ci(deps): bump the github-actions group across 1 directory with 5 updates by dependabot[bot] · Pull Request #511 · IntersectMBO/evolution-sdk

dependabot · 2026-08-24T09:18:37Z

Bumps the github-actions group with 5 updates in the / directory:

Package	From	To
actions/checkout	`6.0.3`	`7.0.1`
pnpm/action-setup	`6.0.9`	`6.0.10`
actions/setup-node	`6.4.0`	`7.0.0`
actions/cache	`5`	`6`
changesets/action	`1.9.0`	`2.1.0`

Updates actions/checkout from 6.0.3 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1
What's Changed
skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518
trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521
escape values passed to --unset by @aiqiaoy in actions/checkout#2530
Various dependency updates
Full Changelog: actions/checkout@v7...v7.0.1
v7.0.0
What's Changed
block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464
update error wording by @aiqiaoy in actions/checkout#2467
New Contributors
@aiqiaoy made their first contribution in actions/checkout#2454
Full Changelog: actions/checkout@v6.0.3...v7.0.0
v6.1.0
What's Changed
[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500
backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527
https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0

Changelog

Sourced from actions/checkout's changelog.

v7.0.1
Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518
Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521
Escape values passed to --unset by @aiqiaoy in actions/checkout#2530
Various dependency updates
v7.0.0
Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
Various dependency updates

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates pnpm/action-setup from 6.0.9 to 6.0.10

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.10
What's Changed
docs(README): point users to the successor pnpm/setup action by @BlackHole1 in pnpm/action-setup#282
refactor: introduce restore keys for cache by @SukkaW in pnpm/action-setup#280
ci: use pnpm 11 for pr-check by @jamietanna in pnpm/action-setup#284
fix: update pnpm to v11.19.0 by @jamietanna in pnpm/action-setup#283
docs: update README to include devEngines.packageManager by @nemchik in pnpm/action-setup#273
New Contributors
@jamietanna made their first contribution in pnpm/action-setup#284
@nemchik made their first contribution in pnpm/action-setup#273
Full Changelog: pnpm/action-setup@v6...v6.0.10

Commits

0977fd9 docs: Update README to include devEngines.packageManager (#273)
48261ac fix: update pnpm to v11.19.0 (#283)
75677f7 ci: use pnpm 11 for pr-check (#284)
769ae71 refactor: introduce restore keys for cache (#280)
6fed91f docs(README): point users to the successor pnpm/setup action (#282)
See full diff in compare view

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0
What's Changed
Enhancements:
Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in actions/setup-node#1577
Migrate to ESM and upgrade dependencies by @gowridurgad in actions/setup-node#1574
Bug fixes:
Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in actions/setup-node#1558
Only use mirrorToken in getManifest if it's provided by @deiga in actions/setup-node#1548
Documentation updates:
Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in actions/setup-node#1536
docs: Update restore-only cache documentation by @priya-kinthali in actions/setup-node#1550
docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in actions/setup-node#1567
Dependency update:
Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-node#1569
New Contributors
@chiranjib-swain made their first contribution in actions/setup-node#1536
@deiga made their first contribution in actions/setup-node#1548
@jasongin made their first contribution in actions/setup-node#1569
Full Changelog: actions/setup-node@v6...v7.0.0
v6.5.0
What's Changed
Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in actions/setup-node#1579
Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

8207627 Migrate to ESM and upgrade dependencies (#1574)
04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
30eb73b Resolve high-severity audit issues
4e1a87a Update dist
360237f Strict equality
4f8aac5 Bump @actions/cache to 5.1.0, log cache write denied
f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
Additional commits viewable in compare view

Updates actions/cache from 5 to 6

Release notes

Sourced from actions/cache's releases.

v6.0.0
What's Changed
Update packages, migrate to ESM by @Samirat in actions/cache#1760
Full Changelog: actions/cache@v5...v6.0.0
v5.1.0
What's Changed
Bump @actions/cache to v5.1.0 - handle read-only cache access by @jasongin in actions/cache#1775
Full Changelog: actions/cache@v5...v5.1.0
v5.0.5
What's Changed
Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747
Full Changelog: actions/cache@v5...v5.0.5
v5.0.4
What's Changed
Add release instructions and update maintainer docs by @Link- in actions/cache#1696
Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697
Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699
docs: Update examples to use the latest version by @XZTDean in actions/cache#1690
Fix proxy integration tests by @Link- in actions/cache#1701
Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722
Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738
New Contributors
@XZTDean made their first contribution in actions/cache#1690
@RyPeck made their first contribution in actions/cache#1722
Full Changelog: actions/cache@v5...v5.0.4
v5.0.3
What's Changed
Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
Bump @actions/core to v2.0.3
Full Changelog: actions/cache@v5...v5.0.3
v.5.0.2
v5.0.2
What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases
How to prepare a release
[!NOTE] Relevant for maintainers with write access only.
Switch to a new branch from main.
Run npm test to ensure all tests are passing.
Update the version in https://github.com/actions/cache/blob/main/package.json.
Run npm run build to update the compiled files.
Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
Run licensed cache to update the license report.
Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
Commit your changes and push your branch upstream.
Open a pull request against main and get it reviewed and merged.
Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
Create a new tag with the version number.
Auto generate release notes and update them to match the changes you made in RELEASES.md.
Toggle the set as the latest release option.
Publish the release.
Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
There should be a workflow run queued with the same version number.
Approve the run to publish the new version and update the major tags for this action.
Changelog
6.1.0
Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token
Switch redundant "Cache save failed" warning to debug log in save-only
6.0.0
Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
Migrated to ESM module system
Upgraded Jest to v30 and test infrastructure to be ESM compatible
5.0.4
Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
Bump fast-xml-parser to v5.5.6
5.0.3
Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
Bump @actions/core to v2.0.3
5.0.2

... (truncated)

Commits

55cc834 Merge pull request #1768 from jasongin/readonly-cache
d8cd72f Bump @actions/cache to v6.1.0 - handle cache write error due to RO token
2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
e9b91fd Prettier fixes
e4884b8 Rebuild dist
10baf01 Fixed licenses
e39b386 Fix test mock return order
b692820 PR feedback
6074912 Rebuild dist bundles as ESM to match type:module
5a912e8 Fix lint and jest issues
Additional commits viewable in compare view

Updates changesets/action from 1.9.0 to 2.1.0

Release notes

Sourced from changesets/action's releases.

v2.1.0
Minor Changes
#718 3b7c71c Thanks @bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.
Patch Changes
#716 6f58ba3 Thanks @bluwy! - Update pr-status message to link to the new faq page
v2.0.0
Major Changes
#692 cb3f011 Thanks @Andarist! - Release commits and tags are now pushed using the GitHub API by default.
Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.
Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.
#680 ca57073 Thanks @bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.
If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.
#657 4f718b5 Thanks @Andarist! - Removed compatibility support for old Changesets v1.
#681 7359107 Thanks @bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.
Inputs:
version -> version-script
publish -> publish-script
commit -> commit-message
title -> pr-title
branch -> pr-base-branch
Outputs:
pull-request-number -> pr-number
#674 164652b Thanks @bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.
#659 5649ff4 Thanks @bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.
#673 823cf74 Thanks @bluwy! - Update to Changesets v3 packages
#695 469993c Thanks @bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.
Authentication should be handled via Trusted Publishing instead. If a token is still needed, use actions/setup-node to set it up instead via the registry-url option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.
#668 0eae789 Thanks @bluwy! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern

... (truncated)

Changelog

Sourced from changesets/action's changelog.

2.1.0
Minor Changes
#718 3b7c71c Thanks @bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.
Patch Changes
#716 6f58ba3 Thanks @bluwy! - Update pr-status message to link to the new faq page
2.0.0
Major Changes
#692 cb3f011 Thanks @Andarist! - Release commits and tags are now pushed using the GitHub API by default.
Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.
Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.
#680 ca57073 Thanks @bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.
If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.
#657 4f718b5 Thanks @Andarist! - Removed compatibility support for old Changesets v1.
#681 7359107 Thanks @bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.
Inputs:
version -> version-script
publish -> publish-script
commit -> commit-message
title -> pr-title
branch -> pr-base-branch
Outputs:
pull-request-number -> pr-number
#674 164652b Thanks @bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.
#659 5649ff4 Thanks @bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.
#673 823cf74 Thanks @bluwy! - Update to Changesets v3 packages
#695 469993c Thanks @bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.
Authentication should be handled via Trusted Publishing instead. If a token is still needed, use actions/setup-node to set it up instead via the registry-url option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.

... (truncated)

Commits

198f833 v2.1.0
7545547 Version Packages (#719)
3043070 Prevent test warning annotations (#720)
3b7c71c Add back cwd input (#718)
6f58ba3 Update pr-status message links to new faq (#716)
e52ce9e Version Packages (#715)
78fdc6b Exit pre mode (#714)
187a104 Update deps for stable (#709)
d11394a Version Packages (next) (#712)
5fa6767 Fix support for prerelease exits using the new .changeset/pre layout (#711)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ates Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.1` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.9` | `6.0.10` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [actions/cache](https://github.com/actions/cache) | `5` | `6` | | [changesets/action](https://github.com/changesets/action) | `1.9.0` | `2.1.0` | Updates `actions/checkout` from 6.0.3 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6.0.3...v7.0.1) Updates `pnpm/action-setup` from 6.0.9 to 6.0.10 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@v6.0.9...v6.0.10) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6.4.0...v7.0.0) Updates `actions/cache` from 5 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v5...v6) Updates `changesets/action` from 1.9.0 to 2.1.0 - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](changesets/action@v1.9.0...v2.1.0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: pnpm/action-setup dependency-version: 6.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: changesets/action dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-24T09:18:38Z

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 24, 2026

dependabotBot requested a review from solidsnakedev as a code owner August 24, 2026 09:18

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 24, 2026

Navigation Menu

Uh oh!

ci(deps): bump the github-actions group across 1 directory with 5 updates - #511

ci(deps): bump the github-actions group across 1 directory with 5 updates#511
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1fc90296c8

dependabotBot commented on behalf of githubAug 24, 2026

Uh oh!

dependabotBot commented on behalf of githubAug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabotBot commented on behalf of githubAug 24, 2026

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

v7.0.1

v7.0.0

v6.0.10

What's Changed

New Contributors

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

v6.5.0

What's Changed

v6.0.0

What's Changed

v5.1.0

What's Changed

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

v.5.0.2

v5.0.2

What's Changed

Releases

How to prepare a release

Changelog

6.1.0

6.0.0

5.0.4

5.0.3

5.0.2

v2.1.0

Minor Changes

Patch Changes

v2.0.0

Major Changes

2.1.0

Minor Changes

Patch Changes

2.0.0

Major Changes

Uh oh!

dependabotBot commented on behalf of githubAug 24, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants