chore(deps): bump the actions group across 1 directory with 11 updates by dependabot[bot] · Pull Request #29 · hyperpolymath/FirmwareAudit.jl

dependabot · 2026-09-14T09:28:26Z

Bumps the actions group with 11 updates in the / directory:

Package	From	To
actions/checkout	`4.1.1`	`7.0.1`
haskell-actions/setup	`2.7.5`	`2.12.0`
actions/cache	`4.3.0`	`6.1.0`
actions/configure-pages	`5.0.0`	`6.0.0`
actions/upload-pages-artifact	`3.0.1`	`5.0.0`
actions/deploy-pages	`4.0.5`	`5.0.1`
julia-actions/setup-julia	`2.7.0`	`3.0.2`
julia-actions/cache	`3.0.0`	`3.3.0`
webfactory/ssh-agent	`0.9.1`	`0.10.0`
dtolnay/rust-toolchain	`efa25f7f19611383d5b0ccf2d1c8914531636bf9`	`02cb101ec7c40f2c49e1d9714d64511d8e1b74de`
hyperpolymath/smtp-notify-action	`0.2.0`	`0.3.0`

Updates actions/checkout from 4.1.1 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates haskell-actions/setup from 2.7.5 to 2.12.0

Release notes

Sourced from haskell-actions/setup's releases.

v2.11.0

GHC: try ghcup first, choco only as fallback

What's Changed

Add GHC 9.12.4 and Stack 3.9.3 by @andreasabel in haskell-actions/setup#142

Bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in haskell-actions/setup#143

GHC: try ghcup first, choco only as fallback by @andreasabel in haskell-actions/setup#144

Full Changelog: haskell-actions/setup@v2.10.3...v2.11.0

v2.10.4

Add GHC 9.12.4 and Stack 3.9.3

What's Changed

Add GHC 9.12.4 and Stack 3.9.3 by @andreasabel in haskell-actions/setup#142

Full Changelog: haskell-actions/setup@v2.10.3...v2.10.4

v2.10.3

Add Stack 3.9.1

What's Changed

Add Stack 3.9.1 by @andreasabel in haskell-actions/setup#138

Full Changelog: haskell-actions/setup@v2.10.2...v2.10.3

v2.10.2

Remove GHCup vanilla channel from defaults

What's Changed

Remove GHCup vanilla channel from defaults by @andreasabel in haskell-actions/setup#137

Full Changelog: haskell-actions/setup@v2.10.1...v2.10.2

... (truncated)

Commits

6037f33 fix: parseYAMLBoolean for enable-stack/stack-no-global/stack-setup-ghc/disabl...
d07e232 fix: bump bundled ghcup from 0.1.50.2 to 0.2.6.2
5873697 Bump actions/setup-node from 6 to 7
482af4f Bump actions/checkout from 6 to 7
cd0d9bd GHC: try ghcup first, choco only as fallback
4568e64 Bump softprops/action-gh-release from 2 to 3
de26526 Add GHC 9.12.4 and Stack 3.9.3
f9150cb Add Stack 3.9.1
dc63c94 Remove GHCup vanilla channel from defaults
7786314 await addGhcupReleaseChannel
Additional commits viewable in compare view

Updates actions/cache from 4.3.0 to 6.1.0

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

Bump @actions/cache to v6.1.0 - handle read-only cache access by @jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Update packages, migrate to ESM by @Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Bump @actions/cache to v5.1.0 - handle read-only cache access by @jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token

Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2

Migrated to ESM module system

Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

55cc834 Merge pull request #1768 from jasongin/readonly-cache
d8cd72f Bump @actions/cache to v6.1.0 - handle cache write error due to RO token
2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
e9b91fd Prettier fixes
e4884b8 Rebuild dist
10baf01 Fixed licenses
e39b386 Fix test mock return order
b692820 PR feedback
6074912 Rebuild dist bundles as ESM to match type:module
5a912e8 Fix lint and jest issues
Additional commits viewable in compare view

Updates actions/configure-pages from 5.0.0 to 6.0.0

Release notes

Sourced from actions/configure-pages's releases.

v6.0.0

Changelog

upgrade to node 24 @salmanmkc (#186)

Upgrade IA Publish @Jcambass (#165)

Add workflow file for publishing releases to immutable action package @Jcambass (#163)

pin draft release version @YiMysty (#162)

Bump espree from 9.6.1 to 10.1.0 @dependabot (#160)

Bump eslint-config-prettier from 8.8.0 to 9.1.0 @dependabot (#143)

Be more friendly to Dependabot @yoannchaudet (#158)

Bump eslint-plugin-github from 4.10.2 to 5.0.1 @dependabot (#154)

Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group @dependabot (#156)

Bump undici from 5.28.3 to 5.28.4 @dependabot (#145)

See details of all code changes since previous release.

Commits

45bfe01 Merge pull request #186 from salmanmkc/node24
d8770c2 Update Node version from 20 to 24 in action.yml
cb8a1a3 upgrade to node 24
d560657 Merge pull request #165 from actions/Jcambass-patch-1
35e0ac4 Upgrade IA Publish
1dfbcbf Merge pull request #163 from actions/Jcambass-patch-1
2f4f988 Add workflow file for publishing releases to immutable action package
0d7570c Merge pull request #162 from actions/pin-draft-release-verssion
3ea1966 pin draft release version
aabcbc4 Merge pull request #160 from actions/dependabot/npm_and_yarn/espree-10.1.0
Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 3.0.1 to 5.0.0

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

Update upload-artifact action to version 7 @Tom-van-Woudenberg (#139)

feat: add include-hidden-files input @jonchurch (#137)

See details of all code changes since previous release.

v4.0.0

What's Changed

Potentially breaking change: hidden files (specifically dotfiles) will not be included in the artifact by @tsusdere in actions/upload-pages-artifact#102 If you need to include dotfiles in your artifact: instead of using this action, create your own artifact according to these requirements https://github.com/actions/upload-pages-artifact?tab=readme-ov-file#artifact-validation

Pin actions/upload-artifact to SHA by @heavymachinery in actions/upload-pages-artifact#127

Full Changelog: actions/upload-pages-artifact@v3.0.1...v4.0.0

Commits

fc324d3 Merge pull request #139 from Tom-van-Woudenberg/patch-1
fe9d4b7 Merge branch 'main' into patch-1
0ca1617 Merge pull request #137 from jonchurch/include-hidden-files
57f0e84 Update action.yml
4a90348 v7 --> hash
56f665a Update upload-artifact action to version 7
f7615f5 Add include-hidden-files input
7b1f4a7 Merge pull request #127 from heavymachinery/pin-sha
4cc19c7 Pin actions/upload-artifact to SHA
2d163be Merge pull request #107 from KittyChiu/main
Additional commits viewable in compare view

Updates actions/deploy-pages from 4.0.5 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

Add backoff and jitter to deployment polling @yoannchaudet (#444)

Improve deployment request test coverage @adwitiyagoyal (#440)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

v5.0.0

Changelog

Update Node.js version to 24.x @salmanmkc (#404)

Add workflow file for publishing releases to immutable action package @Jcambass (#374)

Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory @dependabot (#360)

Make the rebuild dist workflow work nicer with Dependabot @yoannchaudet (#361)

Bump the non-breaking-changes group across 1 directory with 3 updates @dependabot (#358)

Delete repeated sentence @garethsb (#359)

Update README.md @tsusdere (#348)

Bump the non-breaking-changes group with 4 updates @dependabot (#341)

Remove error message for file permissions @TooManyBees (#340)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
7e97763 Validate deployment polling intervals
0143e11 Add backoff and jitter to deployment polling
5e98f10 Merge pull request #440 from actions/user/adwitiya
8b0625a Improve deployment request test coverage
cd2ce8f Merge pull request #404 from salmanmkc/node24
bbe2a95 Update Node.js version to 24.x
854d7aa Merge pull request #374 from actions/Jcambass-patch-1
306bb81 Add workflow file for publishing releases to immutable action package
b742728 Merge pull request #360 from actions/dependabot/npm_and_yarn/npm_and_yarn-513...
Additional commits viewable in compare view

Updates julia-actions/setup-julia from 2.7.0 to 3.0.2

Release notes

Sourced from julia-actions/setup-julia's releases.

v3.0.2

What's Changed

We fixed a bug (#389).

We also updated our documentation, and we updated a CI dependency.

New Contributors

@krynju made their first contribution in julia-actions/setup-julia#389

Full Changelog

Full Changelog: julia-actions/setup-julia@v3.0.1...v3.0.2

v3.0.1

What's Changed

This is a bugfix release that fixes an error seen when using min-minor or min-patch.

Full Changelog

Full Changelog: julia-actions/setup-julia@v3.0.0...v3.0.1

v3.0.0

⚠️ Breaking Changes, and Migration Guide for v2 ⟶ v3

v3 requires Node 24 (compared to v2, which required Node 20).

The behavior of version: min has changed between v2 and v3.

In v2, version: min would resolve to the minimum major/minor/patch, e.g. 1.10.0.

In v3, version: min resolves to the minimum major/minor but the latest patch, e.g. 1.10.11.

If you specifically want the minimum major/minor/patch under v3, you should specify version: min-patch. Note: v3 also adds the alias version: min-minor, which is equivalent to version: min.

v3 will throw an error if x86_64 Julia binaries are requested on Apple Silicon macOS. (Under v2, this was a warning.) Under v3, if you specifically want to run x86_64 Julia binaries on Apple Silicon (under Rosetta 2), you must now opt-in by specifying the force-arch: true input.

Other Changes

We updated some dependencies, and we improved and updated the CI tooling on this repo.

Full Changelog

Full Changelog: julia-actions/setup-julia@v2.7.0...v3.0.0

Commits

fa02766 Bug fix: Validate cached julia binary exists and check PATH resolution (#389)
ff78161 Bump julia-actions/setup-julia from 2.7.0 to 3.0.1 in the all-github-actions ...
fe02cb7 README: Add a link to the v2-to-v3 release notes (#388)
f6f565d Bugfix: Fix an error seen when using min-minor or min-patch (#387)
4a12c5f Breaking: Change min to return the latest patch (but still the minimum majo...
a8c65a2 Bump the all-github-actions group across 1 directory with 2 updates (#381)
92d77f5 Bump picomatch from 2.3.1 to 2.3.2 (#379)
679f144 Bump handlebars from 4.7.8 to 4.7.9 (#377)
7c976c8 Add workflow to run make everything-from-scratch (#378)
101e139 Breaking: Migrate from Node 20 to Node 24 (#374)
Additional commits viewable in compare view

Updates julia-actions/cache from 3.0.0 to 3.3.0

Release notes

Sourced from julia-actions/cache's releases.

v3.3.0

What's Changed

We migrated this action from JavaScript to TypeScript. Users should not notice any difference.

We also updated some dependencies.

Full Changelog

Full Changelog: julia-actions/cache@v3.2.0...v3.3.0

v3.2.0

New Features

Stream tar archives directly to/from GCP storage without intermediate files by @wsmoses in julia-actions/cache#245

Add option to use (multithreaded) zstd for gcp by @wsmoses in julia-actions/cache#244

Add optional prefix for uploads by @wsmoses in julia-actions/cache#246

Other changes

We updated some dependencies (JavaScript and CI).

We implemented a 7-day dependency cooldown for our dependencies.

We updated our docs.

New Contributors

@JJ made their first contribution in julia-actions/cache#228

@DilumAluthge-LLM made their first contribution in julia-actions/cache#232

Full Changelog

Full Changelog: julia-actions/cache@v3.1.0...v3.2.0

v3.1.0

What's Changed

New feature: We added support for Google Cloud Platform (julia-actions/cache#204).

We also updated some dependencies.

New Contributors

@wsmoses made their first contribution in julia-actions/cache#204

Full Changelog

Full Changelog: julia-actions/cache@v3.0.2...v3.1.0

v3.0.2

What's Changed

... (truncated)

Commits

a7bed9d Update some NPM dependencies (#257)
56d8125 Migrate from JavaScript to TypeScript (#248)
fcb41b5 Bump brace-expansion from 1.1.13 to 1.1.18 (#256)
592ca37 .gitattributes: Hide generated JS code from diffs and language stats (#253)
eb70237 Bump actions/checkout from 7.0.0 to 7.0.1 (#249)
d3af421 Bump actions/setup-node from 6.4.0 to 7.0.0 (#250)
b7788ab Add optional prefix for uploads (#246)
3208dfc Add option to use (multithreaded) zstd for gcp (#244)
f6f2182 Stream tar archives directly to/from GCP storage without intermediate files (...
8020c5e Bump @google-cloud/storage from 7.19.0 to 7.21.0 (#240)
Additional commits viewable in compare view

Updates webfactory/ssh-agent from 0.9.1 to 0.10.0

Release notes

Sourced from webfactory/ssh-agent's releases.

v0.10.0: Upgrade to node-24

This release upgrades from node 20 to node 24, preparing for Node 20's upcoming EOL and getting rid of the related warning message in GitHub.

What's Changed

use node24 by @jimmymcpeter in webfactory/ssh-agent#243

New Contributors

@jimmymcpeter made their first contribution in webfactory/ssh-agent#243

Full Changelog: webfactory/ssh-agent@v0.9.1...v0.10.0

Commits

e838748 use node24 (#243)
See full diff in compare view

Updates dtolnay/rust-toolchain from efa25f7f19611383d5b0ccf2d1c8914531636bf9 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

Commits

02cb101 Merge pull request 185 from fufesou/feat/force-non-host
b38a663 Pass --force-non-host unconditionally
a4f61a0 Document rustup non-host opt-in requirement
06b350f Support force-non-host toolchains
d103106 Predefine branches up to 1.120
3ea7b2d Add 1.98.1 patch release
6c977a6 Merge pull request #182 from dtolnay/name
f3510ff Render better step names
2c7215f Add 1.97.1 patch release
fa04a14 Add 1.96.1 patch release
Additional commits viewable in compare view

Updates hyperpolymath/smtp-notify-action from 0.2.0 to 0.3.0

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.3.0

Static, byte-reproducible smtp-notify binaries. CI rebuilt them from this tag and verified they hash to exactly the SHA-256 pins inside this tag's action.yml before publishing.

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

// SPDX-License-Identifier: MPL-2.0 = Changelog :toc: macro :toclevels: 2

All notable changes to this action are recorded here. The format follows https://keepachangelog.com/en/1.1.0/[Keep a Changelog]; versions follow https://semver.org/spec/v2.0.0.html[Semantic Versioning].

The unit of release is the action ref: the tag or commit you pin determines both action.yml and, through the SHA-256 pins inside it, the exact binary that runs.

toc::[]

== v0.3.0 — 2026-09-09

[IMPORTANT]

main is not a release, and pinning @main is not supported.

Between a release commit landing on main and its tag being pushed, action.yml on main names assets that do not exist yet, so @main fails at the download step. This window is unavoidable rather than an oversight: the release workflow refuses to publish unless the asset URL in the tagged commit already names the tag being released, so the commit must precede the tag. The window is minutes long and is one more reason @main is not a supported ref.

Pin a tag, or a commit SHA that is an ancestor of one.

=== Added

STARTTLS on the submission port. secure: false or secure: starttls now starts in the clear on port 587 and upgrades the same connection in place per RFC 3207, including the mandatory second EHLO after the upgrade. The upgrade is not opportunistic: a server that does not advertise STARTTLS fails the step, and that check runs before the command is sent, so no credential is ever written to a cleartext stream. Certificate verification is identical on both TLS paths.

EHLO capability parsing (issue #9). The EHLO reply is parsed into a Capabilities value — STARTTLS, the AUTH mechanism list (including the Exchange AUTH=LOGIN spelling), SIZE and 8BITMIME — and an AUTH failure now names what the server actually advertised. A mechanism mismatch and a wrong password no longer look alike in the log.

The proven state machine now carries two tables, selected by transport, each proven separately: the implicit-TLS table is proven to contain no upgrade rows, and the STARTTLS table is proven to reach them from the start state. A row that is present but unreachable would have authenticated in the clear while every prior proof stayed green.

AUTH LOGIN, and mechanism selection (issue #10). The mechanism is chosen

... (truncated)

Commits

22e7bdb release: v0.3.0 — action.yml fetches the STARTTLS binaries
11c4ba9 feat: reach Microsoft 365 and Google Workspace on the submission port (STARTT...
See full diff in compare view

Dependabot will...

Description has been truncated

Bumps the actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.1.1` | `7.0.1` | | [haskell-actions/setup](https://github.com/haskell-actions/setup) | `2.7.5` | `2.12.0` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` | | [actions/configure-pages](https://github.com/actions/configure-pages) | `5.0.0` | `6.0.0` | | [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3.0.1` | `5.0.0` | | [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4.0.5` | `5.0.1` | | [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia) | `2.7.0` | `3.0.2` | | [julia-actions/cache](https://github.com/julia-actions/cache) | `3.0.0` | `3.3.0` | | [webfactory/ssh-agent](https://github.com/webfactory/ssh-agent) | `0.9.1` | `0.10.0` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `efa25f7f19611383d5b0ccf2d1c8914531636bf9` | `02cb101ec7c40f2c49e1d9714d64511d8e1b74de` | | [hyperpolymath/smtp-notify-action](https://github.com/hyperpolymath/smtp-notify-action) | `0.2.0` | `0.3.0` | Updates `actions/checkout` from 4.1.1 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.1.1...3d3c42e) Updates `haskell-actions/setup` from 2.7.5 to 2.12.0 - [Release notes](https://github.com/haskell-actions/setup/releases) - [Commits](haskell-actions/setup@ec49483...6037f33) Updates `actions/cache` from 4.3.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...55cc834) Updates `actions/configure-pages` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/configure-pages/releases) - [Commits](actions/configure-pages@983d773...45bfe01) Updates `actions/upload-pages-artifact` from 3.0.1 to 5.0.0 - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](actions/upload-pages-artifact@56afc60...fc324d3) Updates `actions/deploy-pages` from 4.0.5 to 5.0.1 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](actions/deploy-pages@d6db901...368f825) Updates `julia-actions/setup-julia` from 2.7.0 to 3.0.2 - [Release notes](https://github.com/julia-actions/setup-julia/releases) - [Commits](julia-actions/setup-julia@4c0cb0f...fa02766) Updates `julia-actions/cache` from 3.0.0 to 3.3.0 - [Release notes](https://github.com/julia-actions/cache/releases) - [Commits](julia-actions/cache@e33b4bf...a7bed9d) Updates `webfactory/ssh-agent` from 0.9.1 to 0.10.0 - [Release notes](https://github.com/webfactory/ssh-agent/releases) - [Changelog](https://github.com/webfactory/ssh-agent/blob/main/CHANGELOG.md) - [Commits](webfactory/ssh-agent@a6f90b1...e838748) Updates `dtolnay/rust-toolchain` from efa25f7f19611383d5b0ccf2d1c8914531636bf9 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](dtolnay/rust-toolchain@efa25f7...02cb101) Updates `hyperpolymath/smtp-notify-action` from 0.2.0 to 0.3.0 - [Release notes](https://github.com/hyperpolymath/smtp-notify-action/releases) - [Changelog](https://github.com/hyperpolymath/smtp-notify-action/blob/main/CHANGELOG.adoc) - [Commits](hyperpolymath/smtp-notify-action@ede1191...22e7bdb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: haskell-actions/setup dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/configure-pages dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-pages-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/deploy-pages dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: julia-actions/setup-julia dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: julia-actions/cache dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: webfactory/ssh-agent dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: dtolnay/rust-toolchain dependency-version: 02cb101ec7c40f2c49e1d9714d64511d8e1b74de dependency-type: direct:production dependency-group: actions - dependency-name: hyperpolymath/smtp-notify-action dependency-version: 0.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-14T09:28:45Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a05285bf-c184-46a7-aecb-c8b5fabb0a2d

📥 Commits

Reviewing files that changed from the base of the PR and between 9c72924 and 0d31eab.

📒 Files selected for processing (5)

.github/workflows/boj-build.yml
.github/workflows/casket-pages.yml
.github/workflows/ci.yml
.github/workflows/mirror.yml
.github/workflows/push-email-notify.yml

📝 Summary

Summary by CodeRabbit

Chores
- Updated pinned GitHub Actions used for builds, continuous integration, GitHub Pages deployment, repository mirroring, and email notifications.
- Updated toolchain and caching actions to newer versions while preserving existing workflow behaviour, triggers, permissions, and configuration.

Walkthrough

The pull request updates pinned GitHub Actions across five workflows. Workflow triggers, jobs, permissions, configuration values, and other logic remain unchanged.

Changes

GitHub Actions pin updates

Layer / File(s)	Summary
Build and Pages action updates `.github/workflows/boj-build.yml`, `.github/workflows/casket-pages.yml`	The workflows update checkout, GHCup, cache, Pages configuration, artifact upload, and deployment action pins.
CI and mirror action updates `.github/workflows/ci.yml`, `.github/workflows/mirror.yml`	The CI workflow updates Julia action pins. Mirror jobs update checkout, SSH-agent, and Rust toolchain pins.
Notification action update `.github/workflows/push-email-notify.yml`	The notification workflow updates the pinned SMTP notification action from v0.2.0 to v0.3.0.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: hyperpolymath

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks each action pin,
Fresh revisions now begin.
Build and mirrors hop in line,
Pages deploy on newer spine.
CI follows, alerts arrive—
All workflows keep their shape alive.}

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 14, 2026

hyperpolymath merged commit 75d6ef0 into main Sep 14, 2026
17 of 19 checks passed

hyperpolymath deleted the dependabot/github_actions/actions-67d06bedcc branch September 14, 2026 12:47

Navigation Menu

Repository navigation

chore(deps): bump the actions group across 1 directory with 11 updates - #29

chore(deps): bump the actions group across 1 directory with 11 updates#29
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-67d06bedcc

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading

Review failed

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

v6.0.3

What's Changed

New Contributors

v6.0.2

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v2.11.0

What's Changed

v2.10.4

What's Changed

v2.10.3

What's Changed

v2.10.2

What's Changed

v6.1.0

What's Changed

v6.0.0

What's Changed

v5.1.0

What's Changed

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

Releases

How to prepare a release

Changelog

6.1.0

6.0.0

5.0.4

5.0.3

5.0.2

v6.0.0

Changelog

v5.0.0

Changelog

v4.0.0

What's Changed

v5.0.1

Changelog

v5.0.0

Changelog

v3.0.2

What's Changed

New Contributors

Full Changelog

v3.0.1

What's Changed

Full Changelog

v3.0.0

⚠️ Breaking Changes, and Migration Guide for v2 ⟶ v3

Other Changes

Full Changelog

v3.3.0

What's Changed

Full Changelog

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading