deps(deps): bump actions/cache from 4.3.0 to 5.0.5 by dependabot[bot] · Pull Request #248 · simple-container-com/api

dependabot · 2026-05-11T09:19:04Z

Bumps actions/cache from 4.3.0 to 5.0.5.

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
6682284 Merge pull request #1738 from actions/prepare-v5.0.4
e340396 Update RELEASES
8a67110 Add licenses
1865903 Update dependencies & patch security vulnerabilities
5656298 Merge pull request #1722 from RyPeck/patch-1
4e380d1 Fix cache key in examples.md for bun.lock
Additional commits viewable in compare view

dependabot · 2026-05-11T09:19:06Z

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-05-11T09:21:10Z

Security Scan Results

Repository: api | Commit: 5827313

Check	Status	Details
✅ Secret Scan	Pass	No secrets detected
✅ Dependencies (Trivy)	Pass	0 total (no critical/high)
✅ Dependencies (Grype)	Pass	0 total (no critical/high)
📦 SBOM	Generated	509 components (CycloneDX)

Scanned at 2026-05-19 10:02 UTC

github-actions · 2026-05-11T09:21:15Z

Semgrep Scan Results

Repository: api | Commit: 5827313

Check	Status	Details
⚠️ Semgrep	Warning	10 warning(s), 10 total

Scanned at 2026-05-19 10:02 UTC

Comprehensive SCA pass on top of the Go 1.25.10 + go-billy 5.9.0 work in this PR's first commit. Identifies + fixes additional vulnerable deps that the first triage missed. ## go-git/v5 5.18.0 → 5.19.0 CVE-2026-45022 (HIGH) — go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git. Trivy fs flagged this; my earlier triage missed it because Scorecard's flag pointed at the v6-alpha advisory and I incorrectly classified the v5 sibling as a false positive too. Same upstream advisory, separate v5 advisory: GHSA-389r-gv7p-r3rp (v6) and CVE-2026-45022 (v5). Fix is in 5.19.0. ## Caddy 2.11.2 → 2.11.3 (caddy.Dockerfile) Caddy 2.11.2 image scan revealed 18 CVEs (2 CRITICAL, 9 HIGH) all in the binary's vendored deps. Caddy 2.11.3 released after our Phase 1 lock; it bumps: - go-jose/v4 4.1.3 → 4.1.4 (CVE-2026-34986 HIGH) - otel + otel/sdk 1.42→1.43 (CVE-2026-29181, CVE-2026-39883 HIGH) - smallstep/certificates 0.30.0-rc3 → 0.30.0 (CVE-2026-30836 CRITICAL) - Plus Caddy core fixes: fastcgi non-PHP execution bug, admin-socket auth-bypass via array-index normalization + path-prefix matching. Source: https://github.com/caddyserver/caddy/releases/tag/v2.11.3 Updated all three sites (builder FROM + final FROM + xcaddy build arg) per the in-file note. New digests resolved via Docker Hub registry API on 2026-05-16. ## Net source-side state after this commit - trivy fs: 0 vulnerabilities (was 1 HIGH = CVE-2026-45022, now fixed) - govulncheck: 0 reachable; 2 unreachable in modules (the documented aws-sdk-go v1 s3crypto false positives) ## Image-side state (verify post-rebuild) Each prod image at v2026.5.14: kubectl 8 (5H/3M) — all upstream kubectl-binary stdlib@1.26.2; no SC action; track upstream rebuild caddy 18 (2C/9H/6M/1L) — should drop to ~6 after rebuild with Caddy 2.11.3 (this PR) github-actions 27 (17H/10M) — 7 fixed by Go 1.25.10 + go-git/go-billy bumps (this PR); remaining 20 are bundled pulumi/gcloud binaries @ 1.26.2 (upstream) cloud-helpers 17 (9H/8M) — glibc 2.34-231.amzn2023.0.4 NOW patched (Phase 1 deferred status closes); rebuild auto-picks via dnf upgrade. Plus stdlib fixed by Go 1.25.10. ## Dependabot reconciliation | PR | What | Verdict | |---|---|---| | #162 | go-git/v5 5.13.1 → 5.16.5 | SUPERSEDED — we're at 5.19.0 now | | #237 | pulumi-command/sdk 0.9.2 → 1.2.1 | LET STAND | | #242 | alpine 3.21 → 3.23 (docker-minor-and-patch group) | LET STAND — fixes Alpine OS-pkg CVEs in kubectl/github-actions images | | #243 | caddy digest bump (still 2.11.2) | SUPERSEDED — this PR bumps to 2.11.3 | | #244 | alpine/kubectl base digest bump | LET STAND | | #245-247 | mkdocs deps | LET STAND | | #248-251 | GitHub Actions bumps | LET STAND | | #252 | gomod-minor-and-patch group (26 deps) | PARTIAL SUPERSEDE — go-billy/go-git/go-jose/otel/grpc bumps from this PR. Dependabot will auto-rebase #252 on top with the remaining 22 non-security minor/patch bumps. | | #233 | reecetech/version-increment | LET STAND | ## Validation - `go build ./...` clean - `go vet ./...` clean - `go test -short ./pkg/security/...` — all 8 packages PASS - `govulncheck ./...` — 0 reachable - `trivy fs` — 0 findings (any severity) Refs HARDENING.md Phase 8 Scorecard climb plan. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>

…addy 2.11.3 (#261) ## SCA pass — comprehensive deps + image scan Goes beyond the initial Scorecard `Vulnerabilities` fix to address **every** vulnerable dep found across source + 4 published images, all severities. Per the `feedback_all_severities` rule. Two commits in this PR: 1. Go 1.25.9 → **1.25.10** + go-billy/v5 5.8.0 → **5.9.0** 2. go-git/v5 5.18.0 → **5.19.0** + Caddy `caddy.Dockerfile` 2.11.2 → **2.11.3** ## Source-side (govulncheck + trivy fs) | Before | After | |---|---| | 6 reachable stdlib HIGH/MEDIUM + 1 HIGH go-git in `trivy fs` | **0 trivy fs findings · 0 reachable govulncheck** | ### Reachable Go stdlib (6, all fixed by Go 1.25.10) | Advisory | Module | Severity | Call path govulncheck traced | |---|---|---|---| | GO-2026-4986 | `net/mail` consumeComment — quadratic concat | HIGH | `pulumi.init` → `mail.ParseAddress` | | GO-2026-4977 | `net/mail` consumePhrase — quadratic concat | HIGH | same | | GO-2026-4982 | `html/template` meta-content URL escaping bypass | HIGH | `mcp.Start` → `http.Server.Serve` → `template.Execute` | | GO-2026-4980 | `html/template` escaper bypass | HIGH | same | | GO-2026-4971 | `net` Dial / LookupPort NUL-byte panic | HIGH | many call sites (aws, mongo, mcp) | | GO-2026-4918 | `net/http` HTTP/2 SETTINGS_MAX_FRAME_SIZE infinite loop | HIGH | many call sites | ### Reachable Go-deps (3 fixed, 2 documented) | Advisory | Module | Old → New | Status | |---|---|---|---| | GHSA-m3xc-h892-ggx6 | `go-git/go-billy/v5 < 5.9.0` | 5.8.0 → 5.9.0 | ✅ fixed | | GHSA-qw64-3x98-g7q2 | `go-git/go-billy/v5 < 5.9.0` | 5.8.0 → 5.9.0 | ✅ fixed | | **CVE-2026-45022** | `go-git/go-git/v5 < 5.19.0` | 5.18.0 → 5.19.0 | ✅ fixed (trivy fs flagged) | | GO-2022-0635 | `aws-sdk-go v1 service/s3/s3crypto` | n/a | ❌ FALSE POSITIVE — we import aws-sdk-go v1 for cloudtrail code but NOT `s3crypto`. govulncheck reachability confirms 0 hits. No upstream fix (architectural deprecation; AWS recommends migrating to v3 in `aws-sdk-go-v2`). Documented; standalone migration PR tracked. | | GO-2022-0646 | same as above | n/a | ❌ FALSE POSITIVE — same | (GHSA-389r-gv7p-r3rp / CVE-2026-45022 — initial triage misread the GHSA as a v6-alpha flag; the Dependabot record makes clear it is the v5 advisory. Bumping to 5.19.0 closes it.) ## Image-side (Trivy + Grype on the 4 v2026.5.14 published images) | Image | Before (v2026.5.14) | Source of fix | After next release | |---|---|---|---| | **simplecontainer/kubectl** | 8 (5H/3M) — all `kubectl` binary stdlib@1.26.2 | Upstream kubectl needs Go 1.26.3 rebuild | unchanged this PR; track upstream | | **simplecontainer/caddy** | 18 (2C/9H/6M/1L) — all Caddy 2.11.2 vendored deps | **Caddy 2.11.3 bump in this PR** | drops to ~6 (residual: grpc 1.79.1 — Caddy 2.11.3 ships only 1.79.0; tracked upstream) | | **simplecontainer/github-actions** | 27 (17H/10M) — 7 our binary, 20 bundled gcloud/pulumi | Our 7 fixed by Go 1.25.10 + go-git/go-billy in this PR; rest are upstream | drops to ~20 | | **simplecontainer/cloud-helpers** | 17 (9H/8M) — 4× glibc, 4× curl/krb5/libgcrypt (AL2023 now patched!), 8× stdlib in cloud-helpers binary | AL2023 `dnf upgrade` auto-picks patched packages; Go 1.25.10 fixes the binary | drops to ~0 | ### Phase 1 deferred items — status check Reviewed all four Phase 1 deferred items per HARDENING.md: | Phase 1 deferred | Now | |---|---| | `glibc` CVE-2026-4046 (HIGH, AL2023 pending) | ✅ **AL2023 published 2.34-231.amzn2023.0.4** — picked up automatically by Dockerfile's `dnf upgrade` on next rebuild | | Caddy 2.11.2 upstream transitives (2C/4H/3M/1L originally) | 🟡 **Caddy 2.11.3 ships partial fix** (this PR); residual ~6 vulns track Caddy 2.11.4+ | | `docker/docker` CVE-2026-34040 / CVE-2026-33997 | ❓ Re-check via `go list -m -versions github.com/docker/docker` — separate triage. Was migrated to `github.com/moby/moby` in PR #238; need to re-verify reachability. | | Caddy non-root USER | ⏳ Phase 6 (TUF + distro repackaging) | | github-actions non-root USER | ⏳ Track upstream GitHub Actions OIDC/userns guidance | ## Dependabot security alerts addressed Three OPEN Dependabot alerts as of this PR — all close automatically when this merges to `main`: | Alert | GHSA | CVE | Sev | Package | Fixed in | Source of fix in this PR | |---|---|---|---|---|---|---| | [#62](https://github.com/simple-container-com/api/security/dependabot/62) | GHSA-389r-gv7p-r3rp | CVE-2026-45022 | HIGH | `github.com/go-git/go-git/v5` | 5.19.0 | ✅ `go.mod`: 5.18.0 → 5.19.0 | | [#63](https://github.com/simple-container-com/api/security/dependabot/63) | GHSA-m3xc-h892-ggx6 | CVE-2026-44740 | MED | `github.com/go-git/go-billy/v5` | 5.9.0 | ✅ `go.mod`: 5.8.0 → 5.9.0 | | [#64](https://github.com/simple-container-com/api/security/dependabot/64) | GHSA-qw64-3x98-g7q2 | CVE-2026-44973 | HIGH | `github.com/go-git/go-billy/v5` | 5.9.0 | ✅ `go.mod`: 5.8.0 → 5.9.0 | What each one is: - **GHSA-389r-gv7p-r3rp** — go-git parses specially-crafted objects inconsistently with upstream Git, which can cause divergent state on a clone. Reachable via the SC `welder` git-driver path. - **GHSA-m3xc-h892-ggx6** — go-billy lacks depth/cycle detection in symlink resolution; a crafted repo can spin the resolver into infinite loops / resource exhaustion. Reachable via `welder` clone. - **GHSA-qw64-3x98-g7q2** — go-billy path-traversal across multiple components (`osfs.ChrootOS` deprecated in v5, removed in v6 — upstream recommendation is `osfs.New(path, WithBoundOS())`). Reachable via `welder` clone. (The 60 historical Dependabot alerts in `state: fixed` were closed by earlier PRs over 2025 — full audit available via `gh api repos/simple-container-com/api/dependabot/alerts`. No additional outstanding security alerts remain after this PR.) ## Dependabot PR reconciliation | PR | What | Verdict | |---|---|---| | [#162](#162) | go-git/v5 5.13.1 → 5.16.5 | **SUPERSEDED** — now at 5.19.0 | | [#237](#237) | pulumi-command/sdk 0.9.2 → 1.2.1 | LET STAND | | [#242](#242) | alpine 3.21 → 3.23 (docker-minor-and-patch group) | **LET STAND + merge first** — fixes Alpine OS-pkg CVEs in kubectl/github-actions images | | [#243](#243) | caddy digest bump (still 2.11.2) | **SUPERSEDED** — this PR bumps to 2.11.3 | | [#244](#244) | alpine/kubectl base digest bump | LET STAND | | #245-247 | mkdocs deps | LET STAND (docs/) | | #248-251 | GitHub Actions bumps | LET STAND | | [#252](#252) | gomod-minor-and-patch group (26 deps) | **PARTIAL SUPERSEDE** — go-billy / go-git / go-jose / otel / grpc bumps from this PR. Dependabot will auto-rebase #252 on top with the remaining ~22 non-security bumps. | | [#233](#233) | reecetech/version-increment | LET STAND | ## Scorecard `Vulnerabilities` projection | State | Score | |---|---| | Pre-PR (5 advisories flagged) | 5/10 | | Post-PR + Scorecard rescan | **9-10/10** (3 advisories remaining are documented false-positives + Scorecard's go-git/v6 flag, all reachability-clean per govulncheck) | ## Validation - `go build ./...` clean - `go vet ./...` clean (no output) - `go test -short ./pkg/security/...` — all 8 packages PASS (29 tests; HMAC integrity cache from PR #254 still green) - `govulncheck ./...` — **0 reachable** (was 6) - `trivy fs --severity CRITICAL,HIGH,MEDIUM,LOW` — **0 findings** (was 1 HIGH) - `trivy image simplecontainer/caddy:2026.5.14` — flagged 18; expected ~6 after Caddy 2.11.3 rebuild - `trivy image simplecontainer/cloud-helpers:aws-2026.5.14` — flagged 17; expected ~0 after rebuild (AL2023 + Go 1.25.10) ## Follow-ups out of this PR's scope - **aws-sdk-go v1 → v2 migration** — 3 `.go` files in `pkg/clouds/{pulumi/,}aws/` use v1 cloudtrail / cloudwatch / session APIs. The migration is a separate refactor PR; documented false-positives in govulncheck suffice for the security signal. - **`docker/docker` reachability re-check** — verify if PR #238's moby/moby migration cleared the original CVE. - **github-actions image bundled binaries** (pulumi, gcloud) — Track upstream rebuilds with Go 1.26.3. - **kubectl base bump** — Dependabot #244 will pick it up. Refs HARDENING.md Phase 8 Scorecard climb plan; the SAST coverage audit produced today is a separate follow-up. --------- Signed-off-by: Dmitrii Creed <creeed22@gmail.com>

Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...27d5ce7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…label (#279) ## Summary - **Consolidates 12 open Dependabot PRs into one merge** so we pay for CI / review once instead of 12+ times. Closes #275 #276 #274 #242 #243 #244 #233 #237 #248 #249 #250 #251 (and the stale #162, superseded by the gomod group in #275). - **Gates `branch.yaml` (Blacksmith / paid) on Dependabot PRs behind a `ci-run` label**, so future Dependabot PRs stop burning multi-vCPU minutes on a doomed build (they can't decrypt `secrets.SC_CONFIG`). Cheap PR workflows (CodeQL, Semgrep, govulncheck, Fuzz, TruffleHog, DCO) still run on every Dependabot PR — they're free-tier and catch the supply-chain risk that matters for a bump. - **Adapts three upstream API breaks** that this bump batch introduces (disgo, pulumi-cloudflare, pulumi backend) — `go build ./...` and tests compile clean. ## What's bumped ### Go modules (group #275, post-tidy) 24 direct + transitive: `cloud.google.com/go/storage` 1.49.0→1.62.2 · `aws/aws-lambda-go` 1.47.0→1.54.0 · `aws/aws-sdk-go-v2/config` 1.29.7→1.32.17 · `cloudflare/cloudflare-go` 0.104.0→0.116.0 · `disgoorg/disgo` 0.18.5→0.19.3 · `fatih/color` 1.18.0→1.19.0 · `go-git/go-git/v5` 5.19.0→5.19.1 (also #276) · `onsi/gomega` 1.38.2→1.41.0 · `pulumi-aws/sdk/v6` 6.83.0→6.83.3 · `pulumi-cloudflare/sdk/v6` 6.2.0→6.15.0 · `pulumi-docker/sdk/v4` 4.5.8→4.11.2 · `pulumi-gcp/sdk/v8` 8.0.0→8.41.1 · `pulumi-kubernetes/sdk/v4` 4.18.1→4.31.0 · `pulumi-mongodbatlas/sdk/v3` 3.30.0→3.38.0 · `pulumi-random/sdk/v4` 4.17.0→4.20.0 · `pulumi/pkg/v3` 3.184.0→3.241.0 · `pulumi/sdk/v3` 3.214.0→3.241.0 · `samber/lo` 1.38.1→1.53.0 · `tmc/langchaingo` 0.1.13→0.1.14 · `mongo-driver` 1.16.1→1.17.9 · `k8s.io/apimachinery` 0.35.0→0.36.1 · `k8s.io/client-go` 0.35.0→0.36.1 · others. Major bump (out of group): `pulumi/pulumi-command/sdk` 0.9.2→1.2.1 (#237). ### Docker (group #242 + digests #243 #244) - `alpine` 3.21 → 3.23 (`github-actions.Dockerfile`, `github-actions-staging.Dockerfile`) - `caddy` digest `14f5b3e` → `f96a3b7` - `alpine/kubectl` digest `e9acf90` → `405e713` ### Python docs (group #274) 3 updates in `docs/requirements.in` / `docs/requirements.txt`. ### GitHub Actions - `actions/upload-artifact` v4.6.2 → v7.0.1 (#251) - `actions/download-artifact` v4.3.0 → v8.0.1 (#249) - `actions/cache` v4.3.0 → v5.0.5 (#248) - `docker/setup-buildx-action` v3.12.0 → v4.0.0 (#250) - `reecetech/version-increment` 2023.10.2 → 2024.10.1 (#233) ## Upstream API breaks adapted in `83401af` | Dep | Break | Fix | |---|---|---| | `disgoorg/disgo` 0.19 | `webhook.Client` interface → struct | Field type `*webhook.Client` | | `disgoorg/disgo` 0.19 | `CreateMessage` gained required `rest.CreateWebhookMessageParams` arg | Pass empty `rest.CreateWebhookMessageParams{}` | | `pulumi-cloudflare/sdk` v6.15 | `LookupZoneResult.ZoneId` `*string` → `string` | Drop `lo.FromPtr(...)` wrapper at 4 sites | | `pulumi/pkg/v3` v3.241 | `backend.RemoveStack` gained `removeBackups bool` arg | Pass `false, false` (preserve no-backup-delete behaviour) | ## CI gate — what changes ```yaml # .github/workflows/branch.yaml on: pull_request: types: [opened, synchronize, reopened, labeled] # `labeled` re-triggers jobs: build-setup: if: >- github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]' || contains(github.event.pull_request.labels.*.name, 'ci-run') ``` `finalize` carries the same guard so a Dependabot PR doesn't get a "build failed" Telegram sticky for a pipeline that was intentionally never run. **Operationally** — when a future Dependabot PR (or another consolidated batch like this one) needs full Blacksmith validation before merge, add the `ci-run` label and the workflow re-fires on label. ## Test plan - [x] `go build ./...` clean (local Go 1.26, CI uses 1.25) - [x] `go test -count=1 -run '^$' -vet=off ./...` (compile every test binary) clean - [ ] Add `ci-run` label to this PR (it's authored by a human, not Dependabot, so the gate is inert — CI runs anyway) and let `branch.yaml` produce a real green build - [ ] Verify the Blacksmith build's `build-setup` decrypts `SC_CONFIG` correctly (Dependabot's failure mode was secret access, not code) - [ ] After merge: confirm next Monday's Dependabot PRs land with the heavy workflow showing as skipped (cascade from `build-setup`) and only cheap CI fires --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Dmitrii Creed <creeed22@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot · 2026-05-20T14:59:07Z

Looks like actions/cache is up-to-date now, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label May 11, 2026

dependabot Bot mentioned this pull request May 11, 2026

deps(deps): bump actions/cache from 4.3.0 to 5.0.5 #232

Closed

dependabot Bot force-pushed the dependabot/github_actions/actions/cache-5.0.5 branch 2 times, most recently from 38cb4d3 to 80ae83c Compare May 16, 2026 10:27

dependabot Bot requested review from Cre-eD and smecsia as code owners May 16, 2026 10:27

dependabot Bot force-pushed the dependabot/github_actions/actions/cache-5.0.5 branch from 80ae83c to 9eaf8ee Compare May 16, 2026 11:13

Cre-eD mentioned this pull request May 16, 2026

fix(deps): SCA pass — Go 1.25.10 + go-git 5.19.0 + go-billy 5.9.0 + Caddy 2.11.3 #261

Merged

dependabot Bot force-pushed the dependabot/github_actions/actions/cache-5.0.5 branch 6 times, most recently from f4013ce to 5445e29 Compare May 18, 2026 20:29

dependabot Bot force-pushed the dependabot/github_actions/actions/cache-5.0.5 branch from 5445e29 to 3debbcc Compare May 19, 2026 10:01

Cre-eD mentioned this pull request May 20, 2026

deps: consolidate 12 Dependabot bumps + gate branch.yaml on ci-run label #279

Merged

5 tasks

dependabot Bot closed this May 20, 2026

dependabot Bot deleted the dependabot/github_actions/actions/cache-5.0.5 branch May 20, 2026 14:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps(deps): bump actions/cache from 4.3.0 to 5.0.5#248

deps(deps): bump actions/cache from 4.3.0 to 5.0.5#248
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/cache-5.0.5

dependabot Bot commented on behalf of github May 11, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 11, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

v.5.0.2

v5.0.2

What's Changed

v5.0.1

v5.0.1

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

Uh oh!

dependabot Bot commented on behalf of github May 11, 2026

Labels

Uh oh!

github-actions Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Scan Results

Uh oh!

github-actions Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semgrep Scan Results

Uh oh!

dependabot Bot commented on behalf of github May 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 11, 2026 •

edited

Loading

github-actions Bot commented May 11, 2026 •

edited

Loading

github-actions Bot commented May 11, 2026 •

edited

Loading