chore(deps): bump the dependencies group across 1 directory with 11 updates by dependabot[bot] · Pull Request #10511 · treeverse/lakeFS

dependabot · 2026-08-01T01:15:38Z

Bumps the dependencies group with 11 updates in the / directory:

Package	From	To
actions/checkout	`5`	`7`
actions/stale	`10`	`10.4.0`
github/codeql-action	`4`	`4.37.3`
actions/setup-go	`6`	`7`
actions/setup-java	`5`	`5.6.0`
sbt/setup-sbt	`1`	`1.5.4`
actions/setup-python	`6`	`7`
actions/setup-node	`6`	`7`
docker/login-action	`4`	`4.5.1`
actions/cache	`5`	`6`
actions/labeler	`6`	`7`

Updates actions/checkout from 5 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates actions/stale from 10 to 10.4.0

Release notes

Sourced from actions/stale's releases.

v10.4.0

What's Changed

Bug Fix

Fixed only-issue-types validation by @trueberryless in actions/stale#1338

Dependency Updates

Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @dependabot in actions/stale#1342

New Contributors

@trueberryless made their first contribution in actions/stale#1338

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

What's Changed

Bug Fix

Enhancement: ignore stale labeling events by @shamoon in actions/stale#1311

Dependency Updates

Upgrade dependencies (@actions/core, @octokit/plugin-retry, @typescript-eslint) by @Copilot in actions/stale#1335

New Contributors

@shamoon made their first contribution in actions/stale#1311

Full Changelog: actions/stale@v10...v10.3.0

v10.2.0

What's Changed

Bug Fix

Fix checking state cache (fix #1136) and switch to Octokit helper methods by @itchyny in actions/stale#1152

Dependency Updates

Upgrade js-yaml from 4.1.0 to 4.1.1 by @dependabot in actions/stale#1304

Upgrade lodash from 4.17.21 to 4.17.23 by @dependabot in actions/stale#1313

Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by @chiranjib-swain in actions/stale#1312

New Contributors

@itchyny made their first contribution in actions/stale#1152

Full Changelog: actions/stale@v10...v10.2.0

v10.1.1

What's Changed

Bug Fix

Add Missing Input Reading for only-issue-types by @Bibo-Joshi in actions/stale#1298

Improvement

Improves error handling when rate limiting is disabled on GHES. by @chiranjib-swain in actions/stale#1300

Dependency Upgrades

... (truncated)

Commits

See full diff in compare view

Updates github/codeql-action from 4 to 4.37.3

Release notes

Sourced from github/codeql-action's releases.

v4.37.3

No user facing changes.

v4.37.2

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

v4.36.0

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

v4.35.5

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

v4.35.4

Update default CodeQL bundle version to 2.25.4. #3881

v4.35.3

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

v4.35.2

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

Commits

e4fba86 Merge pull request #4031 from github/update-v4.37.3-72f6a9da0
fb50ab5 Update changelog for v4.37.3
72f6a9d Merge pull request #4030 from github/mbg/fix/no-proxy
3b5ee58 Use default request options instead of undefined
bfb6be4 Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621
526ab84 Rebuild
d6217b9 Update changelog and version after v4.37.2
e064762 Merge pull request #4027 from github/update-v4.37.2-385bcdc5a
e0faed8 Add a couple of change notes
73aad0e Update changelog for v4.37.2
Additional commits viewable in compare view

Updates actions/setup-go from 6 to 7

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-go#763

chore(deps): bump @actions/cache to 6.2.0 by @philip-gai in actions/setup-go#771

New Contributors

@philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

Upgrade actions dependencies by @priyagupta108 with @Copilot in actions/setup-go#744

Upgrade @types/node and typescript-eslint dependencies to resolve npm audit findings by @HarithaVattikuti in actions/setup-go#755

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-go#758

Upgrade version to 6.5.0 in package.json and package-lock.json by @HarithaVattikuti in actions/setup-go#762

New Contributors

@priyagupta108 with @Copilot made their first contribution in actions/setup-go#744

@jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

Add go-download-base-url input for custom Go distributions by @gdams in actions/setup-go#721

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-go#727

Documentation update

Rearrange README.md, add advanced-usage.md by @priyagupta108 in actions/setup-go#724

Fix Microsoft build of Go link by @gdams in actions/setup-go#734

New Contributors

@gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

Update default Go module caching to use go.mod by @priyagupta108 in actions/setup-go#705

Fix golang download url to go.dev by @178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

b7ad1da chore(deps): bump @actions/cache to 6.2.0 (#771)
0778a10 Migrate to ESM and upgrade dependencies (#763)
See full diff in compare view

Updates actions/setup-java from 5 to 5.6.0

Release notes

Sourced from actions/setup-java's releases.

v5.6.0

What's Changed

Backport to v5: Add Maven compiler problem matcher for javac diagnostics by @brunoborges in actions/setup-java#1087

feat: expose cache-primary-key output (#597) [v5 backport] by @brunoborges in actions/setup-java#1089

dist: Cover Tencent Kona JDK 25 (#1108) [v5 backport] by @brunoborges in actions/setup-java#1110

Backport #1111: Preserve Maven toolchains across repeated setup-java runs (#1099) by @brunoborges in actions/setup-java#1113

Backport #1097/#1098 to v5: cache Maven and Gradle wrapper distributions separately by @brunoborges in actions/setup-java#1122

Full Changelog: actions/setup-java@v5...v5.6.0

v5.5.0

What's Changed

chore: enforce pre-PR validation (aggregate scripts, git hooks, PR checklist) by @brunoborges in actions/setup-java#1061

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in actions/setup-java#1069

Bump actions/checkout from 6 to 7 by @dependabot[bot] in actions/setup-java#1068

Bump actions/setup-python from 5 to 6 by @dependabot[bot] in actions/setup-java#1067

Bump @typescript-eslint/parser from 8.61.1 to 8.62.0 by @dependabot[bot] in actions/setup-java#1062

feat: Add verify-signature plumbing and Temurin+Microsoft verification support by @johnoliver in actions/setup-java#1060

Updated jetbrains test: https.request() now catches errors. This fixes leaking tests as well by @jmjaffe37 in actions/setup-java#1070

Fix arm64 e2e workflow tests mislabeled as x64 by @brunoborges with @Copilot in actions/setup-java#1073

feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) by @brunoborges in actions/setup-java#1053

feat: Disable interactiveMode in generated Maven settings.xml by @brunoborges with @Copilot in actions/setup-java#1052

Bump prettier from 3.6.2 to 3.9.1 by @dependabot[bot] in actions/setup-java#1066

chore(deps-dev): bump eslint-plugin-jest from 29.0.1 to 29.15.4 by @dependabot[bot] in actions/setup-java#1074

fix: Maven Toolchains grows unexpectedly by @Okeanos in actions/setup-java#534

dist: Support Tencent Kona JDK by @johnshajiang in actions/setup-java#672

feat: Add set-default option by @gsmet in actions/setup-java#1017

docs: document problem matcher (and how to disable it), Maven Wrapper caching, and generated interactiveMode by @brunoborges in actions/setup-java#1075

feat: Add distribution detection support to .sdkmanrc file by @lukaszgyg in actions/setup-java#975

New Contributors

@jmjaffe37 made their first contribution in actions/setup-java#1070

@gsmet made their first contribution in actions/setup-java#1017

@lukaszgyg made their first contribution in actions/setup-java#975

Full Changelog: actions/setup-java@v5...v5.5.0

v5.4.0

What's Changed

Bump @typescript-eslint/parser from 8.48.0 to 8.61.1 by @dependabot[bot] in actions/setup-java#1021

Fix codeql workflow permissions by @jsoref in actions/setup-java#993

fix CodeQL permissions by @gdams in actions/setup-java#1025

fix: reject non-semver candidate versions in isVersionSatisfies by @sproctor in actions/setup-java#1009

Bump @actions/cache to 5.1.0, handle cache write denied by @jasongin in actions/setup-java#1026

Add Maven Wrapper cache feature by @mahabaleshwars in actions/setup-java#1027

Spelling by @jsoref in actions/setup-java#713

add link to advanced configuration for JetBrains by @robstoll in actions/setup-java#850

docs(action): fix missing required or default fields by @kranthipoturaju in actions/setup-java#1007

feat: add microsoft openjdk 17.0.18 by @al-kau in actions/setup-java#1002

... (truncated)

Commits

c5f2f2e Bump github/codeql-action from 3 to 4 (#1069)
623c707 chore: enforce pre-PR validation (aggregate scripts, git hooks, PR checklist)...
1bcf9fb dist: Address Copilot review suggestions from PR #1042 (GraalVM Community) (#...
See full diff in compare view

Updates sbt/setup-sbt from 1 to 1.5.4

Release notes

Sourced from sbt/setup-sbt's releases.

v1.5.4

Updates

fix: Recheck after actions/cache by @arashi01 + @eed3si9n in sbt/setup-sbt#116

Full Changelog: sbt/setup-sbt@v1...v1.5.4

v1.5.3

Updates

fix: Include RUNNER_ARCH into the cache key to fix Windows cache restoration errors by @eed3si9n in sbt/setup-sbt#115

Bump carabiner-dev/actions/ampel/verify from 1.2.1 to 1.2.3 by @dependabot[bot] in sbt/setup-sbt#113

Full Changelog: sbt/setup-sbt@v1...v1.5.3

v1.5.2

Updates

Update sbt to 2.0.3 by @scala-steward in sbt/setup-sbt#110

Test if unzip actually worked by @eed3si9n in sbt/setup-sbt#112

Full Changelog: sbt/setup-sbt@v1...v1.5.2

v1.5.1

updates

Update sbt to 2.0.2 by @scala-steward in sbt/setup-sbt#107

sbt 2.0.2 by @eed3si9n in sbt/setup-sbt#109

behind the scenes

Add --server to post-update hook by @eed3si9n in sbt/setup-sbt#108

Full Changelog: sbt/setup-sbt@v1...v1.5.1

v1.5.0

updates

Update default runner to sbt 2.0.1 by @eed3si9n in sbt/setup-sbt#106

behind the scenes

Bump actions/checkout from 6 to 7 by @dependabot[bot] in sbt/setup-sbt#102

Update sbt, scripted-plugin to 1.12.13 by @scala-steward in sbt/setup-sbt#103

Bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in sbt/setup-sbt#104

Update sbt to 2.0.1 by @scala-steward in sbt/setup-sbt#105

Full Changelog: sbt/setup-sbt@v1...v1.5.0

v1.4.0

... (truncated)

Commits

e832248 Merge pull request #103 from scala-steward/update/sbt-1.12.13
2240d3c Merge pull request #102 from sbt/dependabot/github_actions/actions/checkout-7
17d87ea Regenerated action.yml
03b53e3 Update sbt, scripted-plugin to 1.12.13
aa5c837 Bump actions/checkout from 6 to 7
3afe9cf Merge pull request #100 from sbt/wip/revert
b00de36 Revert "sbt 2.0.0"
See full diff in compare view

Updates actions/setup-python from 6 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-python#1330

Pin SHA commits and update docs with latest versions by @HarithaVattikuti in actions/setup-python#1338

Remove the pip-install input by @gowridurgad in actions/setup-python#1336

Bug Fix

Fix to Classify stderr warning messages as warnings instead of errors in annotations by @lmvysakh in actions/setup-python#1335

Validate and retry manifest fetch to prevent silent failures by @priyagupta108 in actions/setup-python#1332

Dependency Upgrade

Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @dependabot in actions/setup-python#1328

Remove EOL Python versions and Bumps numpy text fixture by @priya-kinthali in actions/setup-python#1333

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-python#1337

New Contributors

@lmvysakh made their first contribution in actions/setup-python#1335

@philip-gai made their first contribution in actions/setup-python#1337

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Add RHEL support and include Linux distro in cache keys by @priyagupta108 in actions/setup-python#1323

Fix pip cache error handling on Windows by @priyagupta108 in actions/setup-python#1040

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-python#1281

Upgrade actions dependencies by @gowridurgad with @Copilot in actions/setup-python#1303

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-python#1324

Upgrade dependency versions and test workflow configuration by @HarithaVattikuti in actions/setup-python#1322

Documentation

Update advanced-usage.md by @Dunky-Z in actions/setup-python#811

New Contributors

@gowridurgad with @Copilot made their first contribution in actions/setup-python#1303

@jasongin made their first contribution in actions/setup-python#1324

@Dunky-Z made their first contribution in actions/setup-python#811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

Upgrade dependencies to Node 24 compatible versions by @salmanmkc in actions/setup-python#1259

... (truncated)

Commits

5fda3b9 Pin SHA commits and update docs with latest versions (#1338)
4ab7e95 Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-0
0f3a009 Remove the pip-install input (#1336)
f8cf429 Migrate to ESM and upgrade dependencies (#1330)
54baeea Validate and retry manifest fetch to prevent silent failures (#1332)
c709277 Annotation code fix (#1335)
6849080 remove EOL Python versions and Bumps numpy text fixture (#1333)
0903b46 Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)
See full diff in compare view

Updates actions/setup-node from 6 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in actions/setup-node#1577

Migrate to ESM and upgrade dependencies by @gowridurgad in actions/setup-node#1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in actions/setup-node#1558

Only use mirrorToken in getManifest if it's provided by @deiga in

…pdates Bumps the dependencies group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `5` | `7` | | [actions/stale](https://github.com/actions/stale) | `10` | `10.4.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4` | `4.37.3` | | [actions/setup-go](https://github.com/actions/setup-go) | `6` | `7` | | [actions/setup-java](https://github.com/actions/setup-java) | `5` | `5.6.0` | | [sbt/setup-sbt](https://github.com/sbt/setup-sbt) | `1` | `1.5.4` | | [actions/setup-python](https://github.com/actions/setup-python) | `6` | `7` | | [actions/setup-node](https://github.com/actions/setup-node) | `6` | `7` | | [docker/login-action](https://github.com/docker/login-action) | `4` | `4.5.1` | | [actions/cache](https://github.com/actions/cache) | `5` | `6` | | [actions/labeler](https://github.com/actions/labeler) | `6` | `7` | Updates `actions/checkout` from 5 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v7) Updates `actions/stale` from 10 to 10.4.0 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v10...v10.4.0) Updates `github/codeql-action` from 4 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4...v4.37.3) Updates `actions/setup-go` from 6 to 7 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...v7) Updates `actions/setup-java` from 5 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v5...v5.6.0) Updates `sbt/setup-sbt` from 1 to 1.5.4 - [Release notes](https://github.com/sbt/setup-sbt/releases) - [Commits](sbt/setup-sbt@v1...v1.5.4) Updates `actions/setup-python` from 6 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) Updates `actions/setup-node` from 6 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) Updates `docker/login-action` from 4 to 4.5.1 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4...v4.5.1) Updates `actions/cache` from 5 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v5...v6) Updates `actions/labeler` from 6 to 7 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: actions/stale dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github/codeql-action dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: sbt/setup-sbt dependency-version: 1.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: docker/login-action dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: actions/labeler dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added area/ci exclude-changelog PR description should not be included in next release changelog minor-change Used for PRs that don't require issue attached labels Aug 1, 2026

Navigation Menu

Uh oh!

chore(deps): bump the dependencies group across 1 directory with 11 updates - #10511

chore(deps): bump the dependencies group across 1 directory with 11 updates#10511
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/dependencies-e4f5a7e130

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

v6.0.3

What's Changed

New Contributors

v6.0.2

What's Changed

v6.0.1

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v10.4.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

v10.3.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

v10.2.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

v10.1.1

What's Changed

Bug Fix

Improvement

Dependency Upgrades

v4.37.3

v4.37.2

v4.37.1

v4.37.0

v4.36.3

v4.36.2

v4.36.1

v4.36.0

v4.35.5

v4.35.4

v4.35.3

v4.35.2

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

v7.0.0

What's Changed

New Contributors

v6.5.0

What's Changed

Dependency update

New Contributors

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

v6.3.0

What's Changed