Skip to content

Bump the github-actions group across 1 directory with 8 updates#941

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-017c5d7c41
Open

Bump the github-actions group across 1 directory with 8 updates#941
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-017c5d7c41

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 12, 2026

Bumps the github-actions group with 8 updates in the / directory:

Package From To
actions/github-script 8.0.0 9.0.0
conda-incubator/setup-miniconda 3.3.0 4.0.1
actions/upload-pages-artifact 4.0.0 5.0.0
actions/add-to-project 1.0.2 2.0.0
actions/cache 5.0.4 5.0.5
actions/upload-artifact 7.0.0 7.0.1
CodSpeedHQ/action 4.13.0 4.15.1
test-summary/action 2.4 2.6

Updates actions/github-script from 8.0.0 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates conda-incubator/setup-miniconda from 3.3.0 to 4.0.1

Release notes

Sourced from conda-incubator/setup-miniconda's releases.

Version 4.0.1

What's Changed

Full Changelog: conda-incubator/setup-miniconda@v4.0.0...v4.0.1

Version 4.0.0

Breaking Changes

  • #459: Upgrade action runtime to Node.js 24.x (requires runners with Node 24 support; this is the reason for the v4 major bump)
  • #450: Switch action build to ESM (for @actions/exec v3)

Features and Enhancements

  • #469: Add conda-init input to optionally skip conda init and document activation for restricted environments
  • #482: Add channels parsing utility and URL validation
  • #481: Enable stricter TypeScript checks and typing
  • #480: Add more tests, increase coverage, add Codecov integration and coverage badge
  • #479: Add TypeDoc-based API docs, generation and checks; configure GitHub Pages and Netlify previews

Fixes

  • #465: Fix double channel configuration being applied
  • #467: Speed up Windows post-run cleanup by moving the extracted packages directory instead of removing files one by one
  • #470: Fix name-version-build syntax expansion and add tests
  • #475: Split shell init and activation of the test environment to remove spurious warning
  • #498: Skip Netlify preview for Dependabot PRs

Performance

  • #486: Remove HTML index scraping for Miniconda version validation
  • #487: Parallelize Windows takeown calls with Promise.all
  • #488: Replace isDefaultEnvironment subprocess with local YAML reads
  • #489: Replace conda config subprocesses with direct .condarc YAML writes

Tasks and Maintenance

  • #444: Bump conda-incubator/setup-miniconda from 3.2.0 to 3.3.0
  • #445: Bump actions/checkout from 6.0.1 to 6.0.2
  • #449: Bump @​actions/exec from 2.0.0 to 3.0.0
  • #456, #484, #491: Bump actions/upload-artifact
  • #460: Bump actions/download-artifact from 7.0.0 to 8.0.1

... (truncated)

Changelog

Sourced from conda-incubator/setup-miniconda's changelog.

CHANGELOG

v4.0.1 (2026-04-24)

Fixes

  • Fix MultipleKeysError on conda 25.11+ when a user-supplied condarc-file already declares auto_activate: now only one of auto_activate / auto_activate_base is written to .condarc, preferring whichever key the user's existing condarc uses.
  • Add auto_activate to the boolean coercion set so its value is serialized as a YAML boolean when it is the chosen canonical key.
  • Add local_repodata_ttl to KNOWN_CONDARC_KEYS to silence a spurious "Unrecognized condarc key" warning for a valid conda key.

[v4.0.0] (2026-04-23)

Breaking Changes

  • #459[459]: Upgrade action runtime to Node.js 24.x (requires runners with Node 24 support; this is the reason for the v4 major bump)
  • #450[450]: Switch action build to ESM (for @actions/exec v3)

Features and Enhancements

  • #469[469]: Add conda-init input to optionally skip conda init and document activation for restricted environments
  • #482[482]: Add channels parsing utility and URL validation
  • #481[481]: Enable stricter TypeScript checks and typing
  • #480[480]: Add more tests, increase coverage, add Codecov integration and coverage badge
  • #479[479]: Add TypeDoc-based API docs, generation and checks; configure GitHub Pages and Netlify previews

Fixes

  • #465[465]: Fix double channel configuration being applied
  • #467[467]: Speed up Windows post-run cleanup by moving the extracted packages directory instead of removing files one by one
  • #470[470]: Fix name-version-build syntax expansion and add tests
  • #475[475]: Split shell init and activation of the test environment to remove spurious warning

Performance

  • #486[486]: Remove HTML index scraping for Miniconda version validation
  • #487[487]: Parallelize Windows takeown calls with Promise.all
  • #488[488]: Replace isDefaultEnvironment subprocess with local YAML reads

... (truncated)

Commits
  • 8ee1f36 Fix MultipleKeysError when user condarc declares auto_activate (#500)
  • bce0bd8 Prepare v4 release (#499)
  • 78fb0ff ci(docs): skip Netlify preview for Dependabot PRs (#498)
  • d32e72e Bump @​actions/core from 3.0.0 to 3.0.1 (#496)
  • 3e251ae Bump actions/upload-artifact from 4 to 7 (#491)
  • 7ff02ae Bump actions/upload-pages-artifact from 3 to 5 (#492)
  • 65b62b8 Bump actions/deploy-pages from 4 to 5 (#494)
  • 1eb4d38 Bump marocchino/sticky-pull-request-comment from 2 to 3 (#493)
  • bfb6f7e Bump codecov/codecov-action from 5 to 6 (#495)
  • 77236ef Merge pull request #489 from conda-incubator/perf/direct-condarc-write
  • Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 4.0.0 to 5.0.0

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

See details of all code changes since previous release.

Commits

Updates actions/add-to-project from 1.0.2 to 2.0.0

Release notes

Sourced from actions/add-to-project's releases.

v2

What's Changed

... (truncated)

Commits
  • 5afcf98 Merge pull request #712 from salmanmkc/node24
  • ffed68f Merge main and update action runtime to Node 24
  • 27022a1 Merge pull request #777 from actions/dependabot/npm_and_yarn/types/node-25.5.0
  • cc89d2e Merge pull request #778 from actions/dependabot/npm_and_yarn/globals-17.4.0
  • ef8e6ff Merge pull request #779 from actions/dependabot/npm_and_yarn/eslint-plugin-je...
  • eb406b3 Merge pull request #780 from actions/dependabot/npm_and_yarn/handlebars-4.7.9
  • bb8d4d7 Bump handlebars from 4.7.8 to 4.7.9
  • a6fcf8b Bump eslint-plugin-jest from 29.12.1 to 29.15.1
  • b35f5d3 Bump globals from 17.0.0 to 17.4.0
  • 036fea0 Bump @​types/node from 25.0.3 to 25.5.0
  • Additional commits viewable in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • See full diff in compare view

Updates CodSpeedHQ/action from 4.13.0 to 4.15.1

Release notes

Sourced from CodSpeedHQ/action's releases.

v4.15.1

Release Notes

🚀 Features

⚙️ Internals

Install codspeed-runner 4.15.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.15.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.15.1

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.15.0...v4.15.1

v4.15.0

Release Notes

This release adds first support for macOS walltime.

Please note that profiling and other instruments are not yet available on macOS and will come in a later update.

Minimum integration versions

... (truncated)

Commits
  • 3194d9a Release v4.15.1 🚀
  • 91dff45 chore: bump runner version to 4.15.1
  • c381be0 Release v4.15.0 🚀
  • 5cb7f66 chore: bump runner version to 4.15.0
  • 658a901 Release v4.14.0 🚀
  • 1d42668 chore: bump runner version to 4.14.0
  • db35df7 Release v4.13.1 🚀
  • bc11107 feat: support action-only releases with explicit version argument
  • 12a303d feat: fail release script if version already exists
  • 6e1e277 feat: add dry-run mode to release script
  • Additional commits viewable in compare view

Updates test-summary/action from 2.4 to 2.6

Release notes

Sourced from test-summary/action's releases.

v2.6

Actually update the tag to point to the correct branch (dist) instead of the dev branch.

v2.5

What's Changed

New Contributors

Full Changelog: https://github.com/test-summary/action/commits/v2.5

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group across 1 directory with 8 updates
6c1dd4c 
Bumps the github-actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` |
| [conda-incubator/setup-miniconda](https://github.com/conda-incubator/setup-miniconda) | `3.3.0` | `4.0.1` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `4.0.0` | `5.0.0` |
| [actions/add-to-project](https://github.com/actions/add-to-project) | `1.0.2` | `2.0.0` |
| [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `4.13.0` | `4.15.1` |
| [test-summary/action](https://github.com/test-summary/action) | `2.4` | `2.6` |



Updates `actions/github-script` from 8.0.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@ed59741...3a2844b)

Updates `conda-incubator/setup-miniconda` from 3.3.0 to 4.0.1
- [Release notes](https://github.com/conda-incubator/setup-miniconda/releases)
- [Changelog](https://github.com/conda-incubator/setup-miniconda/blob/main/CHANGELOG.md)
- [Commits](conda-incubator/setup-miniconda@fc2d68f...8ee1f36)

Updates `actions/upload-pages-artifact` from 4.0.0 to 5.0.0
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@7b1f4a7...fc324d3)

Updates `actions/add-to-project` from 1.0.2 to 2.0.0
- [Release notes](https://github.com/actions/add-to-project/releases)
- [Commits](actions/add-to-project@244f685...5afcf98)

Updates `actions/cache` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@6682284...27d5ce7)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `CodSpeedHQ/action` from 4.13.0 to 4.15.1
- [Release notes](https://github.com/codspeedhq/action/releases)
- [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md)
- [Commits](CodSpeedHQ/action@d872884...3194d9a)

Updates `test-summary/action` from 2.4 to 2.6
- [Release notes](https://github.com/test-summary/action/releases)
- [Commits](test-summary/action@31493c7...37b508c)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: conda-incubator/setup-miniconda
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/add-to-project
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: CodSpeedHQ/action
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: test-summary/action
  dependency-version: '2.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies [bot] PRs that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 12, 2026
@dependabot dependabot Bot requested a review from a team as a code owner May 12, 2026 02:18
@dependabot dependabot Bot added dependencies [bot] PRs that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 12, 2026
@conda-bot conda-bot added the cla-signed [bot] added once the contributor has signed the CLA label May 12, 2026
@github-project-automation github-project-automation Bot moved this to 🆕 New in 🔎 Review May 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

cla-signed [bot] added once the contributor has signed the CLA dependencies [bot] PRs that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

🔎 Review
Status: 🆕 New

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@conda-bot