Skip to content

chore(deps): Bump the github-actions group across 1 directory with 4 updates#523

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-c32b547ee8
Open

chore(deps): Bump the github-actions group across 1 directory with 4 updates#523
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-c32b547ee8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 4 updates in the / directory: actions/checkout, ruby/setup-ruby, dataaxiom/ghcr-cleanup-action and mindsers/changelog-reader-action.

Updates actions/checkout from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

... (truncated)

Commits

Updates ruby/setup-ruby from 1.307.0 to 1.310.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.310.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.309.0...v1.310.0

v1.309.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.308.0...v1.309.0

v1.308.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.307.0...v1.308.0

Commits

Updates dataaxiom/ghcr-cleanup-action from 1.0.16 to 1.2.1

Release notes

Sourced from dataaxiom/ghcr-cleanup-action's releases.

v1.2.1

  • fix: tolerate every 404 on package version delete (was: fail on the second) (fix #121)
  • fix: eliminate spurious "wasn't found" warnings from cosign signature dual-cascade race
  • fix: per-image log buffer flushes audit trail even when a cascade errors mid-flight

v1.2.0

  • feature: cross-run manifest cache; warm runs only fetch newly-published manifests (hit rate logged)
  • perf: parallel API throughout — package pagination, manifest fetches, untag PUTs, child/referrer deletes
  • perf: batched untagging — one reload per batch instead of one per tag
  • perf: push token reuse across untag PUTs + 429/secondary rate-limit retries on registry auth
  • fix: repository input is now informational; cleanup uses owner + package directly (supports unlinked / cross-account packages)
  • log volume cap at 1000 lines per group (info); per-image log output buffered to avoid interleaving under concurrent deletes
  • package version upgrades

v1.1.0

  • fix: preserve OCI 1.1 subject-bearing referrers (cosign sigstore-bundles, attestations) during cleanup — were silently deleted as untagged #71
  • fix: keep-n-tagged now gates untag operations; a matched tag is not stripped from an image that keep-n-tagged would protect (#99, #101)
  • fix: shared multi-arch platform digests no longer cascade-deleted when one of multiple parent indexes is removed (#91)
  • fix: delete-partial-images excludes fully ghost images #112
  • fix: Octokit error output visible at all log levels (was suppressed when log-level was error or warn)
  • fix: expand-packages rejects fine-grained PATs upfront with a clear message
  • fix: setFailed message no longer overwritten by an empty Error in early-failure paths
  • feat: ReDoS guard on user-supplied regex (delete-tags, exclude-tags, package) when use-regex: true
  • feat: code refactor/split, removal of anys where possible using typed classes
  • chore(deps): Node.js 24
  • docs: README rewrite + Limitations section (5,000-download undeletable policy, nested-manifest non-support)
Commits
  • f092b48 Merge pull request #122 from rohanmars/main
  • fa3daf5 ci: hoist fork-PR approval gate to a single job (was per matrix entry)
  • c1ba289 fix: synchronously claim digests before delete to prevent concurrent duplicat...
  • f5e37e7 fix: tolerate all 404s on package version delete; always flush per-tree log b...
  • 374e202 Merge pull request #120 from rohanmars/code-review
  • e1e6176 perf: cap per-listing log volume at 1000 lines (truncate at INFO)
  • 6516895 fix: drop the post-reload untag-ops invariant assertion (3.1.5 retraction)
  • 5a020af feat: buffer deleteImage logs per top-level tree, flush atomically
  • 8263ff3 chore: refresh dependencies to latest patches within current ranges
  • 5a3f4cc chore: update coverage badge to 94.47%
  • Additional commits viewable in compare view

Updates mindsers/changelog-reader-action from 2.2.3 to 2.4.0

Release notes

Sourced from mindsers/changelog-reader-action's releases.

v2.4.0

Added

  • New changes_file output: a path to a temporary file containing the matched entry's text, for tools that consume release notes as a file (goreleaser, gh release create --notes-file, etc.). Resolves #68.
  • New version_scheme input (semver default, or pep440) enabling extraction and validation of Python PEP 440 version identifiers like 0.1.0a1. Resolves #38.

Security

  • Harden the reference-link parsing regex against catastrophic backtracking (CodeQL js/redos). The previous pattern had a . character in two overlapping character classes; a hostile CHANGELOG line could in principle trigger exponential matching time. The fix tightens the label character class without changing the regex's accepted inputs.

v2.3.0

Changed

  • Use Node 24 as the action runtime.
  • Refactor the internal entry, validation, and pipeline modules for type safety and easier maintenance. No change in observable behavior for action consumers.
  • Modernize the bundled runtime dependencies: @actions/core 1.x → 2.x and the YAML parser 1.x → 2.x. The action's input/output contract is unchanged.

Fixed

  • Declare semver as a runtime dependency instead of a dev dependency.
  • Stop dumping the full CHANGELOG content to debug logs when parsing entries and links.
  • Detect the Unreleased heading case-insensitively when picking the most recent released entry.
  • Warn (instead of silently degrading) when validation_level or validation_depth inputs are invalid; fall back to safe defaults.
  • Warn (instead of silently using an empty config) when an explicit config_file does not exist.
  • Validate the shape of YAML/JSON config files; warn on per-field type mismatches and reject non-object roots.
  • Recognize bare ## Unreleased headings in addition to the bracketed ## [Unreleased] form.
Changelog

Sourced from mindsers/changelog-reader-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[2.4.0] - 2026-05-20

Added

  • New changes_file output: a path to a temporary file containing the matched entry's text, for tools that consume release notes as a file (goreleaser, gh release create --notes-file, etc.). Resolves #68.
  • New version_scheme input (semver default, or pep440) enabling extraction and validation of Python PEP 440 version identifiers like 0.1.0a1. Resolves #38.

Security

  • Harden the reference-link parsing regex against catastrophic backtracking (CodeQL js/redos). The previous pattern had a . character in two overlapping character classes; a hostile CHANGELOG line could in principle trigger exponential matching time. The fix tightens the label character class without changing the regex's accepted inputs.

[2.3.0] - 2026-05-19

Changed

  • Use Node 24 as the action runtime.
  • Refactor the internal entry, validation, and pipeline modules for type safety and easier maintenance. No change in observable behavior for action consumers.
  • Modernize the bundled runtime dependencies: @actions/core 1.x → 2.x and the YAML parser 1.x → 2.x. The action's input/output contract is unchanged.

Fixed

  • Declare semver as a runtime dependency instead of a dev dependency.
  • Stop dumping the full CHANGELOG content to debug logs when parsing entries and links.
  • Detect the Unreleased heading case-insensitively when picking the most recent released entry.
  • Warn (instead of silently degrading) when validation_level or validation_depth inputs are invalid; fall back to safe defaults.
  • Warn (instead of silently using an empty config) when an explicit config_file does not exist.
  • Validate the shape of YAML/JSON config files; warn on per-field type mismatches and reject non-object roots.
  • Recognize bare ## Unreleased headings in addition to the bracketed ## [Unreleased] form.

[2.2.3] - 2024-03-10

Fixed

  • Upgrade dependencies to solve deprecation issues.
  • Use node v20
  • Remove useless empty line between links in the body of a version

[2.2.2] - 2022-11-23

Fixed

... (truncated)

Commits
  • 1faaf50 chore(release): v2.4.0
  • 5f62f39 feat: support PEP 440 versions via a version_scheme input (#123)
  • c8614b9 feat: add changes_file output (#68) (#122)
  • 6a1d138 fix: harden link-parsing regex against catastrophic backtracking (#121)
  • 695e5c9 chore(ci): use the action itself to extract release notes (#120)
  • 4b39e79 chore(release): v2.3.0
  • 5169600 fix: tighten input and config validation for v2.3.0 (#119)
  • a5d2d13 chore(deps): upgrade toolchain to current (Node 24, @​actions/core 2, yaml 2, ...
  • 5358d0b unify link handling, type rule results, extract pure pipeline (#117)
  • 347fff2 Phase 4: SECURITY.md, code of conduct, issue/PR templates, commitlint (#115)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the github-actions group across 1 directory with 4 …
fd1aeed 
…updates

Bumps the github-actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [ruby/setup-ruby](https://github.com/ruby/setup-ruby), [dataaxiom/ghcr-cleanup-action](https://github.com/dataaxiom/ghcr-cleanup-action) and [mindsers/changelog-reader-action](https://github.com/mindsers/changelog-reader-action).


Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

Updates `ruby/setup-ruby` from 1.307.0 to 1.310.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@6aaa311...afeafc3)

Updates `dataaxiom/ghcr-cleanup-action` from 1.0.16 to 1.2.1
- [Release notes](https://github.com/dataaxiom/ghcr-cleanup-action/releases)
- [Commits](dataaxiom/ghcr-cleanup-action@cd0cdb9...f092b48)

Updates `mindsers/changelog-reader-action` from 2.2.3 to 2.4.0
- [Release notes](https://github.com/mindsers/changelog-reader-action/releases)
- [Changelog](https://github.com/mindsers/changelog-reader-action/blob/master/CHANGELOG.md)
- [Commits](mindsers/changelog-reader-action@32aa5b4...1faaf50)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: ruby/setup-ruby
  dependency-version: 1.310.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: dataaxiom/ghcr-cleanup-action
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: mindsers/changelog-reader-action
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@stevehipwell stevehipwell

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stevehipwell