Bump the github-actions group across 1 directory with 7 updates by dependabot[bot] · Pull Request #1033 · basecamp/lexxy

dependabot · 2026-05-02T12:23:32Z

Bumps the github-actions group with 7 updates in the / directory:

Package	From	To
actions/setup-node	`6.3.0`	`6.4.0`
ruby/setup-ruby	`1.299.0`	`1.308.0`
rhysd/actionlint	`1.7.11`	`1.7.12`
zizmorcore/zizmor-action	`0.5.2`	`0.5.6`
actions/upload-artifact	`7.0.0`	`7.0.1`
actions/cache	`4.3.0`	`5.0.5`
actions/upload-pages-artifact	`4.0.0`	`5.0.0`

Updates actions/setup-node from 6.3.0 to 6.4.0

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in actions/setup-node#1525

Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in actions/setup-node#1533

New Contributors

@Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

Commits

48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
ab72c7e Upgrade @actions dependencies (#1525)
See full diff in compare view

Updates ruby/setup-ruby from 1.299.0 to 1.308.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.308.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#912

Full Changelog: ruby/setup-ruby@v1.307.0...v1.308.0

v1.307.0

What's Changed

Update README: fix outdated URLs and Ruby version examples by @fkmy in ruby/setup-ruby#910

Add ruby-4.0.4 by @ruby-builder-bot in ruby/setup-ruby#911

Full Changelog: ruby/setup-ruby@v1.306.0...v1.307.0

v1.306.0

What's Changed

Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1 by @ruby-builder-bot in ruby/setup-ruby#909

Full Changelog: ruby/setup-ruby@v1.305.0...v1.306.0

v1.305.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#908

Full Changelog: ruby/setup-ruby@v1.304.0...v1.305.0

v1.304.0

What's Changed

Add jruby-10.1.0.0 by @ruby-builder-bot in ruby/setup-ruby#906

Full Changelog: ruby/setup-ruby@v1.303.0...v1.304.0

v1.303.0

What's Changed

Add ruby-4.0.3 by @ruby-builder-bot in ruby/setup-ruby#903

Full Changelog: ruby/setup-ruby@v1.302.0...v1.303.0

v1.302.0

Full Changelog: ruby/setup-ruby@v1.301.0...v1.302.0

v1.301.0

What's Changed

Add truffleruby-34.0.0,truffleruby+graalvm-34.0.0 by @ruby-builder-bot in ruby/setup-ruby#901

... (truncated)

Commits

97ecb7b Update CRuby releases on Windows
6aaa311 Add ruby-4.0.4
f02c009 Fix docs.github.com URLs to avoid 301 redirects
98bfeb1 Remove EOL Ruby versions from matrix example in README
59a7680 Update Ruby version examples in README to include 4.0
6459287 Replace outdated help.github.com URLs with docs.github.com
c4e5b13 Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1
0cb964f Update CRuby releases on Windows
94e4d89 Add jruby-10.1.0.0
60ecfba Add ruby-4.0.3
Additional commits viewable in compare view

Updates rhysd/actionlint from 1.7.11 to 1.7.12

Release notes

Sourced from rhysd/actionlint's releases.

v1.7.12
Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @martincostello)
on:
  schedule:
    # ERROR: The timezone is not a valid IANA timezone string
    - cron: '*/5 * * * *'
      timezone: 'Asia/Somewhere'
Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @springmeyer)

Support the macos-26-intel runner label. (#629, thanks @hugovk)

Fix the outdated table of webhook activity types by rebuilding the script to scrape the table from scratch.

Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.

Tests are run on arm64 Windows in CI.

Update the popular actions data set to the latest.

Changelog

Sourced from rhysd/actionlint's changelog.

v1.7.12 - 2026-03-30
Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @martincostello)
on:
  schedule:
    # ERROR: The timezone is not a valid IANA timezone string
    - cron: '*/5 * * * *'
      timezone: 'Asia/Somewhere'
Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @springmeyer)

Support the macos-26-intel runner label. (#629, thanks @hugovk)

Fix the table of webhook activity types are outdated by rebuilding the script to scrape the table from scratch.

Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.

Tests are run on arm64 Windows in CI.

Update the popular actions data set to the latest.
[Changes][v1.7.12]

v1.7.11 - 2026-02-14
Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @heppu)
env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @hugovk and @muzimuzhi)
Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @takaram)
$ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

... (truncated)

Commits

914e7df bump up version to v1.7.12
f1fe8a1 update popular actions data set to the latest
0ef3e18 add support for https://github.blog/changelog/2026-03-19-github-actions-late-...
d2f9e65 update document to describe the timezone check in on.schedule
c03b271 Merge branch 'followup-issue641' (#641)
c9efd91 fix staticcheck checks files inside ./playground/node_modules
08e2336 include timezone database in executable statically
f48c0a4 fix timezone check is incomplete
6b811d3 fix problem matcher test fails due to line ending in test data
4897c1d Merge pull request #641 from martincostello/gh-638
Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.2 to 0.5.6

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.6

1.25.2 is now available via the action

1.25.2 is now the default version of zizmor used by the action

v0.5.5

This is a no-op release.

v0.5.4

1.25.0 is now available via the action

1.25.0 is now the default version of zizmor used by the action

v0.5.3

What's Changed

1.24.0 and 1.24.1 are now available via the action

1.24.1 is now the default version of zizmor used by the action

Full Changelog: zizmorcore/zizmor-action@v0.5.2...v0.5.3

Commits

5f14fd0 Sync zizmor versions (#114)
a16621b Bump pins in README (#112)
1c03e04 chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the github-ac...
b572f7b Sync zizmor versions (#111)
06928c5 chore(deps): bump github/codeql-action in the github-actions group (#109)
5ea8b96 docs: Update link to GitHub docs (#108)
849ac26 chore(deps): bump the github-actions group with 2 updates (#106)
814f977 Bump pins in README (#103)
b1d7e1f Sync zizmor versions (#102)
a195b57 Sync zizmor versions (#100)
Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
See full diff in compare view

Updates actions/cache from 4.3.0 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
6682284 Merge pull request #1738 from actions/prepare-v5.0.4
e340396 Update RELEASES
8a67110 Add licenses
1865903 Update dependencies & patch security vulnerabilities
5656298 Merge pull request #1722 from RyPeck/patch-1
4e380d1 Fix cache key in examples.md for bun.lock
Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 4.0.0 to 5.0.0

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

Update upload-artifact action to version 7 @Tom-van-Woudenberg (#139)

feat: add include-hidden-files input @jonchurch (#137)

See details of all code changes since previous release.

Commits

fc324d3 Merge pull request #139 from Tom-van-Woudenberg/patch-1
fe9d4b7 Merge branch 'main' into patch-1
0ca1617 Merge pull request #137 from jonchurch/include-hidden-files
57f0e84 Update action.yml
4a90348 v7 --> hash
56f665a Update upload-artifact action to version 7
f7615f5 Add include-hidden-files input
See full diff in compare view

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `6.4.0` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.299.0` | `1.308.0` | | [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.11` | `1.7.12` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.2` | `0.5.6` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.5` | | [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `4.0.0` | `5.0.0` | Updates `actions/setup-node` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@53b8394...48b55a0) Updates `ruby/setup-ruby` from 1.299.0 to 1.308.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@3ff19f5...97ecb7b) Updates `rhysd/actionlint` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/rhysd/actionlint/releases) - [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md) - [Commits](rhysd/actionlint@393031a...914e7df) Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.5.6 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@71321a2...5f14fd0) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) Updates `actions/cache` from 4.3.0 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...27d5ce7) Updates `actions/upload-pages-artifact` from 4.0.0 to 5.0.0 - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](actions/upload-pages-artifact@7b1f4a7...fc324d3) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-pages-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: rhysd/actionlint dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: ruby/setup-ruby dependency-version: 1.305.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 2, 2026

dependabot Bot requested review from Copilot and removed request for Copilot May 2, 2026 12:23

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 2, 2026

Copilot AI review requested due to automatic review settings May 5, 2026 18:54

dependabot Bot force-pushed the dependabot/github_actions/github-actions-90353b6c14 branch from 6b04e05 to 71106c8 Compare May 5, 2026 18:54

dependabot Bot requested review from Copilot and removed request for Copilot May 5, 2026 18:54

dependabot Bot force-pushed the dependabot/github_actions/github-actions-90353b6c14 branch from 71106c8 to 340e9c2 Compare May 9, 2026 12:23

dependabot Bot review requested due to automatic review settings May 9, 2026 12:23

dependabot Bot force-pushed the dependabot/github_actions/github-actions-90353b6c14 branch from 340e9c2 to 3d3b42a Compare May 16, 2026 12:23

Copilot AI review requested due to automatic review settings May 16, 2026 12:23

Copilot AI reviewed May 16, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/github-actions-90353b6c14 branch from 3d3b42a to a6fa770 Compare May 23, 2026 12:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the github-actions group across 1 directory with 7 updates#1033

Bump the github-actions group across 1 directory with 7 updates#1033
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-90353b6c14

dependabot Bot commented on behalf of github May 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.4.0

What's Changed

Dependency updates:

New Contributors

v1.308.0

What's Changed

v1.307.0

What's Changed

v1.306.0

What's Changed

v1.305.0

What's Changed

v1.304.0

What's Changed

v1.303.0

What's Changed

v1.302.0

v1.301.0

What's Changed

v1.7.12

v1.7.12 - 2026-03-30

v1.7.11 - 2026-02-14

v0.5.6

v0.5.5

v0.5.4

v0.5.3

What's Changed

v7.0.1

What's Changed

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

v.5.0.2

v5.0.2

What's Changed

v5.0.1

v5.0.1

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

v5.0.0

Changelog

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github May 2, 2026 •

edited

Loading