Skip to content

chore(deps): bump the github-actions group across 1 directory with 10 updates#28

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-aa9a50697d
Open

chore(deps): bump the github-actions group across 1 directory with 10 updates#28
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-aa9a50697d

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Apr 13, 2026

Bumps the github-actions group with 10 updates in the / directory:

Package From To
actions/checkout 4.3.1 6.0.2
astral-sh/setup-uv 5.4.2 8.0.0
actions/setup-python 5.6.0 6.2.0
pnpm/action-setup 4.2.0 6.0.0
actions/setup-node 4.4.0 6.3.0
actions/upload-artifact 4.6.2 7.0.1
amondnet/vercel-action 25.2.0 42.2.0
actions/cache 4.3.0 5.0.4
actions/download-artifact 4.3.0 8.0.1
pypa/gh-action-pypi-publish 1.13.0 1.14.0

Updates actions/checkout from 4.3.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits

Updates astral-sh/setup-uv from 5.4.2 to 8.0.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.0.0 🌈 Immutable releases and secure tags

This is the first immutable release of setup-uv 🥳

All future releases are also immutable, if you want to know more about what this means checkout the docs.

This release also has two breaking changes

New format for manifest-file

The previously deprecated way of defining a custom version manifest to control which uv versions are available and where to download them from got removed. The functionality is still there but you have to use the new format.

No more major and minor tags

To increase security even more we will stop publishing minor tags. You won't be able to use @v8 or @v8.0 any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to tj-actions.

[!TIP] Use the immutable tag as a version astral-sh/setup-uv@v8.0.0 Or even better the githash astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57

🚨 Breaking changes

🧰 Maintenance

v7.6.0 🌈 Fetch uv from Astral's mirror by default

Changes

We now default to download uv from releases.astral.sh. This means by default we don't hit the GitHub API at all and shouldn't see any rate limits and timeouts any more.

🚀 Enhancements

🧰 Maintenance

... (truncated)

Commits

Updates actions/setup-python from 5.6.0 to 6.2.0

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

Full Changelog: actions/setup-python@v6...v6.2.0

v6.1.0

What's Changed

Enhancements:

Dependency and Documentation updates:

New Contributors

Full Changelog: actions/setup-python@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

... (truncated)

Commits
  • a309ff8 Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)
  • bfe8cc5 Upgrade @​actions dependencies to Node 24 compatible versions (#1259)
  • 4f41a90 Bump urllib3 from 2.5.0 to 2.6.0 in /tests/data (#1253)
  • 83679a8 Bump @​types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ...
  • bfc4944 Bump prettier from 3.5.3 to 3.6.2 (#1234)
  • 97aeb3e Bump requests from 2.32.2 to 2.32.4 in /tests/data (#1130)
  • 443da59 Bump actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pi...
  • cfd55ca graalpy: add graalpy early-access and windows builds (#880)
  • bba65e5 Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md (#1094)
  • 18566f8 Improve wording and "fix example" (remove 3.13) on testing against pre-releas...
  • Additional commits viewable in compare view

Updates pnpm/action-setup from 4.2.0 to 6.0.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.0

Added support for pnpm v11.

v5.0.0

Updated the action to use Node.js 24.

v4.4.0

Updated the action to use Node.js 24.

v4.3.0

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v4.2.0...v4.3.0

Commits
  • 08c4be7 docs(README): update action-setup version
  • 5798914 chore: update .gitignore
  • ddffd66 fix: remove accidentally committed file
  • b43f991 fix: update pnpm to 11.0.0-rc.0
  • 3852509 README.md: bring versions up-to-date (#222)
  • 6e7bdbd chore: bump bootstrap pnpm to 11.0.0-beta.4-1 and add update script
  • 6b87c46 fix: Windows standalone mode — bypass broken npm shims (#217)
  • 994d756 feat: read pnpm version from devEngines.packageManager (#211)
  • 738f428 docs: upgrade pnpm/action-setup from v4 to v5
  • 62bce64 fix: extract pnpm version from packageManager field instead of returning unde...
  • Additional commits viewable in compare view

Updates actions/setup-node from 4.4.0 to 6.3.0

Release notes

Sourced from actions/setup-node's releases.

v6.3.0

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

What's Changed

Documentation

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

What's Changed

Enhancement:

Dependency updates:

... (truncated)

Commits

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates amondnet/vercel-action from 25.2.0 to 42.2.0

Release notes

Sourced from amondnet/vercel-action's releases.

v42.2.0

42.2.0 (2026-04-08)

Features

Bug Fixes

  • forward vercel-project-id to API deployment body for prebuilt deployments (#331) (1d5e098)

v42.1.0

42.1.0 (2026-03-29)

Features

  • comment: redesign deployment comments with rich HTML table (#320) (255bd7b)
  • example: add turbopack configuration to nextjs example (#315) (aae0c95)

v42.0.0

42.0.0 (2026-03-27)

⚠ BREAKING CHANGES

  • @​actions/github upgraded from v2 to v6

Bug Fixes

  • auto-retry deployment when personal account org ID causes scope error (#298) (1b0001f)
  • clear VERCEL_ORG_ID and VERCEL_PROJECT_ID env vars on alias retry (#312) (e34aeb6)
  • example: move express-basic-auth function to api/ directory (#308) (1c7fbdd)
  • example: update nextjs example dependencies to latest versions (#313) (1043003)
  • github ref randomly empty for release triggers (#277) (9ef1deb)
  • handle inaccessible PR head repository gracefully (f9aadd3)
  • require both vercel-org-id and vercel-project-id for deployment (#304) (c5205ad)
  • resolve vercel CLI v41 scope error for personal accounts (#297) (b591ac8)
  • retry alias command without --scope for personal accounts (#310) (b1a533d)
  • use correct commit SHA (#278) (9f07672)

Code Refactoring

  • migrate to TypeScript with Vitest and modern tooling (#311) (feb50fe)

v41.1.4

What's Changed

... (truncated)

Changelog

Sourced from amondnet/vercel-action's changelog.

Changelog

42.2.0 (2026-04-08)

Features

Bug Fixes

  • forward vercel-project-id to API deployment body for prebuilt deployments (#331) (1d5e098)

42.1.0 (2026-03-29)

Features

  • comment: redesign deployment comments with rich HTML table (#320) (255bd7b)
  • example: add turbopack configuration to nextjs example (#315) (aae0c95)

42.0.0 (2026-03-27)

⚠ BREAKING CHANGES

  • @​actions/github upgraded from v2 to v6

Bug Fixes

  • auto-retry deployment when personal account org ID causes scope error (#298) (1b0001f)
  • clear VERCEL_ORG_ID and VERCEL_PROJECT_ID env vars on alias retry (#312) (e34aeb6)
  • example: move express-basic-auth function to api/ directory (#308) (1c7fbdd)
  • example: update nextjs example dependencies to latest versions (#313) (1043003)
  • github ref randomly empty for release triggers (#277) (9ef1deb)
  • handle inaccessible PR head repository gracefully (f9aadd3)
  • require both vercel-org-id and vercel-project-id for deployment (#304) (c5205ad)
  • resolve vercel CLI v41 scope error for personal accounts (#297) (b591ac8)
  • retry alias command without --scope for personal accounts (#310) (b1a533d)
  • use correct commit SHA (#278) (9f07672)

Code Refactoring

  • migrate to TypeScript with Vitest and modern tooling (#311) (feb50fe)

v25.0.0 (2022-06-08)

Full Changelog

... (truncated)

Commits
  • 4b810e2 chore(master): release 42.2.0 (#324)
  • 1d5e098 fix: forward vercel-project-id to API deployment body for prebuilt deployment...
  • 76de380 docs: add migration guide for API-based deployment (#329)
  • 353227b refactor: migrate to API-based deployment (#325)
  • 3c572bd feat: GitHub Deployment integration (#322)
  • c71810f chore(master): release 42.1.0 (#316)
  • 255bd7b feat(comment): redesign deployment comments with rich HTML table (#320)
  • aae0c95 feat(example): add turbopack configuration to nextjs example (#315)

@dependabot @github
Copy link
Copy Markdown
Author

dependabot bot commented on behalf of github Apr 13, 2026

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@vercel
Copy link
Copy Markdown

vercel bot commented Apr 13, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nbadb Ready Ready Preview, Comment Apr 18, 2026 3:09am

@dependabot dependabot bot requested a review from wyattowalsh as a code owner April 13, 2026 07:21
@dependabot dependabot bot force-pushed the dependabot/github_actions/github-actions-aa9a50697d branch from 7ecd60e to 2279fa0 Compare April 13, 2026 14:40
@dependabot dependabot bot force-pushed the dependabot/github_actions/github-actions-aa9a50697d branch from 2279fa0 to 57e6c17 Compare April 13, 2026 16:38
@dependabot dependabot bot force-pushed the dependabot/github_actions/github-actions-aa9a50697d branch from 57e6c17 to a9e690e Compare April 14, 2026 07:53
… updates

Bumps the github-actions group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `5.4.2` | `8.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `6.2.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4.2.0` | `6.0.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.3.0` |
| [amondnet/vercel-action](https://github.com/amondnet/vercel-action) | `25.2.0` | `42.2.0` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.4` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` |



Updates `actions/checkout` from 4.3.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

Updates `astral-sh/setup-uv` from 5.4.2 to 8.0.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@d4b2f3b...cec2083)

Updates `actions/setup-python` from 5.6.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...a309ff8)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...043fb46)

Updates `pnpm/action-setup` from 4.2.0 to 6.0.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@41ff726...08c4be7)

Updates `actions/setup-node` from 4.4.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@49933ea...53b8394)

Updates `amondnet/vercel-action` from 25.2.0 to 42.2.0
- [Release notes](https://github.com/amondnet/vercel-action/releases)
- [Changelog](https://github.com/amondnet/vercel-action/blob/master/CHANGELOG.md)
- [Commits](amondnet/vercel-action@16e87c0...4b810e2)

Updates `actions/cache` from 4.3.0 to 5.0.4
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0057852...6682284)

Updates `actions/download-artifact` from 4.3.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...3e5f45b)

Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: amondnet/vercel-action
  dependency-version: 42.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/github_actions/github-actions-aa9a50697d branch from a9e690e to e52c2ca Compare April 18, 2026 03:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants