build(deps): bump the dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #1621 · box-project/box

dependabot · 2026-04-20T06:13:56Z

Bumps the dependencies group with 6 updates in the /.github/workflows directory:

Package	From	To
docker/login-action	`4.0.0`	`4.1.0`
docker/build-push-action	`7.0.0`	`7.1.0`
actions/cache	`5.0.4`	`5.0.5`
dawidd6/action-download-artifact	`19`	`20`
softprops/action-gh-release	`2.6.1`	`3.0.0`
peter-evans/create-pull-request	`8.1.0`	`8.1.1`

Updates docker/login-action from 4.0.0 to 4.1.0

Release notes

Sourced from docker/login-action's releases.

v4.1.0

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in docker/login-action#945

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in docker/login-action#930

Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in docker/login-action#932 docker/login-action#936

Bump brace-expansion from 1.1.12 to 1.1.13 in docker/login-action#952

Bump fast-xml-parser from 5.3.4 to 5.3.6 in docker/login-action#942

Bump flatted from 3.3.3 to 3.4.2 in docker/login-action#944

Bump glob from 10.3.12 to 10.5.0 in docker/login-action#940

Bump handlebars from 4.7.8 to 4.7.9 in docker/login-action#949

Bump http-proxy-agent and https-proxy-agent to 8.0.0 in docker/login-action#937

Bump lodash from 4.17.23 to 4.18.1 in docker/login-action#958

Bump minimatch from 3.1.2 to 3.1.5 in docker/login-action#941

Bump picomatch from 4.0.3 to 4.0.4 in docker/login-action#948

Bump undici from 6.23.0 to 6.24.1 in docker/login-action#938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

Commits

4907a6d Merge pull request #930 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
1e233e6 chore: update generated content
6c24ead build(deps): bump the aws-sdk-dependencies group with 2 updates
ee034d7 Merge pull request #958 from docker/dependabot/npm_and_yarn/lodash-4.18.1
1527209 Merge pull request #937 from docker/dependabot/npm_and_yarn/proxy-agent-depen...
d39362a build(deps): bump lodash from 4.17.23 to 4.18.1
a6f092b chore: update generated content
60953f0 build(deps): bump the proxy-agent-dependencies group with 2 updates
62c6885 Merge pull request #936 from docker/dependabot/npm_and_yarn/docker/actions-to...
102c0e6 chore: update generated content
Additional commits viewable in compare view

Updates docker/build-push-action from 7.0.0 to 7.1.0

Release notes

Sourced from docker/build-push-action's releases.

v7.1.0

Git context query format support by @crazy-max in docker/build-push-action#1505

Bump @docker/actions-toolkit from 0.79.0 to 0.87.0 by @crazy-max in docker/build-push-action#1505

Bump brace-expansion from 1.1.12 to 1.1.13 in docker/build-push-action#1500

Bump fast-xml-parser from 5.4.2 to 5.5.7 in docker/build-push-action#1489

Bump flatted from 3.3.3 to 3.4.2 in docker/build-push-action#1491

Bump glob from 10.3.12 to 10.5.0 in docker/build-push-action#1490

Bump handlebars from 4.7.8 to 4.7.9 in docker/build-push-action#1497

Bump lodash from 4.17.23 to 4.18.1 in docker/build-push-action#1510

Bump picomatch from 4.0.3 to 4.0.4 in docker/build-push-action#1496

Bump undici from 6.23.0 to 6.24.1 in docker/build-push-action#1486

Bump vite from 7.3.1 to 7.3.2 in docker/build-push-action#1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

Commits

bcafcac Merge pull request #1509 from docker/dependabot/npm_and_yarn/vite-7.3.2
18e62f1 Merge pull request #1510 from docker/dependabot/npm_and_yarn/lodash-4.18.1
46580d2 chore: update generated content
3f80b25 chore(deps): Bump lodash from 4.17.23 to 4.18.1
efeec95 Merge pull request #1505 from crazy-max/refactor-git-context
ddf04b0 Merge pull request #1511 from docker/dependabot/github_actions/crazy-max-dot-...
db08d97 chore(deps): Bump the crazy-max-dot-github group with 2 updates
ef1fb96 Merge pull request #1508 from docker/dependabot/github_actions/docker/login-a...
2d8f2a1 chore: update generated content
919ac7b fix test since secrets are not written to temp path anymore
Additional commits viewable in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
See full diff in compare view

Updates dawidd6/action-download-artifact from 19 to 20

Release notes

Sourced from dawidd6/action-download-artifact's releases.

v20

What's Changed

build(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by @dependabot[bot] in dawidd6/action-download-artifact#387

node_modules: update by @dawidd6 in dawidd6/action-download-artifact#388

build(deps): bump filesize from 11.0.13 to 11.0.14 by @dependabot[bot] in dawidd6/action-download-artifact#389

build(deps): bump brace-expansion by @dependabot[bot] in dawidd6/action-download-artifact#390

node_modules: update by @dawidd6 in dawidd6/action-download-artifact#391

build(deps): bump filesize from 11.0.14 to 11.0.15 by @dependabot[bot] in dawidd6/action-download-artifact#392

build(deps): bump adm-zip from 0.5.16 to 0.5.17 by @dependabot[bot] in dawidd6/action-download-artifact#393

build(deps): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in dawidd6/action-download-artifact#394

node_modules: update by @dawidd6 in dawidd6/action-download-artifact#395

Full Changelog: dawidd6/action-download-artifact@v19...v20

Commits

8305c0f node_modules: update (#395)
542af03 build(deps): bump lodash from 4.17.23 to 4.18.1 (#394)
1553221 build(deps): bump adm-zip from 0.5.16 to 0.5.17 (#393)
905d0ae build(deps): bump filesize from 11.0.14 to 11.0.15 (#392)
6fc03d0 node_modules: update (#391)
c468997 build(deps): bump brace-expansion (#390)
bad68a5 build(deps): bump filesize from 11.0.13 to 11.0.14 (#389)
cdf23fa node_modules: update (#388)
225d1f6 build(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 (#387)
See full diff in compare view

Updates softprops/action-gh-release from 2.6.1 to 3.0.0

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

Move the action runtime and bundle target to Node 24

Update @types/node to the Node 24 line and allow future Dependabot updates

Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in softprops/action-gh-release#775

chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by @dependabot[bot] in softprops/action-gh-release#777

chore(deps): bump vite from 8.0.0 to 8.0.5 by @dependabot[bot] in softprops/action-gh-release#781

Full Changelog: softprops/action-gh-release@v2...v2.6.2

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

Move the action runtime and bundle target to Node 24

Update @types/node to the Node 24 line and allow future Dependabot updates

Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

2.6.2

What's Changed

Other Changes 🔄

chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in softprops/action-gh-release#775

chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by @dependabot[bot] in softprops/action-gh-release#777

chore(deps): bump vite from 8.0.0 to 8.0.5 by @dependabot[bot] in softprops/action-gh-release#781

2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

fix: preserve discussion category on publish by @chenrui333 in softprops/action-gh-release#765

2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Commits

b430933 release: cut v3.0.0 for Node 24 upgrade (#670)
c2e35e0 chore(deps): bump the npm group across 1 directory with 7 updates (#783)
3bb1273 release 2.6.2
c34030f chore: bump node to 24.14.1
8975bd0 chore(deps): bump vite from 8.0.0 to 8.0.5 (#781)
f71937f chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 (#777)
3f0d239 chore(deps): bump picomatch from 4.0.3 to 4.0.4 (#775)
See full diff in compare view

Updates peter-evans/create-pull-request from 8.1.0 to 8.1.1

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.1.1

What's Changed

build(deps-dev): bump the npm group with 2 updates by @dependabot[bot] in peter-evans/create-pull-request#4305

build(deps): bump minimatch by @dependabot[bot] in peter-evans/create-pull-request#4311

build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in peter-evans/create-pull-request#4316

build(deps): bump @tootallnate/once and jest-environment-jsdom by @dependabot[bot] in peter-evans/create-pull-request#4323

build(deps-dev): bump undici from 6.23.0 to 6.24.0 by @dependabot[bot] in peter-evans/create-pull-request#4328

build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in peter-evans/create-pull-request#4334

build(deps): bump picomatch by @dependabot[bot] in peter-evans/create-pull-request#4339

build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in peter-evans/create-pull-request#4344

build(deps-dev): bump the npm group with 3 updates by @dependabot[bot] in peter-evans/create-pull-request#4349

fix: retry post-creation API calls on 422 eventual consistency errors by @peter-evans in peter-evans/create-pull-request#4356

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

Commits

5f6978f fix: retry post-creation API calls on 422 eventual consistency errors (#4356)
d32e88d build(deps-dev): bump the npm group with 3 updates (#4349)
8170bcc build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)
0041819 build(deps): bump picomatch (#4339)
b993918 build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)
36d7c84 build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)
a45d1fb build(deps): bump @tootallnate/once and jest-environment-jsdom (#4323)
3499eb6 build(deps): bump the github-actions group with 2 updates (#4316)
3f3b473 build(deps): bump minimatch (#4311)
6699836 build(deps-dev): bump the npm group with 2 updates (#4305)
See full diff in compare view

…dates Bumps the dependencies group with 6 updates in the /.github/workflows directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.0.0` | `4.1.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.0.0` | `7.1.0` | | [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` | | [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) | `19` | `20` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.1` | `3.0.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` | Updates `docker/login-action` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@b45d80f...4907a6d) Updates `docker/build-push-action` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@d08e5c3...bcafcac) Updates `actions/cache` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@6682284...27d5ce7) Updates `dawidd6/action-download-artifact` from 19 to 20 - [Release notes](https://github.com/dawidd6/action-download-artifact/releases) - [Commits](dawidd6/action-download-artifact@8a33849...8305c0f) Updates `softprops/action-gh-release` from 2.6.1 to 3.0.0 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@153bb8e...b430933) Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@c0f553f...5f6978f) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: dawidd6/action-download-artifact dependency-version: '20' dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: docker/build-push-action dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: docker/login-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: softprops/action-gh-release dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-04T06:30:42Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 20, 2026

dependabot Bot force-pushed the dependabot/github_actions/dot-github/workflows/dependencies-b9287d8360 branch from 4e8d950 to eea49b5 Compare April 27, 2026 06:21

dependabot Bot closed this May 4, 2026

dependabot Bot deleted the dependabot/github_actions/dot-github/workflows/dependencies-b9287d8360 branch May 4, 2026 06:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the dependencies group across 1 directory with 6 updates#1621

build(deps): bump the dependencies group across 1 directory with 6 updates#1621
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/dependencies-b9287d8360

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.1.0

v7.1.0

v5.0.5

What's Changed

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

v20

What's Changed

v3.0.0

What's Changed

Other Changes 🔄

v2.6.2

What's Changed

Other Changes 🔄

3.0.0

What's Changed

Other Changes 🔄

2.6.2

What's Changed

Other Changes 🔄

2.6.1

What's Changed

Bug fixes 🐛

2.6.0

What's Changed

Create Pull Request v8.1.1

What's Changed

Uh oh!

dependabot Bot commented on behalf of github May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading