-action@v4.7.0...v4.7.1) Updates `zizmorcore/zizmor-action` from 0.3.0 to 0.5.2 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@e639db9...71321a2) Updates `astral-sh/setup-uv` from 7.1.6 to 7.6.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@681c641...37802ad) Updates `actions/setup-python` from 6.1.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@83679a8...a309ff8) Updates `astral-sh/ruff-action` from 3.5.1 to 3.6.1 - [Release notes](https://github.com/astral-sh/ruff-action/releases) - [Commits](astral-sh/ruff-action@57714a7...4919ec5) Updates `codecov/codecov-action` from 5.5.2 to 5.5.3 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@671740a...1af5884) Updates `dorny/paths-filter` from 3.0.2 to 4.0.1 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@de90cc6...fbd0ab8) Updates `rossjrw/pr-preview-action` from 1.6.3 to 1.8.1 - [Release notes](https://github.com/rossjrw/pr-preview-action/releases) - [Commits](rossjrw/pr-preview-action@8ff09e4...ffa7509) Updates `actions/upload-artifact` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b7c566a...bbbca2d) Updates `actions/download-artifact` from 7.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@37930b1...3e5f45b) Updates `softprops/action-gh-release` from 2.5.0 to 2.6.1 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@a06a81a...153bb8e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: orhun/git-cliff-action dependency-version: 4.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 7.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: astral-sh/ruff-action dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 5.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dorny/paths-filter dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: rossjrw/pr-preview-action dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-03-23T07:29:07Z

PR Preview Action v1.8.1
🚀 View preview at https://JacobCoffee.github.io/debug-toolbar/pr-preview/pr-47/
Built to branch `gh-pages` at 2026-03-23 07:28 UTC. Preview will be ready when the GitHub Pages deployment is complete.

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the actions group across 1 directory with 12 updates#47

build(deps): bump the actions group across 1 directory with 12 updates#47
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/actions-5a03021b4a

dependabot bot commented on behalf of github Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Built to branch `gh-pages` at 2026-03-23 07:28 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 23, 2026

v6.0.2

What's Changed

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v0.5.2

What's Changed

v0.5.1

What's Changed

v0.5.0

What's Changed

New Contributors

v0.4.1

What's Changed

v0.4.0

What's Changed

v7.6.0 🌈 Fetch uv from Astral's mirror by default

Changes

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v7.5.0 🌈 Use astral-sh/versions as version provider

No more rate-limits

v6.2.0

What's Changed

Dependency Upgrades

v3.6.1 🌈 fix automatic minor tag updates

Changes

🧰 Maintenance

v5.5.3

What's Changed

v5.5.2

What's Changed

v5.5.1

What's Changed

v5.5.0

What's Changed

v5.4.3

What's Changed

v5.4.2

v4.0.1

What's Changed

New Contributors

v4.0.0

What's Changed

New Contributors

v3.0.3

What's Changed

New Contributors

Changelog

v4.0.0

v3.0.3

v3.0.2

v3.0.1

v3.0.0

v2.11.1

v2.11.0

v2.10.2

v2.10.1

v2.10.0

v2.9.3

v2.9.2

v2.9.1

v2.9.0

v1.8.1

Changes

v1.8.0

Features

v7.5.0 🌈 Use `astral-sh/versions` as version provider

Built to branch `gh-pages` at 2026-03-23 07:28 UTC.
Preview will be ready when the GitHub Pages deployment is complete.