chore(deps): bump the github-actions group across 1 directory with 4 updates#51
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
✅ Deploy Preview for pine-icons ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2dfdc4e. Configure here.
|
|
||
| - name: Send Slack Notification | ||
| uses: slackapi/slack-github-action@v1.26.0 | ||
| uses: slackapi/slack-github-action@v3.0.3 |
There was a problem hiding this comment.
Slack action v3 breaks v1 authentication and inputs
High Severity
The slackapi/slack-github-action was bumped from v1.26.0 to v3.0.3, but the workflow configuration still uses v1-style inputs and authentication. In v3, the SLACK_BOT_TOKEN environment variable is no longer recognized for authentication — a token input is required instead. The channel-id input no longer exists in v3 and must be included in the payload. Additionally, a method input (e.g., chat.postMessage) is now required for Slack API calls. This will cause Slack notifications to silently fail or error out on every release.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 2dfdc4e. Configure here.
…updates Bumps the github-actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-node](https://github.com/actions/setup-node), [actions/cache](https://github.com/actions/cache) and [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action). Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) Updates `actions/setup-node` from 4 to 6 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) Updates `actions/cache` from 4 to 5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) Updates `slackapi/slack-github-action` from 1.26.0 to 3.0.3 - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md) - [Commits](slackapi/slack-github-action@v1.26.0...v3.0.3) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: slackapi/slack-github-action dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-31b9609cdc
branch
from
June 22, 2026 04:54
2dfdc4e to
7a42a75
Compare
prsimp
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 4 updates in the / directory: actions/checkout, actions/setup-node, actions/cache and slackapi/slack-github-action.
Updates
actions/checkoutfrom 4 to 7Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)Updates
actions/setup-nodefrom 4 to 6Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
48b55a0Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)ab72c7eUpgrade@actionsdependencies (#1525)53b8394Bump minimatch from 3.1.2 to 3.1.5 (#1498)54045abScope test lockfiles by package manager and update cache tests (#1495)c882bffReplace uuid with crypto.randomUUID() (#1378)774c1d6feat(node-version-file): support parsingdevEnginesfield (#1283)efcb663fix: remove hardcoded bearer (#1467)d02c89dFix npm audit issues (#1491)6044e13Docs: bump actions/checkout from v5 to v6 (#1468)8e49463Fix README typo (#1226)Updates
actions/cachefrom 4 to 5Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
27d5ce7Merge pull request #1747 from actions/yacaovsnc/update-dependencyf280785licensed changes619aeb1npm run build generated dist filesbcf16c2Update ts-http-runtime to 0.3.56682284Merge pull request #1738 from actions/prepare-v5.0.4e340396Update RELEASES8a67110Add licenses1865903Update dependencies & patch security vulnerabilities5656298Merge pull request #1722 from RyPeck/patch-14e380d1Fix cache key in examples.md for bun.lockUpdates
slackapi/slack-github-actionfrom 1.26.0 to 3.0.3Release notes
Sourced from slackapi/slack-github-action's releases.
... (truncated)
Changelog
Sourced from slackapi/slack-github-action's changelog.
Commits
45a88b9chore: release1c0bcf0chore: release (#606)66834e4feat: add instrumentation to address error rates (#600)0fe0f90build(deps): bump@actions/githubfrom 9.0.0 to 9.1.1 (#605)c5e7059build(deps): bump@slack/web-apifrom 7.15.0 to 7.15.1 (#604)0325526build(deps-dev): bump@biomejs/biomefrom 2.4.10 to 2.4.13 (#601)900cd3ebuild(deps-dev): bump@types/nodefrom 24.12.0 to 24.12.2 (#603)53fdcffbuild(deps): bump@actions/corefrom 3.0.0 to 3.0.1 (#602)26856ccbuild(deps): bump slackapi/slack-github-action from 3.0.1 to 3.0.2 (#596)feba1e2ci: skip publish step if no release is needed (#599)Note
Medium Risk
Major Slack action (v1→v3) and Node 24–based action majors could break release/Slack jobs if runner or action APIs differ; impact is limited to CI, not shipped code.
Overview
Bumps pinned GitHub Actions versions across CI, icon export, release, and Slack notification workflows—no application or build logic changes.
actions/checkoutmoves from v4 to v7 inbuild.yml(all three jobs),icon-export.yml,release.yml, andsend-slack-notification.yml.actions/setup-node(v4 → v6) andactions/cache(v4 → v5) are updated only inicon-export.yml.slackapi/slack-github-actionis upgraded from v1.26.0 to v3.0.3 inrelease.ymlandsend-slack-notification.yml; step inputs (channel-id,payload-file-path) and env vars are unchanged in the diff.Composite actions under
.github/workflows/actions/still reference older checkout/setup-node/cache versions and are not part of this PR.Reviewed by Cursor Bugbot for commit 7a42a75. Bugbot is set up for automated code reviews on this repo. Configure here.