Repository navigation
chore(deps-actions): update github-actions (major) - #287
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
October 8, 2026 08:09
ad2398b to
89bcaee
Compare
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
5 times, most recently
from
October 8, 2026 15:40
9ef0e85 to
ef8edf3
Compare
yacosta738
previously approved these changes
Oct 8, 2026
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
October 8, 2026 15:46
ef8edf3 to
313afa4
Compare
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
7 times, most recently
from
October 9, 2026 10:40
bf08ed6 to
2706dd9
Compare
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
October 9, 2026 11:29
2706dd9 to
0a242db
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.



This PR contains the following updates:
v4.3.0→v6.1.0v6→v7v6.0.3→v7.0.1v4→v7v7→v9v6.4.0→v7.0.0v7.1.0v6→v722→2411.11.0→12.10.012.10.1Release Notes
actions/cache (actions/cache)
v6.1.0Compare Source
What's Changed
Full Changelog: actions/cache@v6...v6.1.0
v6.0.0Compare Source
What's Changed
Full Changelog: actions/cache@v5...v6.0.0
v5.1.0Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.1.0
v5.0.5Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.0.5
v5.0.4Compare Source
What's Changed
New Contributors
Full Changelog: actions/cache@v5...v5.0.4
v5.0.3Compare Source
What's Changed
@actions/cacheto v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)@actions/coreto v2.0.3Full Changelog: actions/cache@v5...v5.0.3
v5.0.2: v.5.0.2Compare Source
v5.0.2
What's Changed
When creating cache entries, 429s returned from the cache service will not be retried.
v5.0.1Compare Source
v5.0.1
What's Changed
v5.0.0
What's Changed
Full Changelog: actions/cache@v5...v5.0.1
v5.0.0Compare Source
What's Changed
Full Changelog: actions/cache@v4.3.0...v5.0.0
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
actions/github-script (actions/github-script)
v9.0.0Compare Source
New features:
getOctokitfactory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients withgetOctokitfor details and examples.ACTIONS_ORCHESTRATION_IDenvironment variable is automatically appended to the user-agent string for request tracing.Breaking changes:
require('@actions/github')no longer works in scripts. The upgrade to@actions/githubv9 (ESM-only) meansrequire('@actions/github')will fail at runtime. If you previously used patterns likeconst { getOctokit } = require('@actions/github')to create secondary clients, use the new injectedgetOctokitfunction instead — it's available directly in the script context with no imports needed.getOctokitis now an injected function parameter. Scripts that declareconst getOctokit = ...orlet getOctokit = ...will get aSyntaxErrorbecause JavaScript does not allowconst/letredeclaration of function parameters. Use the injectedgetOctokitdirectly, or usevar getOctokit = ...if you need to redeclare it.@actions/githubinternals beyond the standardgithub/octokitclient, you may need to update those references for v9 compatibility.What's Changed
New Contributors
Full Changelog: actions/github-script@v8.0.0...v9.0.0
v8.0.0Compare Source
actions/setup-node (actions/setup-node)
v7.0.0Compare Source
What's Changed
Enhancements:
Bug fixes:
mirrorTokeningetManifestif it's provided by @deiga in #1548Documentation updates:
Dependency update:
New Contributors
Full Changelog: actions/setup-node@v6...v7.0.0
v6.5.0Compare Source
What's Changed
Full Changelog: actions/setup-node@v6.4.0...v6.5.0
codecov/codecov-action (codecov/codecov-action)
v7.1.1Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1
v7.1.0Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0
v7.0.0Compare Source
codecovsecurityaccount. We have deleted the account and are usingcodecovsecopswith the original gpg keyWhat's Changed
Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0
actions/node-versions (node)
v24.21.0: 24.21.0Compare Source
Node.js 24.21.0
v24.20.0: 24.20.0Compare Source
Node.js 24.20.0
v24.19.0: 24.19.0Compare Source
Node.js 24.19.0
v24.18.1: 24.18.1Compare Source
Node.js 24.18.1
v24.18.0: 24.18.0Compare Source
Node.js 24.18.0
v24.17.0: 24.17.0Compare Source
Node.js 24.17.0
v24.16.0: 24.16.0Compare Source
Node.js 24.16.0
v24.15.0: 24.15.0Compare Source
Node.js 24.15.0
v24.14.1: 24.14.1Compare Source
Node.js 24.14.1
v24.14.0: 24.14.0Compare Source
Node.js 24.14.0
v24.13.1: 24.13.1Compare Source
Node.js 24.13.1
v24.13.0: 24.13.0Compare Source
Node.js 24.13.0
v24.12.0: 24.12.0Compare Source
Node.js 24.12.0
v24.11.1: 24.11.1Compare Source
Node.js 24.11.1
v24.11.0: 24.11.0Compare Source
Node.js 24.11.0
v24.10.0: 24.10.0Compare Source
Node.js 24.10.0
v24.9.0: 24.9.0Compare Source
Node.js 24.9.0
v24.8.0: 24.8.0Compare Source
Node.js 24.8.0
v24.7.0: 24.7.0Compare Source
Node.js 24.7.0
v24.6.0: 24.6.0Compare Source
Node.js 24.6.0
v24.5.0: 24.5.0Compare Source
Node.js 24.5.0
v24.4.1: 24.4.1Compare Source
Node.js 24.4.1
v24.4.0: 24.4.0Compare Source
Node.js 24.4.0
v24.3.0: 24.3.0Compare Source
Node.js 24.3.0
v24.2.0: 24.2.0Compare Source
Node.js 24.2.0
v24.1.0: 24.1.0Compare Source
Node.js 24.1.0
v24.0.2: 24.0.2Compare Source
Node.js 24.0.2
v24.0.1: 24.0.1Compare Source
Node.js 24.0.1
v24.0.0: 24.0.0Compare Source
Node.js 24.0.0
pnpm/pnpm (pnpm)
v12.10.0: pnpm 12.10.0Compare Source
This release adds an experimental
loadednode linker, letspnpm-lock.yamlrecord resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store.Minor Changes
Added experimental
nodeLinker: { type: loaded }installation. Compatible dependencies load directly from the content-addressable store through an automatically registered Node.js loader.nodeLinker.excludedselects packages and their dependency trees to install in the global virtual store.lockfile.includeResolutionSettings: truemakespnpm-lock.yamlrecordautoDedupe,dedupeInjectedDeps,dedupePeerDependentsandlinkWorkspacePackages. Installs then treat a lockfile that records other values as outdated. A lockfile that recordsautoDedupeis reused by later installs on any machine, sopnpm runafterpnpm install --frozen-lockfileno longer starts another install #16583.Patch Changes
Security
pnpm installnow prevents dependency versions with path traversal from writing files outside the global virtual store.pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with
version+integrity.Lockfile verification now checks the tarballs inside a
variationsresolution against the registry. Aname@versionlockfile entry with an emptyvariationsresolution is now rejected.pnpm audit signaturesnow verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification.pnpm installandpnpm publishnow reject archive metadata larger than 64 MiB before reading it into memory. Publishing a pre-built tarball also rejects manifests and README files larger than 64 MiB.Two URL or local path dependencies no longer share a virtual store directory when one URL has
+,#,:, or?where the other has/. Such dependencies, including git dependencies pinned with#, now get a hash suffix on their directory name.The warning about an ignored project
.npmrcregistry setting no longer prints the username and password of a URL-scoped key such as//user:password@registry.example.com/${PATH}/:_authToken.Installing and resolving dependencies
pnpm installnow fails withERR_PNPM_UNSUPPORTED_PROTOCOLwhen a dependency uses a specifier with a protocol pnpm does not support, such as Yarn'spatch:. On Windows, such a specifier failed withos error 123. On other platforms, pnpm linked it to a directory that does not exist. Reading apackage.jsonthat fails now names the file #16590.pnpm installnow fails withERR_PNPM_PACKAGE_MANIFEST_INVALID_ATTRIBUTEwhen a project declares a dependency whose specifier is not a string, such as"is-positive": 42. Before, the dependency was silently left out of the lockfile. AreadPackagehook can still correct the specifier.Fixed
pnpm installfailing withERR_PNPM_CMD_SHIM_RESOLVE_PATHwhen an executable's parent directory contains a dangling symlink.pnpm install --frozen-lockfileno longer fails withERR_PNPM_RESOLUTION_SHAPE_MISMATCHwhen aname@versionlockfile entry has a resolution served by a custom fetcher pnpm/tasks#108.pnpm install --fix-lockfilerepairs a lockfile whose importer references a package that has no snapshot entry, as left by a badly merged lockfile. It failed withERR_PNPM_LOCKFILE_MISSING_DEPENDENCYsince 12.8.0 #16618.When a dependency moves an exact dependency of its own to an older version, a peer dependency that pnpm installed automatically now moves with it. Before,
pnpm installandpnpm dedupekept the newer locked version of the peer, so the lockfile held two copies of it, for example two copies ofvuepnpm/tasks#61.pnpm dedupenow reads registry metadata for a dependency pinned to an exact version, aspnpm installdoes. If the registry metadata disagreed with the package'spackage.json, the lockfile it wrote depended on whetherminimumReleaseAgewas set #16615.Speed and size
Dependency resolution reads cached registry metadata faster. The metadata cache moved to
<cache-dir>/v12/, so the first install after upgrading downloads registry metadata again. A damaged cache entry is downloaded again, or reported as an error when--offlineis set.pnpm cache prunealso removes the metadata cache that older pnpm versions wrote under<cache-dir>/v11/#13512.Package metadata requests no longer wait behind queued tarball downloads when
maxSocketsor a proxy limits the connections to a registry. Large installs resolve faster and print fewerRequest tookwarnings.Sped up installs in large workspaces on macOS when the dependency links already exist. pnpm now keeps a link that already points at the right package without trying to create it first. Relinking the direct dependencies of 1,000 workspace projects took 45 ms, down from 116 ms pnpm/tasks#65.
Commands in a project that pins a different pnpm version start about 13 ms faster on macOS. pnpm now runs the pinned version's binary directly, without the shell script in front of it pnpm/tasks#66.
The pnpm binary is about 0.9 MB smaller, and the arm64 Linux binary is about 1 MB smaller still.
Running scripts and commands
pnpm runno longer prints[ELIFECYCLE] Command failed ...after Ctrl+C ends the script. pnpm still exits the way the script's shell did: on Windows with the shell's exit code (cmdreports-1073741510, PowerShell1), on Unix by re-raisingSIGINT#16579.pnpm run "/<regex>/"now accepts JavaScript regular expression syntax such as lookahead and lookbehind. A selector like"/^hello:(?!b).*$/"failed withERR_PNPM_NO_SCRIPT#16604.pnpm runandpnpm execnow forward--config.*command-line flags to the install started byverifyDepsBeforeRunpnpm/tasks#60.On Windows, a process started by
pnpm runorpnpm execcan again start a child withCREATE_BREAKAWAY_FROM_JOB. That child keeps running after pnpm exits, even if the command fails #16628.Empty
nodeOptionsvalues from command-line flags and environment variables now override lower-priority settings. Scripts retainNODE_OPTIONSfrom the parent environment orextraEnvwhennodeOptionsis empty.pnpm now reads the
failIfNoMatchsetting frompnpm-workspace.yaml, so a filter that matches no workspace project exits with code 1 when the setting istrue. The new--no-fail-if-no-matchflag turns the setting off for one command #16577.Configuration, setup, and pnpm versions
pnpm config get --globalandpnpm config list --globalnow show only the global configuration, also when run inside a project. Settings from the project'spnpm-workspace.yamland.npmrcwere included before. The same applies to--location=global#16598.pnpm now prints config warnings, such as an unset environment variable in
.npmrc, when loading the config fails.pnpm 11 releases older than 11.28.4 can run pnpm 12 again when the
packageManagerfield pins it. Since 12.9.0 they failed withSyntaxError: Invalid or unexpected token#16594.On Windows,
pnpm self-updateno longer runs the update a second time when it replaces apnpm.cmdlinked by pnpm 12.8 or older. cmd.exe read on in the replacedpnpm.cmd, printed an error about a command that is not recognized, and ran the new pnpm once more #16573.pnpm setupnow puts$PNPM_HOME/binfirst onPATHin login shells that inherited it further down, such as the VS Code terminal on macOS. Before, anothernodetook precedence over the one installed bypnpm runtime set node -g. Runpnpm setupagain to update the block in your shell config #16635.pnpm setupnow names the shell config file even if it is already up to date #16608.Updating, auditing, and publishing
pnpm update --latestnow applies thesavePrefixsetting when it rewrites a dependency whose range has no operator of its own, such as<2.0.0.The interactive
pnpm audit --fixpicker now shows each patched version with thesaveExactandsavePrefixstyle that the override is written with #13209.pnpm unpublish <pkg>@<version>now deletes the tarball under the registry's path when the registry is served under one, such as Gitea's npm registry. It used to send the delete to the host root and report success without removing the version #16568. It also no longer mistakes a sibling path such as/npm-mirror/for the registry path/npm/pnpm/tasks#94.Output and messages
A warning about a project's
devEnginesorpackageManagerpin is now printed to stderr. A command such aspnpm cache pathorpnpm list --jsonkeeps only its own output on stdout #16584.pnpm listnow reports the correct package paths whennodeLinkerishoisted#9593.Resolution errors now name the failing dependency and its parent packages. Fatal errors appear as structured error records with their error codes when using
--reporter=ndjson.The error for an invalid git repository in the lockfile now has the code
ERR_PNPM_INVALID_GIT_REPOSITORY. Its message now lists every rejected form of the value.pnpm runtime --helpandpnpm help runtimenow name thesetsubcommand and the runtimes it accepts #16580.Platinum Sponsors
Gold Sponsors
v12.9.1: pnpm 12.9.1Compare Source
This release moves the WebContainer build into a separate
@pnpm/wasmpackage, shrinks thepnpmpackage back to about 4 MB, and fixespnpm publishwith provenance from GitLab CI.Patch Changes
The WebAssembly build for StackBlitz WebContainers now ships as a separate
@pnpm/wasmpackage. Thepnpmand@pnpm/exepackages no longer include it, which brings their unpacked size back from about 55 MB to about 4 MB. In a WebContainer, install@pnpm/wasmwith npm to get thepnpmcommand.pnpm publishwith provenance from GitLab CI is no longer rejected by the npm registry with a 422 error. The provenance statement now includes the GitLab CI variables ininvocation.parameters, as npm does #16551.pnpm audit signaturesnow uses the TLS settings of the redirect target when a registry redirects its signing-keys request, for example to registry.npmjs.org. Acafilescoped to a private registry no longer makes the redirected request fail #16541.Fixed
pnpm install --frozen-lockfilerejecting an up-to-date lockfile when an injected workspace package uses a catalog entry inpeerDependencies#16557.The
[<since>]filter selector works again with Git 2.24 through 2.27 #16561. With Git older than 2.24, the selector now fails with an error that names the required Git version.It also detects changes in projects whose directory names contain non-ASCII characters. Such a change used to be credited to the parent project.
changedFilesIgnorePatternandtestPatternnow match changed files whose names contain non-ASCII characters.The
pnpmexecutable is about 10% smaller. On macOS arm64 it went from 45.1 MB to 40.3 MB.Sped up trust downgrade checks for packages with long release histories.
With
optimisticRepeatInstall: false,pnpm installnow runs the projects' own lifecycle scripts, such asprepare, even whennode_modulesis already up to date #16545.pnpm self-updatenow fails for Homebrew-installed pnpm and prints thebrew upgradecommand for the installed formula, such asbrew upgrade pnpmorbrew upgrade pnpm@11. It used to install a second copy of pnpm that the Homebrew one kept shadowing #16547.Platinum Sponsors
Gold Sponsors
v12.9.0: pnpm 12.9Compare Source
This release runs pnpm in StackBlitz WebContainers, adds a per-registry
networkConcurrencysetting, and records every installed project in the store. It also carries a security fix forpnpm login.Minor Changes
pnpm now automatically uses WebAssembly in StackBlitz WebContainers, including when installation scripts are disabled. Native installations continue to use the native executable when installation scripts are enabled.
A
registriesentry can now setnetworkConcurrency, the most requests pnpm keeps in flight to that registry's origin. Requests to other registries keep the overall limit. The setting may live inpnpm-workspace.yamlor the globalconfig.yaml.pnpm installnow records every project it installs in the store'sprojectsdirectory, as a symlink to the project directory. A--frozen-storeinstall without the global virtual store still records nothing. Only projects that used the global virtual store were recorded before #6929.Patch Changes
pnpm loginno longer forwards credentials in its request body to another origin during redirects.Installing packages
Fixed
pnpm installfailing on Android withERR_PNPM_STORE_DIR_ACQUIRE_OPERATION_LOCK#16508.pnpm install --frozen-lockfileagain succeeds when a workspace project recorded inpnpm-lock.yamlhas no directory, such as a project left out of a Docker build context. It still fails if the project's directory exists without apackage.json#16453.pnpm install --frozen-lockfileno longer requires apnpm-lock.yamlin a project that has no dependencies. It also succeeds whenpnpm-lock.yamlrecords only the pinned pnpm version, as other commands write it when they run before the first install #16477.Fixed
pnpm install --frozen-lockfilerejecting a fresh lockfile when an injected workspace dependency has an optional peer supplied by another workspace project #16428.With
nodeLinker: hoisted, a filtered install now keeps the packages of the workspace projects an earlier install put innode_modules. This also covers the install thatpnpm --filter <selector> runandpnpm --filter <selector> execstart before the command. Before, these installs removed every package that only the unselected projects needed #16483.pnpm installwithnodeLinker: hoistednow refreshes directories supplied by custom fetchers when reinstalling. pnpm also keeps the symlinks inside those directories.With
enableGlobalVirtualStoreon, scripts can run entry points that a CommonJS require hook loads again, such asts-node index.ts. They failed withERR_UNKNOWN_FILE_EXTENSIONon Node.js versions without built-in TypeScript support #16436.pnpm now keeps each project's current lockfile and hidden hoisted dependencies in its own
node_modules/.pnpmwhenvirtualStoreDirpoints at a shared global virtual store.--virtual-store-dirnow sets the global virtual store's location too pnpm/tasks#47.pnpm cleanno longer deletes the project whenvirtualStoreDirorglobalVirtualStoreDiris set to the project directory. It also leaves a directory outside the project alone when the setting reaches it through a symlink. It now removes a global virtual store thatglobalVirtualStoreDirplaces inside the project, as it does forvirtualStoreDir.Optional dependencies
pnpm installno longer fails when a dependency of an optional dependency is missing from the registry. Like npm, pnpm now leaves out the nearest optional dependency above it, together with its subtree #16511.When an optional dependency fails to build, pnpm now removes its link from
node_modules. A repeatpnpm installthen reports "Already up to date" and no longer reruns the failing build #16468.pnpm installnow prints a warning with the error when an optional dependency cannot be fetched and is skipped. The skipped package is no longer counted in thePackages: +Nsummary. Thepnpm:skipped-optional-dependencylog reports the skip with thefetch_failurereason #16514.Resolving dependencies
pnpm installchanging an unchanged project's direct dependency to a siblingConfiguration
📅 Schedule: (in timezone America/Havana)
* 17-23,0-6 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.