Skip to content

Bump the github-actions group across 1 directory with 6 updates - #927

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/github-actions-079aac402b
Open

Bump the github-actions group across 1 directory with 6 updates#927
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/github-actions-079aac402b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 6 updates in the / directory:

Package From To
actions/download-artifact 8.0.1 8.0.2
EndBug/add-and-commit 10.0.0 11.1.1
actions/setup-java 5.6.0 6.1.0
jsdaniell/create-json 1.2.3 1.2.4
jlumbroso/free-disk-space 1.3.1 2.0.0
softprops/action-gh-release 3.0.2 3.0.3

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • See full diff in compare view

Updates EndBug/add-and-commit from 10.0.0 to 11.1.1

Release notes

Sourced from EndBug/add-and-commit's releases.

v11.1.1

What's Changed

New Contributors

Full Changelog: EndBug/add-and-commit@v11.1.0...v11.1.1

v11.1.0

What's Changed

Full Changelog: EndBug/add-and-commit@v11.0.0...v11.1.0

v11.0.0

What's Changed

... (truncated)

Commits
  • cc9c08b 11.1.1
  • 3446398 fix: validate denylisted git args on every token (#784)
  • b0ca327 fix: Remove GH var interpolation in action.yml docstring (#783)
  • 3e1240d docs: highlight untrusted git-arg interpolation as a warning callout (#781)
  • fc1cf1d 11.1.0
  • f14ee6d chore(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 (#779)
  • bccc19e chore(deps): bump js-yaml from 5.2.3 to 5.3.0 (#780)
  • 7a6d750 ci: rebuild lib on Dependabot PRs so CI can re-run
  • 66d71de fix: reject glued quotes that string-argv would split into extra git flags (#...
  • 60ff4bb fix: neutralize workflow-command injection in info logs (#776)
  • Additional commits viewable in compare view

Updates actions/setup-java from 5.6.0 to 6.1.0

Release notes

Sourced from actions/setup-java's releases.

v6.1.0

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

v6.0.1

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

v6.0.0

What's Changed

... (truncated)

Commits
  • b843ebf Support Maven plugin repositories in generated settings.xml (#1286)
  • 2a69be2 feat: support Maven server credential origins (#1282)
  • d0e6e4d chore(deps): bump the monthly-npm-updates group with 13 updates (#1276)
  • b24925b chore(deps): bump undici from 6.28.0 to 6.29.0 (#1274)
  • 47b3648 Support Temurin JEP 322 patch versions like 26.0.2.1+1 (#1270) (#1279)
  • 74920aa Prefer Zulu 4-segment hotfix builds when resolving version ranges (#1278)
  • a78ec39 Stop GPG agent before removing signature-verification home (#1273)
  • 97c5a5e Support Temurin on Linux RISC-V (#1269)
  • 1aa87b6 Preserve compound Liberica build versions from .sdkmanrc (#1268)
  • de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
  • Additional commits viewable in compare view

Updates jsdaniell/create-json from 1.2.3 to 1.2.4

Release notes

Sourced from jsdaniell/create-json's releases.

v1.2.4

What's changed

  • Update action runtime to Node 24 (runs.using: node24) by @​stevechun in #11
  • README examples updated to jsdaniell/create-json@v1.2.4

Full Changelog: jsdaniell/create-json@v1.2.3...v1.2.4

Commits
  • 938ec49 Comment out needs for test-action in release.yml
  • c7b8b46 Disable test-action in release.yml
  • 1f60e21 Merge pull request #11 from stevechun/node-24
  • 50526fb Update to node24 and prepare for 1.2.4
  • 11bfeb0 better description to test message on json
  • b568c27 included tests on main action
  • 698796e included tests on main action
  • 01ebdae included tests on main action
  • f5e6f0e included tests on main action
  • 58324f5 included tests on main action
  • Additional commits viewable in compare view

Updates jlumbroso/free-disk-space from 1.3.1 to 2.0.0

Release notes

Sourced from jlumbroso/free-disk-space's releases.

v2.0.0 — three breaking changes, each with its reason

Breaking changes

  1. swap-storage now defaults to false. Closes #12 — reported and diagnosed by @​zaikunzhang, whose proposed documentation fallback became the new FAQ. Removing swap can kill a job under memory pressure with no error pointing back at the cleanup step; a default should not break something that elementary.
  2. tool-cache is renamed preinstalled-runtimes. The old name still works until v3.0.0 and prints a deprecation warning. (Its default is unchanged: false, as it has been since 2022.) The new name says what actually breaks when you enable it: the runtimes that actions/setup-node, setup-python, setup-go, and setup-ruby rely on.
  3. Specific options now override general ones. dotnet: false exempts .NET from every removal path, including large-packages. Fixes #33 — reported by @​ashleney; the overlap was first reported by @​gmij in #6, and @​ax3l explained the overlapping removal paths and a workaround. The policy is explicit, and this release applies it to .NET; future subject options add and test their own exemptions.

Upgrading from v1 to v2

Most workflows need no change.

  • If you set tool-cache:, rename it to preinstalled-runtimes:. The old name still works until v3.0.0 and prints a warning.
  • If you relied on swap being removed by default, add swap-storage: true. It now defaults to false, because removing swap can kill a job under memory pressure with no error pointing back here (#12).
  • If you set dotnet: false and were surprised that .NET was still removed, that is fixed — a specific option now overrides a general one (#33).

Also in this release

A README FAQ ("what are the possible side-effects of these settings?"), CONTRIBUTING.md, and a workflow example for running cleanup conditionally (#22). The reasons behind every design decision live in docs/adr/ — including ADR-0007, the record of this release's default change, written the day it was decided.

v1.3.2 — security fix and the decision records

Fixes the template-injection pattern in input handling (#51, by @​nbuckwalt).

Also adds docs/adr/ — the reasoning behind this action: why it exists, what it inherited from apache/flink and ShubhamTatvamasi, what it deliberately does not do, and what is still open.

No behaviour changes. The swap-storage default change ships in the next release.

Commits
  • ceedf09 docs: credit the contributors who reported the .NET overlap first, and narrow...
  • afeb5ad docs: state the deprecation horizon and add the v1→v2 migration note
  • a614499 docs: remove references to unreleased versions
  • 9881e8b fix: specific options override general ones — dotnet: false now keeps .NET ...
  • 654d8aa feat!: swap-storage defaults to false; tool-cache renamed to preinstalled-run...
  • 3f13fea docs: backfill the deliberative record (ADR-0001..0007)
  • a855e00 Merge pull request #51 from nbuckwalt/fix/cmd-exec-inputs-env-indirection
  • bcffc68 fix: use env var indirection for all boolean inputs to prevent CMD_EXEC
  • See full diff in compare view

Updates softprops/action-gh-release from 3.0.2 to 3.0.3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

Other Changes 🔄

  • dependency updates
Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

Other Changes 🔄

  • dependency updates
Commits
  • efb3536 release 3.0.3 (#840)
  • 6441963 chore(deps): bump the npm group with 2 updates (#839)
  • e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
  • d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)
  • 6403751 chore(deps): bump the npm group with 2 updates (#835)
  • 7c7184b chore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)
  • 0f3f0d2 chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)
  • 77fb938 chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)
  • 5a6f517 chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)
  • a3c91c9 chore(deps): bump the github-actions group with 2 updates (#825)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group across 1 directory with 6 updates
9f341b8 
Bumps the github-actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [EndBug/add-and-commit](https://github.com/endbug/add-and-commit) | `10.0.0` | `11.1.1` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.6.0` | `6.1.0` |
| [jsdaniell/create-json](https://github.com/jsdaniell/create-json) | `1.2.3` | `1.2.4` |
| [jlumbroso/free-disk-space](https://github.com/jlumbroso/free-disk-space) | `1.3.1` | `2.0.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.2` | `3.0.3` |



Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

Updates `EndBug/add-and-commit` from 10.0.0 to 11.1.1
- [Release notes](https://github.com/endbug/add-and-commit/releases)
- [Commits](EndBug/add-and-commit@290ea2c...cc9c08b)

Updates `actions/setup-java` from 5.6.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v5.6.0...v6.1.0)

Updates `jsdaniell/create-json` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/jsdaniell/create-json/releases)
- [Commits](jsdaniell/create-json@v1.2.3...v1.2.4)

Updates `jlumbroso/free-disk-space` from 1.3.1 to 2.0.0
- [Release notes](https://github.com/jlumbroso/free-disk-space/releases)
- [Commits](lumbroso-commons/free-disk-space@54081f1...ceedf09)

Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v3.0.2...v3.0.3)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: EndBug/add-and-commit
  dependency-version: 11.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: jsdaniell/create-json
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: jlumbroso/free-disk-space
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 1, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hyoklee hyoklee hyoklee approved these changes
@lrknox lrknox Awaiting requested review from lrknox lrknox is a code owner
@derobins derobins Awaiting requested review from derobins derobins is a code owner
@byrnHDF byrnHDF Awaiting requested review from byrnHDF byrnHDF is a code owner
@fortnern fortnern Awaiting requested review from fortnern fortnern is a code owner
@jhendersonHDF jhendersonHDF Awaiting requested review from jhendersonHDF jhendersonHDF is a code owner
@vchoi-hdfgroup vchoi-hdfgroup Awaiting requested review from vchoi-hdfgroup vchoi-hdfgroup is a code owner
@bmribler bmribler Awaiting requested review from bmribler bmribler is a code owner
@glennsong09 glennsong09 Awaiting requested review from glennsong09 glennsong09 is a code owner
@mattjala mattjala Awaiting requested review from mattjala mattjala is a code owner
@brtnfld brtnfld Awaiting requested review from brtnfld brtnfld is a code owner
@schwehr schwehr Awaiting requested review from schwehr schwehr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyoklee