Skip to content

chore(deps): update github-actions - #590

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions
Open

chore(deps): update github-actions#590
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
IzumiSy/deps2changesets (changelog) action digest e622436 → 1e89736
actions/checkout action minor v4.2.2 → v4.4.0
actions/checkout action patch v7.0.0 → v7.0.1
actions/download-artifact action patch v8.0.1 → v8.0.2
actions/setup-node action minor v7.0.0 → v7.1.0
actions/setup-node action minor v6.4.0 → v6.5.0
actions/upload-artifact action patch v7.0.1 → v7.0.2
aqua uses-with minor v2.62.3 → v2.64.0
aquaproj/aqua-installer action minor v4.0.5 → v4.1.0
changesets/action action patch v2.1.0 → v2.1.2
github/codeql-action action minor v4.37.7 → v4.38.3
github/gh-aw-actions action minor v0.89.21 → v0.91.8
mcr.microsoft.com/playwright container minor v1.63.0-noble → v1.64.0-noble
node uses-with minor 24 → 24.21.0
pnpm/action-setup action minor v4.1.0 → v4.4.0
pnpm/action-setup action minor v6.0.9 → v6.1.0
tailor-platform/actions action minor v1.6.0 → v1.7.0

Release Notes

actions/checkout (actions/checkout)

v4.4.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v4.3.1...v4.4.0

v4.3.1

Compare Source

v4.3.0

Compare Source

actions/download-artifact (actions/download-artifact)

v8.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/setup-node (actions/setup-node)

v7.1.0

Compare Source

What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

actions/upload-artifact (actions/upload-artifact)

v7.0.2

Compare Source

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

aquaproj/aqua (aqua)

v2.64.0

Compare Source

Features

#​5364 Support installing only specified packages by command or package names

aqua install now accepts command names or package names as positional arguments. Only packages matching them are installed.

aqua i gh                                 # by command name
aqua i cli/cli                            # by package name
aqua i gh suzuki-shunsuke/tfcmt           # multiple names

If any of the given names isn't found in the configuration files, the command fails:

ERR aqua failed not_found="[bar foo]" error="packages or commands aren't found in configuration files"

#​5279 Add a settings file

${XDG_CONFIG_HOME:-$HOME/.config}/aquaproj-aqua/config.yaml

checksum:
  enabled: true
  require: true
  enforce: true
  enforce_require: true
lazy_install: true
policy:
  enabled: true
  config: /home/foo/policy.yaml
tracking: true
progress_bar: false
log:
  level: info
  color: auto
max_parallelism: 5
global_config: /home/foo/aqua-global.yaml
root_dir: /home/foo/.local/share/aquaproj-aqua
keyring: false
config.yaml environment variable
checksum.enabled AQUA_CHECKSUM
checksum.require AQUA_REQUIRE_CHECKSUM
checksum.enforce AQUA_ENFORCE_CHECKSUM
checksum.enforce_require AQUA_ENFORCE_REQUIRE_CHECKSUM
lazy_install AQUA_DISABLE_LAZY_INSTALL (inverted)
policy.enabled AQUA_DISABLE_POLICY (inverted)
policy.config AQUA_POLICY_CONFIG
tracking AQUA_DISABLE_TRACKING (inverted)
progress_bar AQUA_PROGRESS_BAR
log.level AQUA_LOG_LEVEL
log.color AQUA_LOG_COLOR
max_parallelism AQUA_MAX_PARALLELISM
global_config AQUA_GLOBAL_CONFIG
root_dir AQUA_ROOT_DIR
keyring AQUA_KEYRING_ENABLED

Precedence: Environment variable > settings file > default

Performance Improvement

#​5283 Detect glibc by its loader instead of by running ldd

Bug Fixes

#​5284 gr: Don't take a build for particular hardware as the ordinary one
#​5285 gr: shorter isn't the point, the same name with less on it is
#​5287 Say what cosign said, and wait long enough for it to matter
#​5310 gr: Don't claim a provenance that is another artifact's

v2.63.0

Compare Source

Security

Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host tar, applying none of its own path or symlink containment. On hosts whose tar follows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the system tar out of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.

Features

#​5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#​5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times

Fixes

#​5237 Skip minisign verification if the host platform doesn't support minisign
#​5188 Ignore incomplete release assets in aqua gr
#​5178 Support files[].src in go_install packages
#​5171 Extract 7z archives that use the ARM64 filter
#​5161 signer_workflow is a literal path, not a regex

Others

#​5239 Fix Dockerfile build failure caused by a stale apt package index

aquaproj/aqua-installer (aquaproj/aqua-installer)

v4.1.0

Compare Source

SHA256 Checksum
4d3e513d42f425609c1ead6ecd40b9c62492011979dfe23d7012428a59efbe82  aqua-installer
Features

#​951 Add the packages input to install only specified packages

aqua >= v2.64.0 is required.

- uses: aquaproj/aqua-installer@82d0e83878a8657c4a6f2ff1755d3bfbfc67f329 # v4.1.0
  with:
    aqua_version: v2.64.0
    packages: |
      ghalint # Command names
      suzuki-shunsuke/tfcmt # Package names
- run: ghalint run

By default, aqua-installer runs aqua i -l, so tools are installed by lazy install when they are first run.
This has some problems:

  1. Without a GitHub access token, lazy install can fail because of the GitHub API rate limit
  2. Lazy install logs are mixed into the command output and become noise. This is confusing especially when a tool such as github-comment posts the output of a failed command to the pull request
  3. If a GitHub access token is passed to avoid the rate limit, the token is also passed to commands that don't need it, which increases the risk of leaking it

A common workaround is to run each command with --version first to trigger lazy install, but the token is still passed to the command, it's hard to understand why the command is run, and you have to add a step for every command.

With the packages input, only the specified packages are installed up front rather than by lazy install, so you don't need to pass a GitHub access token when running them.

  • Names are separated by whitespace or newlines
  • Empty lines and text after # are ignored
  • If packages is set and aqua_opts is the default value -l, -l isn't passed to aqua i, because -l skips installing packages
Others

#​954 Update the bootstrap version to v2.64.0

changesets/action (changesets/action)

v2.1.2

Compare Source

Patch Changes

v2.1.1

Compare Source

Patch Changes
github/codeql-action (github/codeql-action)

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

v4.38.2

Compare Source

v4.38.1

Compare Source

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

v4.38.0

Compare Source

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
  • Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

v4.37.8

Compare Source

No user facing changes.

github/gh-aw-actions (github/gh-aw-actions)

v0.91.8

Compare Source

Sync of actions from gh-aw at v0.91.8.

v0.91.7

Compare Source

Sync of actions from gh-aw at v0.91.7.

v0.91.6

Compare Source

Sync of actions from gh-aw at v0.91.6.

v0.91.5

Compare Source

Sync of actions from gh-aw at v0.91.5.

v0.91.4

Compare Source

Sync of actions from gh-aw at v0.91.4.

v0.91.2

Compare Source

Sync of actions from gh-aw at v0.91.2.

v0.91.1

Compare Source

Sync of actions from gh-aw at v0.91.1.

v0.91.0

Compare Source

Sync of actions from gh-aw at v0.91.0.

v0.90.4

Compare Source

Sync of actions from gh-aw at v0.90.4.

v0.90.3

Compare Source

Sync of actions from gh-aw at v0.90.3.

v0.90.1

Compare Source

Sync of actions from gh-aw at v0.90.1.

v0.90.0

Compare Source

Sync of actions from gh-aw at v0.90.0.

v0.89.22

Compare Source

Sync of actions from gh-aw at v0.89.22.

actions/node-versions (node)

v24.21.0: 24.21.0

Compare Source

Node.js 24.21.0

v24.20.0: 24.20.0

Compare Source

Node.js 24.20.0

v24.19.0: 24.19.0

Compare Source

Node.js 24.19.0

v24.18.1: 24.18.1

Compare Source

Node.js 24.18.1

v24.18.0: 24.18.0

Compare Source

Node.js 24.18.0

v24.17.0: 24.17.0

Compare Source

Node.js 24.17.0

v24.16.0: 24.16.0

Compare Source

Node.js 24.16.0

v24.15.0: 24.15.0

Compare Source

Node.js 24.15.0

v24.14.1: 24.14.1

Compare Source

Node.js 24.14.1

v24.14.0: 24.14.0

Compare Source

Node.js 24.14.0

v24.13.1: 24.13.1

Compare Source

Node.js 24.13.1

v24.13.0: 24.13.0

Compare Source

Node.js 24.13.0

v24.12.0: 24.12.0

Compare Source

Node.js 24.12.0

v24.11.1: 24.11.1

Compare Source

Node.js 24.11.1

v24.11.0: 24.11.0

Compare Source

Node.js 24.11.0

v24.10.0: 24.10.0

Compare Source

Node.js 24.10.0

v24.9.0: 24.9.0

Compare Source

Node.js 24.9.0

v24.8.0: 24.8.0

Compare Source

Node.js 24.8.0

v24.7.0: 24.7.0

Compare Source

Node.js 24.7.0

v24.6.0: 24.6.0

Compare Source

Node.js 24.6.0

v24.5.0: 24.5.0

Compare Source

Node.js 24.5.0

v24.4.1: 24.4.1

Compare Source

Node.js 24.4.1

v24.4.0: 24.4.0

Compare Source

Node.js 24.4.0

v24.3.0: 24.3.0

Compare Source

Node.js 24.3.0

v24.2.0: 24.2.0

Compare Source

Node.js 24.2.0

v24.1.0: 24.1.0

Compare Source

Node.js 24.1.0

v24.0.2: 24.0.2

Compare Source

Node.js 24.0.2

v24.0.1: 24.0.1

Compare Source

Node.js 24.0.1

pnpm/action-setup (pnpm/action-setup)

v4.4.0

Compare Source

Updated the action to use Node.js 24.

v4.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v4.2.0...v4.3.0

v4.2.0

Compare Source

When there's a .npmrc file at the root of the repository, pnpm will be fetched from the registry that is specified in that .npmrc file #​179

tailor-platform/actions (tailor-platform/actions)

v1.7.0

Compare Source

What's Changed

Full Changelog: tailor-platform/actions@v1...v1.7.0

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

  • Branch creation
    • "before 9am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner October 11, 2026 21:31
@renovate renovate Bot added the dependencies Dependency updates by Renovate label Oct 11, 2026
@github-actions

github-actions Bot commented Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Code Metrics Report

main (403eebe) #590 (e5da122) +/-
Coverage 88.1% 88.1% 0.0%
Test Execution Time 2m18s 2m25s +7s
Details 
  |                     | main (403eebe) | #590 (e5da122) | +/-  |
  |---------------------|----------------|----------------|------|
  | Coverage            |          88.1% |          88.1% | 0.0% |
  |   Files             |            207 |            207 |    0 |
  |   Lines             |           6178 |           6178 |    0 |
  |   Covered           |           5448 |           5448 |    0 |
- | Test Execution Time |          2m18s |          2m25s |  +7s |

Reported by octocov

@renovate
renovate Bot force-pushed the renovate/github-actions branch from cad6808 to 52b407f Compare October 12, 2026 01:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates by Renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants