deps: Bump the github-actions group across 1 directory with 6 updates by dependabot[bot] · Pull Request #136 · action-stars/helm-workflows

dependabot · 2026-06-08T12:33:45Z

Bumps the github-actions group with 6 updates in the / directory:

Package	From	To
actions/checkout	`6.0.2`	`6.0.3`
mindsers/changelog-reader-action	`2.2.3`	`2.4.0`
docker/login-action	`4.0.0`	`4.2.0`
imjasonh/setup-crane	`0.5`	`0.6`
sigstore/cosign-installer	`4.1.1`	`4.1.2`
actions/cache	`5.0.4`	`5.0.5`

Updates actions/checkout from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

... (truncated)

Commits

df4cb1c Update changelog for v6.0.3 (#2446)
1cce339 Fix checkout init for SHA-256 repositories (#2439)
900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
0c366fd Update changelog (#2357)
See full diff in compare view

Updates mindsers/changelog-reader-action from 2.2.3 to 2.4.0

Release notes

Sourced from mindsers/changelog-reader-action's releases.

v2.4.0

Added

New changes_file output: a path to a temporary file containing the matched entry's text, for tools that consume release notes as a file (goreleaser, gh release create --notes-file, etc.). Resolves #68.

New version_scheme input (semver default, or pep440) enabling extraction and validation of Python PEP 440 version identifiers like 0.1.0a1. Resolves #38.

Security

Harden the reference-link parsing regex against catastrophic backtracking (CodeQL js/redos). The previous pattern had a . character in two overlapping character classes; a hostile CHANGELOG line could in principle trigger exponential matching time. The fix tightens the label character class without changing the regex's accepted inputs.

v2.3.0

Changed

Use Node 24 as the action runtime.

Refactor the internal entry, validation, and pipeline modules for type safety and easier maintenance. No change in observable behavior for action consumers.

Modernize the bundled runtime dependencies: @actions/core 1.x → 2.x and the YAML parser 1.x → 2.x. The action's input/output contract is unchanged.

Fixed

Declare semver as a runtime dependency instead of a dev dependency.

Stop dumping the full CHANGELOG content to debug logs when parsing entries and links.

Detect the Unreleased heading case-insensitively when picking the most recent released entry.

Warn (instead of silently degrading) when validation_level or validation_depth inputs are invalid; fall back to safe defaults.

Warn (instead of silently using an empty config) when an explicit config_file does not exist.

Validate the shape of YAML/JSON config files; warn on per-field type mismatches and reject non-object roots.

Recognize bare ## Unreleased headings in addition to the bracketed ## [Unreleased] form.

Changelog

Sourced from mindsers/changelog-reader-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[2.4.0] - 2026-05-20

Added

New changes_file output: a path to a temporary file containing the matched entry's text, for tools that consume release notes as a file (goreleaser, gh release create --notes-file, etc.). Resolves #68.

New version_scheme input (semver default, or pep440) enabling extraction and validation of Python PEP 440 version identifiers like 0.1.0a1. Resolves #38.

Security

Harden the reference-link parsing regex against catastrophic backtracking (CodeQL js/redos). The previous pattern had a . character in two overlapping character classes; a hostile CHANGELOG line could in principle trigger exponential matching time. The fix tightens the label character class without changing the regex's accepted inputs.

[2.3.0] - 2026-05-19

Changed

Use Node 24 as the action runtime.

Refactor the internal entry, validation, and pipeline modules for type safety and easier maintenance. No change in observable behavior for action consumers.

Modernize the bundled runtime dependencies: @actions/core 1.x → 2.x and the YAML parser 1.x → 2.x. The action's input/output contract is unchanged.

Fixed

Declare semver as a runtime dependency instead of a dev dependency.

Stop dumping the full CHANGELOG content to debug logs when parsing entries and links.

Detect the Unreleased heading case-insensitively when picking the most recent released entry.

Warn (instead of silently degrading) when validation_level or validation_depth inputs are invalid; fall back to safe defaults.

Warn (instead of silently using an empty config) when an explicit config_file does not exist.

Validate the shape of YAML/JSON config files; warn on per-field type mismatches and reject non-object roots.

Recognize bare ## Unreleased headings in addition to the bracketed ## [Unreleased] form.

[2.2.3] - 2024-03-10

Fixed

Upgrade dependencies to solve deprecation issues.

Use node v20

Remove useless empty line between links in the body of a version

[2.2.2] - 2022-11-23

Fixed

... (truncated)

Commits

1faaf50 chore(release): v2.4.0
5f62f39 feat: support PEP 440 versions via a version_scheme input (#123)
c8614b9 feat: add changes_file output (#68) (#122)
6a1d138 fix: harden link-parsing regex against catastrophic backtracking (#121)
695e5c9 chore(ci): use the action itself to extract release notes (#120)
4b39e79 chore(release): v2.3.0
5169600 fix: tighten input and config validation for v2.3.0 (#119)
a5d2d13 chore(deps): upgrade toolchain to current (Node 24, @actions/core 2, yaml 2, ...
5358d0b unify link handling, type rule results, extract pure pipeline (#117)
347fff2 Phase 4: SECURITY.md, code of conduct, issue/PR templates, commitlint (#115)
Additional commits viewable in compare view

Updates docker/login-action from 4.0.0 to 4.2.0

Release notes

Sourced from docker/login-action's releases.

v4.2.0

Bump @actions/core from 3.0.0 to 3.0.1 in docker/login-action#976

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1050.0 in docker/login-action#960

Bump @docker/actions-toolkit from 0.86.0 to 0.90.0 in docker/login-action#970

Bump brace-expansion from 2.0.1 to 5.0.6 in docker/login-action#993

Bump fast-xml-builder from 1.1.4 to 1.2.0 in docker/login-action#985

Bump fast-xml-parser from 5.3.6 to 5.8.0 in docker/login-action#963

Bump http-proxy-agent and https-proxy-agent to 9.0.0 in docker/login-action#961

Bump postcss from 8.5.6 to 8.5.10 in docker/login-action#979

Bump tar from 6.2.1 to 7.5.15 in docker/login-action#991

Bump vite from 7.3.1 to 7.3.3 in docker/login-action#986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

v4.1.0

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in docker/login-action#945

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in docker/login-action#930

Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in docker/login-action#932 docker/login-action#936

Bump brace-expansion from 1.1.12 to 1.1.13 in docker/login-action#952

Bump fast-xml-parser from 5.3.4 to 5.3.6 in docker/login-action#942

Bump flatted from 3.3.3 to 3.4.2 in docker/login-action#944

Bump glob from 10.3.12 to 10.5.0 in docker/login-action#940

Bump handlebars from 4.7.8 to 4.7.9 in docker/login-action#949

Bump http-proxy-agent and https-proxy-agent to 8.0.0 in docker/login-action#937

Bump lodash from 4.17.23 to 4.18.1 in docker/login-action#958

Bump minimatch from 3.1.2 to 3.1.5 in docker/login-action#941

Bump picomatch from 4.0.3 to 4.0.4 in docker/login-action#948

Bump undici from 6.23.0 to 6.24.1 in docker/login-action#938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

Commits

650006c Merge pull request #960 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
99df1a3 chore: update generated content
3ab375f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
39d8580 Merge pull request #970 from docker/dependabot/npm_and_yarn/docker/actions-to...
4eefcd3 chore: update generated content
56d092c build(deps): bump @docker/actions-toolkit from 0.86.0 to 0.90.0
e2e31ca Merge pull request #976 from docker/dependabot/npm_and_yarn/actions/core-3.0.1
0bced94 chore: update generated content
3e75a0f build(deps): bump @actions/core from 3.0.0 to 3.0.1
365bebd Merge pull request #984 from docker/dependabot/github_actions/aws-actions/con...
Additional commits viewable in compare view

Updates imjasonh/setup-crane from 0.5 to 0.6

Release notes

Sourced from imjasonh/setup-crane's releases.

v0.6

What's Changed

Pass action inputs via env to prevent script injection by @amouat in imjasonh/setup-crane#18

New Contributors

@amouat made their first contribution in imjasonh/setup-crane#18

Full Changelog: imjasonh/setup-crane@v0.5...v0.6

Commits

59c71e9 Merge pull request #18 from amouat/harden-action-env
67f282d Update use-action.yaml
9feaf12 Pass action inputs via env to prevent script injection
See full diff in compare view

Updates sigstore/cosign-installer from 4.1.1 to 4.1.2

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.2

What's Changed

Bump cosign to 3.0.6 in sigstore/cosign-installer#232

Commits

6f9f177 Bump cosign to 3.0.6 (#232)
b5e753a Bump actions/github-script from 8.0.0 to 9.0.0 (#230)
115e4ce Bump actions/setup-go from 6.3.0 to 6.4.0 (#226)
See full diff in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` | | [mindsers/changelog-reader-action](https://github.com/mindsers/changelog-reader-action) | `2.2.3` | `2.4.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.0.0` | `4.2.0` | | [imjasonh/setup-crane](https://github.com/imjasonh/setup-crane) | `0.5` | `0.6` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` | | [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` | Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) Updates `mindsers/changelog-reader-action` from 2.2.3 to 2.4.0 - [Release notes](https://github.com/mindsers/changelog-reader-action/releases) - [Changelog](https://github.com/mindsers/changelog-reader-action/blob/master/CHANGELOG.md) - [Commits](mindsers/changelog-reader-action@32aa5b4...1faaf50) Updates `docker/login-action` from 4.0.0 to 4.2.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@b45d80f...650006c) Updates `imjasonh/setup-crane` from 0.5 to 0.6 - [Release notes](https://github.com/imjasonh/setup-crane/releases) - [Commits](imjasonh/setup-crane@6da1ae0...59c71e9) Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@cad07c2...6f9f177) Updates `actions/cache` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@6682284...27d5ce7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: mindsers/changelog-reader-action dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: imjasonh/setup-crane dependency-version: '0.6' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 8, 2026

dependabot Bot requested a review from a team as a code owner June 8, 2026 12:33

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 8, 2026

chore: Update changelog for Dependabot

4168978

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps: Bump the github-actions group across 1 directory with 6 updates#136

deps: Bump the github-actions group across 1 directory with 6 updates#136
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/github-actions-1d9b1e8c35

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 8, 2026

v6.0.3

What's Changed

New Contributors

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v2.4.0

Added

Security

v2.3.0

Changed

Fixed

Changelog

[Unreleased]

[2.4.0] - 2026-05-20

Added

Security

[2.3.0] - 2026-05-19

Changed

Fixed

[2.2.3] - 2024-03-10

Fixed

[2.2.2] - 2022-11-23

Fixed

v4.2.0

v4.1.0

v0.6

What's Changed

New Contributors

v4.1.2

What's Changed

v5.0.5

What's Changed

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants