Skip to content

ci: bump the actions group across 1 directory with 5 updates - #912

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-fdb718c1da
Open

ci: bump the actions group across 1 directory with 5 updates#912
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-fdb718c1da

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the actions group with 5 updates in the / directory:

Package From To
actions/checkout 4 7
actions/create-github-app-token 2.2.1 3.2.0
actions/github-script 7.0.1 9.0.0
softprops/action-gh-release 2 3
zulip/github-actions-zulip/send-message 1.0.2 2.0.2

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates actions/create-github-app-token from 2.2.1 to 3.2.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.2.0

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

  • improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

  • deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

v3.0.0

3.0.0 (2026-03-14)

Bug Fixes

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • bcd2ba4 chore(main): release 3.2.0 (#370)
  • f24bbd8 fix: validate private-key input (#376)
  • 363531b docs: capitalize Git as a proper noun in README (#374)
  • fd28011 docs: update procedure to configure Git (#287)
  • 85eb8dd feat: support full repository names in repositories input (#372)
  • c9aabb8 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...
  • e02e816 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)
  • 8d835bf build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...
  • 952a2a7 feat: add support for enterprise-level GitHub Apps (#263)
  • 43e5c34 fix(deps): bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependenc...
  • Additional commits viewable in compare view

Updates actions/github-script from 7.0.1 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

... (truncated)

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 2 to 3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.6.2

v2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

v2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

0.1.13

  • fix issue with multiple runs concatenating release bodies #145
Commits
  • efb3536 release 3.0.3 (#840)
  • 6441963 chore(deps): bump the npm group with 2 updates (#839)
  • e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
  • d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)
  • 6403751 chore(deps): bump the npm group with 2 updates (#835)
  • 7c7184b chore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)
  • 0f3f0d2 chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)
  • 77fb938 chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)
  • 5a6f517 chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)
  • a3c91c9 chore(deps): bump the github-actions group with 2 updates (#825)
  • Additional commits viewable in compare view

Updates zulip/github-actions-zulip/send-message from 1.0.2 to 2.0.2

Release notes

Sourced from zulip/github-actions-zulip/send-message's releases.

v2.0.2

What's Changed

Full Changelog: zulip/github-actions-zulip@v2.0.1...v2.0.2

v2.0.1

What's Changed

Full Changelog: zulip/github-actions-zulip@v2.0.0...v2.0.1

v2.0.0

What's Changed

New Contributors

Full Changelog: zulip/github-actions-zulip@v1.0.2...v2.0.0

Changelog

Sourced from zulip/github-actions-zulip/send-message's changelog.

Zulip GitHub Action Changelog

2.0.2 (2026-06-16)

Infrastructure

  • Upgrade dependencies.

2.0.1 (2026-05-21)

Fixes

  • Add missing tslib dependency.

2.0.0 (2026-05-20)

Breaking changes

  • Switch from deprecated Node 20 to Node 24.

Infrastructure

  • Upgrade dependencies.

1.0.0 (2021-08-14)

Breaking changes

⚠️ Please use zulip/github-actions-zulip/send-message@v1 instead of yuzutech/zulip-send-message-action@v0.1.2.
If you were using password as authentification method, please get an API key through Zulip's web interface and use api-key instead. Finally, username field was renamed to email to be consistent with Zulip API naming.

Before

- name: Send a stream message
  uses: yuzutech/zulip-send-message-action@v0.1.0
  with:
    username: "username@example.com"
    api-key: "abcd1234"
    organization-url: "https://org.zulipchat.com"
    to: "social"
    type: "stream"
    topic: "Castle"
    content: "I come not, friends, to steal away your hearts."

After

</tr></table>

... (truncated)

Commits
  • f675f2b Release v2.0.2.
  • 2126b4e Upgrade dependencies.
  • 03c1bf9 eslint: Run prettier separately.
  • bf35ec5 eslint: Fix arrow-body-style.
  • f624d60 eslint: Fix @​typescript-eslint/strict-boolean-expressions.
  • bd8ec52 Release v2.0.1.
  • 78d1446 Add missing tslib dependency.
  • 8f85235 Release v2.0.0.
  • 74e69e3 Upgrade dependencies.
  • 037b859 npmrc: Enable 7 day dependency cooldown.
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 16, 2026
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 16, 2026
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Sep 16, 2026
@dependabot
ci: bump the actions group across 1 directory with 5 updates
8c4db1b 
Bumps the actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2.2.1` | `3.2.0` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `9.0.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2` | `3` |
| [zulip/github-actions-zulip/send-message](https://github.com/zulip/github-actions-zulip) | `1.0.2` | `2.0.2` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v7)

Updates `actions/create-github-app-token` from 2.2.1 to 3.2.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@29824e6...bcd2ba4)

Updates `actions/github-script` from 7.0.1 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v7.0.1...v9)

Updates `softprops/action-gh-release` from 2 to 3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2...v3)

Updates `zulip/github-actions-zulip/send-message` from 1.0.2 to 2.0.2
- [Release notes](https://github.com/zulip/github-actions-zulip/releases)
- [Changelog](https://github.com/zulip/github-actions-zulip/blob/main/CHANGELOG.md)
- [Commits](zulip/github-actions-zulip@e4c8f27...f675f2b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: zulip/github-actions-zulip/send-message
  dependency-version: 2.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title ci: bump the actions group with 5 updates ci: bump the actions group across 1 directory with 5 updates Sep 16, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-fdb718c1da branch from e86b8ab to 8c4db1b Compare September 16, 2026 10:39
@jessealama jessealama mentioned this pull request Sep 17, 2026
Open
@jessealama

jessealama commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Superseded by #917, which breaks up Dependabot into two groups (major version bumps, minor/patch bumps) so that the arrive in separate PRs. I do not have permission to close this one. Could a maintainer please close it once #917 lands, so that Dependabot regenerates under the new config?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fmontesi fmontesi Awaiting requested review from fmontesi fmontesi is a code owner
@chenson2018 chenson2018 Awaiting requested review from chenson2018 chenson2018 is a code owner
@kim-em kim-em Awaiting requested review from kim-em kim-em is a code owner
@arademaker arademaker Awaiting requested review from arademaker arademaker is a code owner
@sorrachai sorrachai Awaiting requested review from sorrachai sorrachai is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jessealama