Skip to content

⬆️(dependencies) update GitHub Actions dependencies - #2371

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-dependencies
Open

⬆️(dependencies) update GitHub Actions dependencies#2371
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
actions/cache action major v5 → v6
actions/checkout action major v6 → v7
actions/setup-node action major v6 → v7
actions/setup-python action major v6 → v7 v7.1.0
actions/upload-artifact (changelog) action digest 043fb46 → cf430e0
astral-sh/setup-uv action major v8.1.0 → v10.3.0 v10.3.2 (+1)
azure/setup-helm (changelog) action digest dda3372 → 9bc31f4
crowdin/github-action action major v2 → v3 v3.5.0
docker/build-push-action (changelog) action digest bcafcac → c3c9e26
docker/login-action action major v3 → v4 v4.7.0
docker/metadata-action (changelog) action digest 030e881 → dc80280
docker/setup-buildx-action (changelog) action digest 4d04d5d → f87e599
docker/setup-buildx-action action major v3 → v4
docker/setup-qemu-action (changelog) action digest ce36039 → 9901266
dorny/paths-filter (changelog) action digest fbd0ab8 → ceb8a2b
node uses-with major 22.x → 24.x 24.22.1
numerique-gouv/action-trivy-cache action pinDigest → d6e94cf
preactjs/compressed-size-action (changelog) action digest 66325aa → f322c29
ubuntu github-runner major 24.04-arm → 26.04-arm

Release Notes

actions/cache

v6.1.0

Compare Source

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

actions/checkout

v7.0.1

Compare Source

v7.0.0

Compare Source

  • Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
  • Various dependency updates
actions/setup-node

v7.1.0

Compare Source

What's Changed

Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

v7.0.0

Compare Source

What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency update:
New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

actions/setup-python

v7.0.0

Compare Source

What's Changed
Enhancements
Bug Fix
Dependency Upgrade
New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

astral-sh/setup-uv

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v9.0.0: 🌈 Change prune-cache default to false

Compare Source

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #​967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes
🐛 Bug fixes
  • fix: fall back to distribution ID when os-release has no version field @​cxzhong (#​961)
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.3.2: 🌈 update known checksums for 0.11.28

Compare Source

Changes

Just a maintenance release

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v8.3.1: 🌈 update known checksums for 0.11.27

Compare Source

Changes

Just a maintenance release

🧰 Maintenance

📚 Documentation

v8.3.0: 🌈 Support uv.lock as a version-file source

Compare Source

Changes

Thanks to @​somaz94 you can now use the pinned version of uv itself in uv.lock. It gets picked up automatically.
If you have pinned another version of uv in your uv.lock you can use the inputs version or version-source to override this.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v8.2.0: 🌈 New inputs quiet and download-from-astral-mirror

Compare Source

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

crowdin/github-action

v3.4.0

Compare Source

What's Changed

Full Changelog: crowdin/github-action@v3.3.0...v3.4.0

v3.3.0

Compare Source

What's Changed

Full Changelog: crowdin/github-action@v3.2.0...v3.3.0

v3.2.0

Compare Source

What's Changed

Full Changelog: crowdin/github-action@v3.1.0...v3.2.0

v3.1.0

Compare Source

What's Changed

Full Changelog: crowdin/github-action@v3.0.2...v3.1.0

v3.0.2

Compare Source

What's Changed

Full Changelog: crowdin/github-action@v3.0.1...v3.0.2

v3.0.1

Compare Source

What's Changed

Full Changelog: crowdin/github-action@v3.0.0...v3.0.1

v3.0.0

Compare Source

Crowdin GitHub Action v3 runs on Crowdin CLI 5 🚀 - a complete rewrite that starts instantly and no longer requires Java. Your workflows, crowdin.yml configuration, and exit codes stay the same, so most setups upgrade with a one-line change:

-uses: crowdin/github-action@v2
+uses: crowdin/github-action@v3

Breaking changes

Only relevant if you pass custom CLI arguments via the command, command_args, or other *_args inputs:

  • pre-translate is now auto-translate (no alias); --translate-untranslated-only was removed - use --scope.
  • --plain was removed - use --output plain.
  • Redundant negatable flags were removed (e.g. --auto-update; --no-auto-update stays) - defaults are unchanged, simply drop them.
docker/login-action

v4.6.0

Compare Source

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Compare Source

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Compare Source

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Compare Source

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Compare Source

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Compare Source

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 08:00 PM and 11:59 PM, only on Sunday (* 20-23 * * 0)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added automated Pull request created automatically dependencies Pull requests that update a dependency file noChangeLog labels Jun 1, 2026
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch from 31ff8f9 to 4662486 Compare June 8, 2026 02:00
@renovate renovate Bot changed the title ⬆️(dependencies) Pin dependencies ⬆️(dependencies) update GitHub Actions dependencies Jun 8, 2026
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch from 4662486 to d40ff26 Compare June 15, 2026 01:32
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 7656c8d to 07bbe5b Compare June 22, 2026 08:19
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 7e92fd1 to a237cdf Compare July 6, 2026 02:47
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch from a237cdf to 8a87b91 Compare July 13, 2026 00:57
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 989ea0e to 3f667dd Compare July 27, 2026 00:33
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 9b1d829 to 455aad9 Compare August 3, 2026 01:42
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch from 455aad9 to b031a21 Compare August 10, 2026 01:44
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 9bc2793 to 1c10737 Compare August 24, 2026 01:31
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch from 1c10737 to 6dab695 Compare August 31, 2026 01:29
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from f10cd7a to c76b0eb Compare September 14, 2026 01:05
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch from c76b0eb to c2622ee Compare September 21, 2026 02:08
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 150ec7d to e51d108 Compare October 5, 2026 01:06
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 824b7bf to 4320bf0 Compare October 18, 2026 21:48
@renovate
renovate Bot force-pushed the renovate/github-actions-dependencies branch from 4320bf0 to e01fe12 Compare October 25, 2026 20:02

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated Pull request created automatically dependencies Pull requests that update a dependency file noChangeLog

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants