Skip to content

ci(deps)(deps): bump the actions-all group with 2 updates - #102

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-all-eab99b3daf
Closed

ci(deps)(deps): bump the actions-all group with 2 updates#102
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-all-eab99b3daf

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions-all group with 2 updates: actions/setup-dotnet and azure/login.

Updates actions/setup-dotnet from 4.3.1 to 6.0.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-dotnet@v5...v6.0.0

v5.4.0

What's Changed

Enhancements

The action now validates the sdk.version field in global.json when rollForward is specified. The version must be a fully-qualified SDK version (e.g., 8.0.100, 10.0.100). Wildcard versions (e.g., 10.0.*) and runtime-style versions (e.g., 8.0.0) will now fail. See the .NET SDK version specification for details.

Documentation

Bug Fixes

Dependency Updates

New Contributors

Full Changelog: actions/setup-dotnet@v5.3.0...v5.4.0

v5.3.0

What's Changed

Enhancements

Dependency Updates

... (truncated)

Commits
  • a98b568 chore(deps): bump @​actions/cache to 6.2.0 (#756)
  • afb2931 Bump actions/checkout from 6.0.3 to 7.0.0 (#751)
  • 6df8cef Migrate to ESM and upgrade dependencies (#752)
  • 26b0ec1 Expand the CSC problem matcher to light up more errors on GitHub. (#717)
  • da5e548 docs(action): explicitly mark all optional inputs with required: false (#737)
  • 9bd3b44 Improve readability of global.json creation command (#694)
  • 4406a63 Bump @​actions/cache to 5.1.0, log cache write denied (#746)
  • dc3262d pin actions to commit SHAs in workflows (#744)
  • 95a3f8b Validate global.json SDK version before rollForward optimization (#742)
  • 9a946fd Add rollForward note in README, improve proxy health check in e2e tests and b...
  • Additional commits viewable in compare view

Updates azure/login from 2.3.0 to 3.0.2

Release notes

Sourced from azure/login's releases.

Azure Login Action v3.0.2

What's Changed

Security & hardening

  • Refactor PowerShell login to a static param()-bound script — eliminates string-interpolation in the AzPS login path so credential/config values can never be re-parsed as PowerShell (injection-safe by construction) by @​MaddyMicrosoft in Azure/login#607
  • Pin third-party GitHub Actions to commit SHAs — supply-chain hardening for the CI/release workflows by @​MaddyMicrosoft in Azure/login#615
  • Add admin-gated Release workflow — reproducible, approval-gated release + rollback pipeline by @​MaddyMicrosoft in Azure/login#610

Telemetry

  • Emit the real action ref in telemetry via GITHUB_ACTION_REF — corrects the previously stale hard-coded value so usage reports the version consumers actually pin by @​MaddyMicrosoft in Azure/login#614

Dependencies

Maintenance & docs

Full Changelog: Azure/login@v3.0.1...v3.1.0

Azure Login Action v3.0.1

What's Changed

Full Changelog: https://github.com/Azure/login/commits/v3.0.1

Azure Login Action v3.0.0

What's Changed

Full Changelog: Azure/login@v2.3.0...v3.0.0

Azure Login Action v3

What's Changed

Full Changelog: Azure/login@v2.3.0...v3

Azure Login Action v2.3.1

What's Changed

... (truncated)

Commits
  • 7ddb5af prepare release v3.0.2
  • d90bae5 Cap @​actions/exec and @​actions/core below the ESM-only 3.x majors (#628)
  • ff48d59 Bump uuid and @​actions/core (#589)
  • a26a331 Bump brace-expansion from 1.1.12 to 1.1.18 (#616)
  • ca06f43 Refactor PS login to use a static param()-bound script (#607)
  • 905554e Add admin-gated Release workflow (#610)
  • 1029b1a Bump the github-actions group across 1 directory with 7 updates (#621)
  • ae37a0d Harden Dependabot config for the CommonJS ncc build (#622)
  • 43c6847 Docs uplift (#620)
  • cf887bb Bump picomatch from 2.3.1 to 2.3.2 (#582)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions-all group with 2 updates: [actions/setup-dotnet](https://github.com/actions/setup-dotnet) and [azure/login](https://github.com/azure/login).
Updates `actions/setup-dotnet` from 4.3.1 to 6.0.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@v4.3.1...a98b568)
Updates `azure/login` from 2.3.0 to 3.0.2
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@a457da9...7ddb5af)
---
updated-dependencies:
- dependency-name: actions/setup-dotnet
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions-all
- dependency-name: azure/login
dependency-version: 3.0.2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions-all
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@dependabot
dependabotBot requested a review from bgard68 as a code ownerAugust 31, 2026 12:03
@dependabot@github

dependabotBot commented on behalf of githubAug 31, 2026

Copy link
Copy Markdown
ContributorAuthor

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabotdependabotBot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@dependabot@github

dependabotBot commented on behalf of githubAug 31, 2026

Copy link
Copy Markdown
ContributorAuthor

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabotdependabotBot closed this Aug 31, 2026
@dependabot
dependabotBot deleted the dependabot/github_actions/actions-all-eab99b3daf branch August 31, 2026 12:09
@bgard68

Copy link
Copy Markdown
Owner

Already on main — closing.

Both bumps here landed separately minutes before this was opened: actions/setup-dotnet → v6.0.0 in #96, azure/login → v3.0.2 in #98. This PR was generated at 12:03:31 from a snapshot taken as those were merging, so it proposes changes main already has.

It is still the most useful artifact of the day. This is the first grouped Actions PR this repo has produced — "the actions-all group with 2 updates", rather than one PR per action. That grouping has been in the config since 2026-08-24 (#76) and never applied, because an invalid NuGet key made Dependabot reject the whole file and fall back to a pre-2026-08-07 version. #100 fixed that.

The practical consequence: codeql-action/init and /analyze will now arrive as a single codeql-action group PR instead of the split pair that failed with Loaded a configuration file for version X, but running version Y four weeks running (#34/#35, #47/#48, #69/#72, #95/#99).

The doubled prefix in the title — ci(deps)(deps): — is fixed in #103, which merged after this was created.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@bgard68