Skip to content

ci: bump the actions group across 1 directory with 5 updates - #912

Merged
ctchou merged 1 commit into
mainfrom
dependabot/github_actions/actions-fdb718c1da
Nov 12, 2026
Merged

ci: bump the actions group across 1 directory with 5 updates#912
ctchou merged 1 commit into
mainfrom
dependabot/github_actions/actions-fdb718c1da

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 5 updates in the / directory:

Package From To
actions/checkout 4 7
actions/create-github-app-token 2.2.1 3.3.0
actions/github-script 8 9
softprops/action-gh-release 2 3
zulip/github-actions-zulip/send-message 1.0.2 2.0.2

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates actions/create-github-app-token from 2.2.1 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

v3.2.0

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

  • improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

  • deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view

Updates actions/github-script from 8 to 9

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 2 to 3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.6.2

v2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

v2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

0.1.13

  • fix issue with multiple runs concatenating release bodies #145
Commits
  • 8a0cd65 release 3.0.4 (#865)
  • ac01154 chore(deps): bump the npm group across 1 directory with 4 updates (#864)
  • ca4c9d5 chore(deps): bump minimatch and glob (#862)
  • e4a57ae chore(deps): bump undici from 6.29.0 to 6.29.1 (#859)
  • ee55a0e chore(deps): bump vite from 8.3.2 to 8.3.5 (#855)
  • 8d42b22 chore(deps): bump actions/setup-node (#853)
  • 6680cc0 chore(deps): bump the npm group with 3 updates (#851)
  • 4a050ba chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#850)
  • b5a645e chore(deps): bump the npm group with 4 updates (#848)
  • d99a5de chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 (#846)
  • Additional commits viewable in compare view

Updates zulip/github-actions-zulip/send-message from 1.0.2 to 2.0.2

Release notes

Sourced from zulip/github-actions-zulip/send-message's releases.

v2.0.2

What's Changed

Full Changelog: zulip/github-actions-zulip@v2.0.1...v2.0.2

v2.0.1

What's Changed

Full Changelog: zulip/github-actions-zulip@v2.0.0...v2.0.1

v2.0.0

What's Changed

New Contributors

Full Changelog: zulip/github-actions-zulip@v1.0.2...v2.0.0

Changelog

Sourced from zulip/github-actions-zulip/send-message's changelog.

Zulip GitHub Action Changelog

2.0.2 (2026-06-16)

Infrastructure

  • Upgrade dependencies.

2.0.1 (2026-05-21)

Fixes

  • Add missing tslib dependency.

2.0.0 (2026-05-20)

Breaking changes

  • Switch from deprecated Node 20 to Node 24.

Infrastructure

  • Upgrade dependencies.

1.0.0 (2021-08-14)

Breaking changes

⚠️ Please use zulip/github-actions-zulip/send-message@v1 instead of yuzutech/zulip-send-message-action@v0.1.2.
If you were using password as authentification method, please get an API key through Zulip's web interface and use api-key instead. Finally, username field was renamed to email to be consistent with Zulip API naming.

Before

- name: Send a stream message
  uses: yuzutech/zulip-send-message-action@v0.1.0
  with:
    username: "username@example.com"
    api-key: "abcd1234"
    organization-url: "https://org.zulipchat.com"
    to: "social"
    type: "stream"
    topic: "Castle"
    content: "I come not, friends, to steal away your hearts."

After

</tr></table>

... (truncated)

Commits
  • f675f2b Release v2.0.2.
  • 2126b4e Upgrade dependencies.
  • 03c1bf9 eslint: Run prettier separately.
  • bf35ec5 eslint: Fix arrow-body-style.
  • f624d60 eslint: Fix @​typescript-eslint/strict-boolean-expressions.
  • bd8ec52 Release v2.0.1.
  • 78d1446 Add missing tslib dependency.
  • 8f85235 Release v2.0.0.
  • 74e69e3 Upgrade dependencies.
  • 037b859 npmrc: Enable 7 day dependency cooldown.
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 16, 2026
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 16, 2026
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Sep 16, 2026
@dependabot dependabot Bot changed the title ci: bump the actions group with 5 updates ci: bump the actions group across 1 directory with 5 updates Sep 16, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-fdb718c1da branch from e86b8ab to 8c4db1b Compare September 16, 2026 10:39
@jessealama jessealama mentioned this pull request Sep 17, 2026
Open
@jessealama

jessealama commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Superseded by #917, which breaks up Dependabot into two groups (major version bumps, minor/patch bumps) so that the arrive in separate PRs. I do not have permission to close this one. Could a maintainer please close it once #917 lands, so that Dependabot regenerates under the new config?

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-fdb718c1da branch from 8c4db1b to d8e126f Compare September 23, 2026 05:15
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-fdb718c1da branch 2 times, most recently from 3df348d to 1658df9 Compare October 7, 2026 05:14
@dependabot
dependabot Bot requested a review from crei as a code owner October 7, 2026 05:14
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-fdb718c1da branch 2 times, most recently from d498dd7 to e435426 Compare October 21, 2026 05:14
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-fdb718c1da branch 3 times, most recently from 4dbc5f0 to 78d9b5d Compare November 4, 2026 05:16
@dependabot
ci: bump the actions group across 1 directory with 5 updates
46d5521 
Bumps the actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2.2.1` | `3.3.0` |
| [actions/github-script](https://github.com/actions/github-script) | `8` | `9` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2` | `3` |
| [zulip/github-actions-zulip/send-message](https://github.com/zulip/github-actions-zulip) | `1.0.2` | `2.0.2` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v7)

Updates `actions/create-github-app-token` from 2.2.1 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@29824e6...64ab729)

Updates `actions/github-script` from 8 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v8...v9)

Updates `softprops/action-gh-release` from 2 to 3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2...v3)

Updates `zulip/github-actions-zulip/send-message` from 1.0.2 to 2.0.2
- [Release notes](https://github.com/zulip/github-actions-zulip/releases)
- [Changelog](https://github.com/zulip/github-actions-zulip/blob/main/CHANGELOG.md)
- [Commits](zulip/github-actions-zulip@e4c8f27...f675f2b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: zulip/github-actions-zulip/send-message
  dependency-version: 2.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-fdb718c1da branch from 78d9b5d to 46d5521 Compare November 11, 2026 05:16
ctchou
ctchou approved these changes Nov 12, 2026
View reviewed changes

@ctchou ctchou left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Jesse explained this PR to me.

@ctchou
ctchou added this pull request to the merge queue Nov 12, 2026
Merged via the queue into main with commit ac3cfdf Nov 12, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ctchou ctchou ctchou approved these changes
@fmontesi fmontesi Awaiting requested review from fmontesi fmontesi is a code owner
@chenson2018 chenson2018 Awaiting requested review from chenson2018 chenson2018 is a code owner
@kim-em kim-em Awaiting requested review from kim-em kim-em is a code owner
@arademaker arademaker Awaiting requested review from arademaker arademaker is a code owner
@sorrachai sorrachai Awaiting requested review from sorrachai sorrachai is a code owner
@SamuelSchlesinger SamuelSchlesinger Awaiting requested review from SamuelSchlesinger SamuelSchlesinger is a code owner
@crei crei Awaiting requested review from crei crei is a code owner
@thomaskwaring thomaskwaring Awaiting requested review from thomaskwaring thomaskwaring is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jessealama @ctchou