deps(actions): bump the actions group with 5 updates#257
Open
dependabot[bot] wants to merge 1 commit intomainfrom
Open
deps(actions): bump the actions group with 5 updates#257dependabot[bot] wants to merge 1 commit intomainfrom
dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps the actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [github/codeql-action](https://github.com/github/codeql-action) | `4.33.0` | `4.35.1` | | [gradle/actions](https://github.com/gradle/actions) | `5.0.2` | `6.1.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.0.0` | `8.0.0` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.293.0` | `1.299.0` | | [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.11` | `1.7.12` | Updates `github/codeql-action` from 4.33.0 to 4.35.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b1bff81...c10b806) Updates `gradle/actions` from 5.0.2 to 6.1.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@0723195...50e97c2) Updates `astral-sh/setup-uv` from 6.0.0 to 8.0.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c7f87aa...cec2083) Updates `ruby/setup-ruby` from 1.293.0 to 1.299.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@dffb23f...4c56a21) Updates `rhysd/actionlint` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/rhysd/actionlint/releases) - [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md) - [Commits](rhysd/actionlint@393031a...914e7df) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: gradle/actions dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: ruby/setup-ruby dependency-version: 1.299.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: rhysd/actionlint dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
dependabot
bot
added
dependencies
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
github-actions
bot
added
enhancement
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found across 7 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/release-kotlin.yml">
<violation number="1" location=".github/workflows/release-kotlin.yml:41">
P3: Update the inline version comment to match the new version bumped in this PR (6.1.0).
Leaving the old version number in the comment can cause confusion and makes it harder to verify the current version without looking up the commit hash.</violation>
</file>
<file name=".github/workflows/release-python.yml">
<violation number="1" location=".github/workflows/release-python.yml:35">
P3: The pinned setup-uv SHA was updated, but the inline version comment is still `v6.0.0`; update it to match the pinned release (`v8.0.0`) to avoid misleading workflow maintenance.</violation>
</file>
<file name=".github/workflows/release-ruby.yml">
<violation number="1" location=".github/workflows/release-ruby.yml:35">
P2: Update the version comment to `v1.301.0` to match the new commit hash. Dependabot often misses inline comments when they contain additional text like a zizmor ignore.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
|
||
| - name: Set up Ruby | ||
| uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | ||
| uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
There was a problem hiding this comment.
P2: Update the version comment to v1.301.0 to match the new commit hash. Dependabot often misses inline comments when they contain additional text like a zizmor ignore.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-ruby.yml, line 35:
<comment>Update the version comment to `v1.301.0` to match the new commit hash. Dependabot often misses inline comments when they contain additional text like a zizmor ignore.</comment>
<file context>
@@ -32,7 +32,7 @@ jobs:
- name: Set up Ruby
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
+ uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
with:
ruby-version: '3.3'
</file context>
|
|
||
| - name: Setup Gradle | ||
| uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | ||
| uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
There was a problem hiding this comment.
P3: Update the inline version comment to match the new version bumped in this PR (6.1.0).
Leaving the old version number in the comment can cause confusion and makes it harder to verify the current version without looking up the commit hash.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-kotlin.yml, line 41:
<comment>Update the inline version comment to match the new version bumped in this PR (6.1.0).
Leaving the old version number in the comment can cause confusion and makes it harder to verify the current version without looking up the commit hash.</comment>
<file context>
@@ -38,7 +38,7 @@ jobs:
- name: Setup Gradle
- uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
+ uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
- name: Build
</file context>
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | ||
| uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
There was a problem hiding this comment.
P3: The pinned setup-uv SHA was updated, but the inline version comment is still v6.0.0; update it to match the pinned release (v8.0.0) to avoid misleading workflow maintenance.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-python.yml, line 35:
<comment>The pinned setup-uv SHA was updated, but the inline version comment is still `v6.0.0`; update it to match the pinned release (`v8.0.0`) to avoid misleading workflow maintenance.</comment>
<file context>
@@ -32,7 +32,7 @@ jobs:
- name: Install uv
- uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
+ uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
- name: Set up Python
</file context>
Suggested change
| uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | |
| uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 5 updates:
4.33.04.35.15.0.26.1.06.0.08.0.01.293.01.299.01.7.111.7.12Updates
github/codeql-actionfrom 4.33.0 to 4.35.1Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
c10b806Merge pull request #3782 from github/update-v4.35.1-d6d1743b8c5ffd06Update changelog for v4.35.1d6d1743Merge pull request #3781 from github/henrymercer/update-git-minimum-version65d2efaAdd changelog note2437b20Update minimum git version for overlay to 2.36.0ea5f719Merge pull request #3775 from github/dependabot/npm_and_yarn/node-forge-1.4.045ceeeaMerge pull request #3777 from github/mergeback/v4.35.0-to-main-b8bb9f2824448c9Rebuild7c51060Update changelog and version after v4.35.0b8bb9f2Merge pull request #3776 from github/update-v4.35.0-0078ad667Updates
gradle/actionsfrom 5.0.2 to 6.1.0Release notes
Sourced from gradle/actions's releases.
... (truncated)
Commits
50e97c2Link to docs for caching providersf2e6298Restructure caching documentation for basic and enhanced providers (#934)b294b1eReally fix integ-test-full83d3189Revise license details for gradle-actions-caching1d5db06Update license link for gradle-actions-caching component1c80961Fix license link for Enhanced Caching component9e99920Fix integ-test-full workflowbb8aaafFix workflow permissionsf5dfb43[bot] Update dist directoryff9ae24Add open-source 'basic' cache provider and revamp licensing documentation (#930)Updates
astral-sh/setup-uvfrom 6.0.0 to 8.0.0Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
cec2083Shortcircuit latest version from manifest (#828)4dd8ab4Simplify inputs.ts (#827)7fdbe7cRemove update-major-minor-tags workflow (#826)485abd0Bump release-drafter to v7.1.1 (#825)f82eb19Refactor inputs (#823)868d1f7Replace inline compile args with tsconfig (#824)447e6d0chore: update known checksums for 0.11.2 (#821)5c62c59chore: update known checksums for 0.11.1 (#817)e1a7373chore: update known checksums for 0.11.0 (#815)8970931Remove deprecrated custom manifest (#813)Updates
ruby/setup-rubyfrom 1.293.0 to 1.299.0Release notes
Sourced from ruby/setup-ruby's releases.
Commits
4c56a21Darwin-x86_64 is no longer supported on TruffleRuby 34+5d9c71dAdd truffleruby-34.0.0,truffleruby+graalvm-34.0.0e65c17dAdd jruby-10.0.5.0ba696adRefactor matrix script2327de0TruffleRuby 34+ does not support macOS Intel3ff19f5Update CRuby releases on Windows4dc28cfAdd ruby-3.2.11c515ec1Update CRuby releases on Windowseab2afbAdd ruby-3.3.1197b3338Mention all maintainers in check-new-windows-versions for consistencyUpdates
rhysd/actionlintfrom 1.7.11 to 1.7.12Release notes
Sourced from rhysd/actionlint's releases.
Changelog
Sourced from rhysd/actionlint's changelog.
... (truncated)
Commits
914e7dfbump up version to v1.7.12f1fe8a1update popular actions data set to the latest0ef3e18add support for https://github.blog/changelog/2026-03-19-github-actions-late-...d2f9e65update document to describe the timezone check inon.schedulec03b271Merge branch 'followup-issue641' (#641)c9efd91fix staticcheck checks files inside./playground/node_modules08e2336include timezone database in executable staticallyf48c0a4fix timezone check is incomplete6b811d3fix problem matcher test fails due to line ending in test data4897c1dMerge pull request #641 from martincostello/gh-638Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by cubic
Update GitHub Actions used in our workflows to improve security scans, caching, and CI reliability. This bumps CodeQL, Gradle, uv, Ruby setup, and actionlint across the repo.
Dependencies
github/codeql-action: 4.33.0 → 4.35.1gradle/actions: 5.0.2 → 6.1.0astral-sh/setup-uv: 6.0.0 → 8.0.0ruby/setup-ruby: 1.293.0 → 1.299.0rhysd/actionlint: 1.7.11 → 1.7.12Migration
gradle/actions@v6: Enhanced caching now has license terms; considercache-provider: basicif you prefer OSS caching.astral-sh/setup-uv@v8: Major/minor tags are removed; pin to a full version. If you used a custom manifest, switch to the new format.github/codeql-action: Improved incremental analysis may require Git 2.36.0 on runners (especially with submodules).Written for commit 93200e7. Summary will update on new commits.