Bump the github-actions group across 1 directory with 5 updates by dependabot[bot] · Pull Request #75 · basecamp/upright

dependabot · 2026-04-29T18:57:17Z

Bumps the github-actions group with 5 updates in the / directory:

Package	From	To
ruby/setup-ruby	`1.295.0`	`1.302.0`
actions/cache	`5.0.4`	`5.0.5`
rhysd/actionlint	`1.7.11`	`1.7.12`
zizmorcore/zizmor-action	`0.5.2`	`0.5.3`
actions/upload-artifact	`7.0.0`	`7.0.1`

Updates ruby/setup-ruby from 1.295.0 to 1.302.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.302.0

Full Changelog: ruby/setup-ruby@v1.301.0...v1.302.0

v1.301.0

What's Changed

Add truffleruby-34.0.0,truffleruby+graalvm-34.0.0 by @ruby-builder-bot in ruby/setup-ruby#901

Full Changelog: ruby/setup-ruby@v1.300.0...v1.301.0

v1.300.0

What's Changed

Refactor matrix script by @ntkme in ruby/setup-ruby#897

Add jruby-10.0.5.0 by @ruby-builder-bot in ruby/setup-ruby#900

Full Changelog: ruby/setup-ruby@v1.299.0...v1.300.0

v1.299.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#896

Full Changelog: ruby/setup-ruby@v1.298.0...v1.299.0

v1.298.0

What's Changed

Add ruby-3.2.11 by @ruby-builder-bot in ruby/setup-ruby#895

Full Changelog: ruby/setup-ruby@v1.297.0...v1.298.0

v1.297.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#894

Full Changelog: ruby/setup-ruby@v1.296.0...v1.297.0

v1.296.0

What's Changed

Add ruby-3.3.11 by @ruby-builder-bot in ruby/setup-ruby#893

Full Changelog: ruby/setup-ruby@v1.295.0...v1.296.0

Commits

7372622 Give a better error for TruffleRuby 34+ on macOS Intel
4c56a21 Darwin-x86_64 is no longer supported on TruffleRuby 34+
5d9c71d Add truffleruby-34.0.0,truffleruby+graalvm-34.0.0
e65c17d Add jruby-10.0.5.0
ba696ad Refactor matrix script
2327de0 TruffleRuby 34+ does not support macOS Intel
3ff19f5 Update CRuby releases on Windows
4dc28cf Add ruby-3.2.11
c515ec1 Update CRuby releases on Windows
eab2afb Add ruby-3.3.11
Additional commits viewable in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
See full diff in compare view

Updates rhysd/actionlint from 1.7.11 to 1.7.12

Release notes

Sourced from rhysd/actionlint's releases.

v1.7.12
Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @martincostello)
on:
  schedule:
    # ERROR: The timezone is not a valid IANA timezone string
    - cron: '*/5 * * * *'
      timezone: 'Asia/Somewhere'
Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @springmeyer)

Support the macos-26-intel runner label. (#629, thanks @hugovk)

Fix the outdated table of webhook activity types by rebuilding the script to scrape the table from scratch.

Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.

Tests are run on arm64 Windows in CI.

Update the popular actions data set to the latest.

Changelog

Sourced from rhysd/actionlint's changelog.

v1.7.12 - 2026-03-30
Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @martincostello)
on:
  schedule:
    # ERROR: The timezone is not a valid IANA timezone string
    - cron: '*/5 * * * *'
      timezone: 'Asia/Somewhere'
Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @springmeyer)

Support the macos-26-intel runner label. (#629, thanks @hugovk)

Fix the table of webhook activity types are outdated by rebuilding the script to scrape the table from scratch.

Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.

Tests are run on arm64 Windows in CI.

Update the popular actions data set to the latest.
[Changes][v1.7.12]

v1.7.11 - 2026-02-14
Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @heppu)
env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @hugovk and @muzimuzhi)
Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @takaram)
$ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

... (truncated)

Commits

914e7df bump up version to v1.7.12
f1fe8a1 update popular actions data set to the latest
0ef3e18 add support for https://github.blog/changelog/2026-03-19-github-actions-late-...
d2f9e65 update document to describe the timezone check in on.schedule
c03b271 Merge branch 'followup-issue641' (#641)
c9efd91 fix staticcheck checks files inside ./playground/node_modules
08e2336 include timezone database in executable statically
f48c0a4 fix timezone check is incomplete
6b811d3 fix problem matcher test fails due to line ending in test data
4897c1d Merge pull request #641 from martincostello/gh-638
Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.2 to 0.5.3

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.3

What's Changed

1.24.0 and 1.24.1 are now available via the action

1.24.1 is now the default version of zizmor used by the action

Full Changelog: zizmorcore/zizmor-action@v0.5.2...v0.5.3

Commits

b1d7e1f Sync zizmor versions (#102)
a195b57 Sync zizmor versions (#100)
629d5d0 chore(deps): bump github/codeql-action in the github-actions group (#99)
453d591 chore(deps): bump the github-actions group with 2 updates (#98)
ea2c18b Bump pins (#97)
See full diff in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.295.0` | `1.302.0` | | [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` | | [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.11` | `1.7.12` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.2` | `0.5.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | Updates `ruby/setup-ruby` from 1.295.0 to 1.302.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@319994f...7372622) Updates `actions/cache` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@6682284...27d5ce7) Updates `rhysd/actionlint` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/rhysd/actionlint/releases) - [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md) - [Commits](rhysd/actionlint@393031a...914e7df) Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.5.3 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@71321a2...b1d7e1f) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.302.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: rhysd/actionlint dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 29, 2026

dependabot Bot requested review from Copilot and removed request for Copilot April 29, 2026 18:57

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the github-actions group across 1 directory with 5 updates#75

Bump the github-actions group across 1 directory with 5 updates#75
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-fc8bd0f168

dependabot Bot commented on behalf of github Apr 29, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.302.0

v1.301.0

What's Changed

v1.300.0

What's Changed

v1.299.0

What's Changed

v1.298.0

What's Changed

v1.297.0

What's Changed

v1.296.0

What's Changed

v5.0.5

What's Changed

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

v1.7.12

v1.7.12 - 2026-03-30

v1.7.11 - 2026-02-14

v0.5.3

What's Changed

v7.0.1

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 29, 2026 •

edited

Loading