-
chore(deps): bump the github-actions group across 1 directory with 2 updates (#1721)
发布于
2026-09-01 03:21:23 +00:00 Bumps the github-actions group with 2 updates in the / directory:
actions/checkout and
actions/setup-node.Updates
actions/checkoutfrom 5.1.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
v7.0.1
What's Changed
- skip running unsafe pr check if input is default by
@aiqiaoyin actions/checkout#2518 - trim only ascii whitespace for branch by
@aiqiaoyin actions/checkout#2521 - escape values passed to --unset by
@aiqiaoyin actions/checkout#2530 - Various dependency updates
Full Changelog: https://github.com/actions/checkout/compare/v7...v7.0.1
v7.0.0
What's Changed
- block checking out fork pr for pull_request_target and workflow_run
by
@aiqiaoyin actions/checkout#2454 - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by
@dependabot[bot] in actions/checkout#2458 - Bump flatted from 3.3.1 to 3.4.2 by
@dependabot[bot] in actions/checkout#2460 - Bump js-yaml from 4.1.0 to 4.2.0 by
@dependabot[bot] in actions/checkout#2461 - Bump
@actions/coreand@actions/tool-cacheand Remove uuid by@dependabot[bot] in actions/checkout#2459 - upgrade module to esm and update dependencies by
@aiqiaoyin actions/checkout#2463 - Bump the minor-npm-dependencies group across 1 directory with 3
updates by
@dependabot[bot] in actions/checkout#2462 - getting ready for checkout v7 release by
@aiqiaoyin actions/checkout#2464 - update error wording by
@aiqiaoyin actions/checkout#2467
New Contributors
@aiqiaoymade their first contribution in actions/checkout#2454
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0
v6.1.0
What's Changed
- [BREAKING] backport
allow-unsafe-pr-checkoutto v6 by@aiqiaoyin actions/checkout#2500 - backport fixes to releases-v6 by
@aiqiaoyin actions/checkout#2527
https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v6.1.0
v6.0.3
What's Changed
- Update changelog by
@ericsciplein actions/checkout#2357 - fix: expand merge commit SHA regex and add SHA-256 test cases by
@yaananthin actions/checkout#2414 - Fix checkout init for SHA-256 repositories by
@yaananthin actions/checkout#2439 - Update changelog for v6.0.3 by
@yaananthin actions/checkout#2446
New Contributors
@yaananthmade their first contribution in actions/checkout#2414
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3
v6.0.2
What's Changed
- Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by
@TingluoHuangin actions/checkout#2355
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
Changelog
v7.0.1
- Skip running unsafe pr check if input is default by
@aiqiaoyin actions/checkout#2518 - Trim only ascii whitespace for branch by
@aiqiaoyin actions/checkout#2521 - Escape values passed to --unset by
@aiqiaoyin actions/checkout#2530 - Various dependency updates
v7.0.0
- Block checking out fork PR for pull_request_target and workflow_run
by
@aiqiaoyin actions/checkout#2454 - Various dependency updates
v6.0.3
- Fix checkout init for SHA-256 repositories by
@yaananthin actions/checkout#2439 - fix: expand merge commit SHA regex and add SHA-256 test cases by
@yaananthin actions/checkout#2414
v6.0.2
- Fix tag handling: preserve annotations and explicit fetch-tags by
@ericsciplein actions/checkout#2356
v6.0.1
- Add worktree support for persist-credentials includeIf by
@ericsciplein actions/checkout#2327
v6.0.0
- Persist creds to a separate file by
@ericsciplein actions/checkout#2286 - Update README to include Node.js 24 support details and requirements
by
@salmanmkcin actions/checkout#2248
v5.0.1
- Port v6 cleanup to v5 by
@ericsciplein actions/checkout#2301
v5.0.0
- Update actions checkout to use node 24 by
@salmanmkcin actions/checkout#2226
v4.3.1
- Port v6 cleanup to v4 by
@ericsciplein actions/checkout#2305
v4.3.0
- docs: update README.md by
@motssin actions/checkout#1971 - Add internal repos for checking out multiple repositories by
@mouismailin actions/checkout#1977 - Documentation update - add recommended permissions to Readme by
@benwellsin actions/checkout#2043 - Adjust positioning of user email note and permissions heading by
@joshmgrossin actions/checkout#2044 - Update README.md by
@nebuk89in actions/checkout#2194 - Update CODEOWNERS for actions by
@TingluoHuangin actions/checkout#2224 - Update package dependencies by
@salmanmkcin actions/checkout#2236
v4.2.2
url-helper.tsnow leverages well-known environment variables by@jww3in actions/checkout#1941- Expand unit test coverage for
isGhesby@jww3in actions/checkout#1946
v4.2.1
- Check out other refs/* by commit if provided, fall back to ref by
@orhantoyin actions/checkout#1924
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)- Additional commits viewable in compare view
Updates
actions/setup-nodefrom 5.0.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
v7.0.0
What's Changed
Enhancements:
- Add cache-primary-key and cache-matched-key as outputs by
@gowridurgadin actions/setup-node#1577 - Migrate to ESM and upgrade dependencies by
@gowridurgadin actions/setup-node#1574
Bug fixes:
- Remove dummy NODE_AUTH_TOKEN export by
@gowridurgadin actions/setup-node#1558 - Only use
mirrorTokeningetManifestif it's provided by@deigain actions/setup-node#1548
Documentation updates:
- Add documentation for publishing to npm with Trusted Publisher
(OIDC) by
@chiranjib-swainin actions/setup-node#1536 - docs: Update restore-only cache documentation by
@priya-kinthaliin actions/setup-node#1550 - docs: Update caching recommendations to mitigate cache poisoning
risks by
@chiranjib-swainin actions/setup-node#1567
Dependency update:
- Upgrade
@actions/cacheto 5.1.0, log cache write denied by@jasonginin actions/setup-node#1569
New Contributors
@chiranjib-swainmade their first contribution in actions/setup-node#1536@deigamade their first contribution in actions/setup-node#1548@jasonginmade their first contribution in actions/setup-node#1569
Full Changelog: https://github.com/actions/setup-node/compare/v6...v7.0.0
v6.5.0
What's Changed
- Update
@actions/cacheto 5.1.0 and add security overrides for undici and fast-xml-parser by@HarithaVattikutiin actions/setup-node#1579
Full Changelog: https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0
v6.4.0
What's Changed
Dependency updates:
- Upgrade
@actionsdependencies by@Copilotin actions/setup-node#1525 - Update Node.js versions in versions.yml and bump package to v6.4.0
by
@priya-kinthaliin actions/setup-node#1533
New Contributors
@Copilotmade their first contribution in actions/setup-node#1525
Full Changelog: https://github.com/actions/setup-node/compare/v6...v6.4.0
v6.3.0
What's Changed
Enhancements:
- Support parsing
devEnginesfield by@susnuxin actions/setup-node#1283
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)- Additional commits viewable in compare view
Signed-off-by: dependabot[bot] support@github.com
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>下载附件
- skip running unsafe pr check if input is default by