Skip to content

Bump the ci-dependencies group with 9 updates#23

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/ci-dependencies-36af579425
Open

Bump the ci-dependencies group with 9 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/ci-dependencies-36af579425

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 1, 2026 •
edited
Loading

Bumps the ci-dependencies group with 9 updates:

Package From To
actions/checkout 4.2.2 6.0.2
actions/dependency-review-action 4.5.0 4.9.0
darbiadev/.github/.github/workflows/generic-precommit.yaml 14.1.0 15.2.0
darbiadev/.github/.github/workflows/python-lint.yaml 14.1.0 15.2.0
darbiadev/.github/.github/workflows/python-test.yaml 14.1.0 15.2.0
darbiadev/.github/.github/workflows/github-pages-python-sphinx.yaml 14.1.0 15.2.0
hynek/build-and-inspect-python-package 2.11.0 2.17.0
actions/download-artifact 4.1.8 8.0.1
pypa/gh-action-pypi-publish 1.12.3 1.14.0

Updates actions/checkout from 4.2.2 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits

Updates actions/dependency-review-action from 4.5.0 to 4.9.0

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

  • There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @​felickz!
  • Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @​jantiebot!
  • There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @​juxtin!

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

4.8.3

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

v4.8.2

Minor fixes:

... (truncated)

Commits
  • 2031cfc Merge pull request #1064 from actions/ahpook/release-4.9.0
  • d02fa39 Updates for release 4.9.0
  • 4038a34 Merge pull request #1021 from actions/dependabot/github_actions/actions/check...
  • a632b83 Merge pull request #1058 from actions/dependabot/github_actions/actions/stale...
  • 57a3d46 Merge pull request #1060 from jantiebot/main
  • 5ecdc4b Merge pull request #1045 from forks-felickz/main
  • e8c2f9a fix: remove inferrable type annotation to pass eslint
  • 0e129e1 Prettier - Refactor summary table rendering for improved readability
  • aa60746 Add 'show-patched-versions' option to configuration and update summary handling
  • e404798 Merge upstream actions/dependency-review-action main
  • Additional commits viewable in compare view

Updates darbiadev/.github/.github/workflows/generic-precommit.yaml from 14.1.0 to 15.2.0

Release notes

Sourced from darbiadev/.github/.github/workflows/generic-precommit.yaml's releases.

v15.2.0

What's Changed

Full Changelog: darbiadev/.github@v15.1.0...v15.2.0

v15.1.0

What's Changed

Full Changelog: darbiadev/.github@v15.0.0...v15.1.0

v15.0.0

What's Changed

Full Changelog: darbiadev/.github@v14.1.0...v15.0.0

Commits
  • 4401664 build(deps): bump the callable-workflows group with 9 updates (#162)
  • a79ad04 build(deps): bump darbiadev/.github (#159)
  • 37c9377 build(deps): bump actions/upload-artifact (#161)
  • 426cc8d build(deps): bump the callable-workflows group with 7 updates (#160)
  • 45471b5 build(deps): bump the callable-workflows group with 5 updates (#158)
  • a1fe1d8 build(deps): bump the callable-workflows group across 1 directory with 3 upda...
  • f98fb33 build(deps): bump the callable-workflows group with 4 updates (#155)
  • e22a8d2 build(deps): bump the callable-workflows group across 1 directory with 11 upd...
  • 9dee814 build(deps): bump darbiadev/.github (#151)
  • 91dda16 build(deps): bump the callable-workflows group across 1 directory with 11 upd...
  • See full diff in compare view

Updates darbiadev/.github/.github/workflows/python-lint.yaml from 14.1.0 to 15.2.0

Release notes

Sourced from darbiadev/.github/.github/workflows/python-lint.yaml's releases.

v15.2.0

What's Changed

Full Changelog: darbiadev/.github@v15.1.0...v15.2.0

v15.1.0

What's Changed

Full Changelog: darbiadev/.github@v15.0.0...v15.1.0

v15.0.0

What's Changed

Full Changelog: darbiadev/.github@v14.1.0...v15.0.0

Commits
  • 4401664 build(deps): bump the callable-workflows group with 9 updates (#162)
  • a79ad04 build(deps): bump darbiadev/.github (#159)
  • 37c9377 build(deps): bump actions/upload-artifact (#161)
  • 426cc8d build(deps): bump the callable-workflows group with 7 updates (#160)
  • 45471b5 build(deps): bump the callable-workflows group with 5 updates (#158)
  • a1fe1d8 build(deps): bump the callable-workflows group across 1 directory with 3 upda...
  • f98fb33 build(deps): bump the callable-workflows group with 4 updates (#155)
  • e22a8d2 build(deps): bump the callable-workflows group across 1 directory with 11 upd...
  • 9dee814 build(deps): bump darbiadev/.github (#151)
  • 91dda16 build(deps): bump the callable-workflows group across 1 directory with 11 upd...
  • See full diff in compare view

Updates darbiadev/.github/.github/workflows/python-test.yaml from 14.1.0 to 15.2.0

Release notes

Sourced from darbiadev/.github/.github/workflows/python-test.yaml's releases.

v15.2.0

What's Changed

Full Changelog: darbiadev/.github@v15.1.0...v15.2.0

v15.1.0

What's Changed

Full Changelog: darbiadev/.github@v15.0.0...v15.1.0

v15.0.0

What's Changed

Full Changelog: darbiadev/.github@v14.1.0...v15.0.0

Commits
  • 4401664 build(deps): bump the callable-workflows group with 9 updates (#162)
  • a79ad04 build(deps): bump darbiadev/.github (#159)
  • 37c9377 build(deps): bump actions/upload-artifact (#161)
  • 426cc8d build(deps): bump the callable-workflows group with 7 updates (#160)
  • 45471b5 build(deps): bump the callable-workflows group with 5 updates (#158)
  • a1fe1d8 build(deps): bump the callable-workflows group across 1 directory with 3 upda...
  • f98fb33 build(deps): bump the callable-workflows group with 4 updates (#155)
  • e22a8d2 build(deps): bump the callable-workflows group across 1 directory with 11 upd...
  • 9dee814 build(deps): bump darbiadev/.github (#151)
  • 91dda16 build(deps): bump the callable-workflows group across 1 directory with 11 upd...
  • See full diff in compare view

Updates darbiadev/.github/.github/workflows/github-pages-python-sphinx.yaml from 14.1.0 to 15.2.0

Release notes

Sourced from darbiadev/.github/.github/workflows/github-pages-python-sphinx.yaml's releases.

v15.2.0

What's Changed

Full Changelog: darbiadev/.github@v15.1.0...v15.2.0

v15.1.0

What's Changed

Full Changelog: darbiadev/.github@v15.0.0...v15.1.0

v15.0.0

What's Changed

Full Changelog: darbiadev/.github@v14.1.0...v15.0.0

Commits
  • 4401664 build(deps): bump the callable-workflows group with 9 updates (#162)
  • a79ad04 build(deps): bump darbiadev/.github (#159)
  • 37c9377 build(deps): bump actions/upload-artifact (#161)
  • 426cc8d build(deps): bump the callable-workflows group with 7 updates (#160)
  • 45471b5 build(deps): bump the callable-workflows group with 5 updates (#158)
  • a1fe1d8 build(deps): bump the callable-workflows group across 1 directory with 3 upda...
  • f98fb33 build(deps): bump the callable-workflows group with 4 updates (#155)
  • e22a8d2 build(deps): bump the callable-workflows group across 1 directory with 11 upd...
  • 9dee814 build(deps): bump darbiadev/.github (#151)
  • 91dda16 build(deps): bump the callable-workflows group across 1 directory with 11 upd...
  • See full diff in compare view

Updates hynek/build-and-inspect-python-package from 2.11.0 to 2.17.0

Release notes

Sourced from hynek/build-and-inspect-python-package's releases.

v2.17.0

Fixed

  • The action now passes Zizmor in pedantic mode. #212

v2.16.0

Added

  • New include-free-threaded input. When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after each matching version. #208

v2.15.0

Added

  • The Python version used to build the package can now be configured using the python-version input. #191

v2.14.0

Changed

  • Update tools such that they work on Python 3.14 (which is now 3.x on GitHub Actions). #182

  • The action now ignores UV_PYTHON coming from the outside. #184

v2.13.0

Added

  • New output: package_name is the name of the built package as stored in metadata. #162

  • The package name is now part of the action summary which is helpful when you build more than one package from a repository. #169

Changed

  • All GitHub actions are now pinned to exact hashes for better reproducibility and mild security improvements.

    Since chosen prefix SHA-1 hash collision attacks exist, this is but security theater against serious attackers.

v2.12.0

This release only updates our dependencies to support packaging metadata v2.4 (as created, for example, by recent Hatchling releases).

[!NOTE] To upload packages with metadata v2.4 (which is required for PEP 639 license metadata) using the official pypi-publish GitHub Action, you must make sure to use its v1.12.4 or later.

Changelog

Sourced from hynek/build-and-inspect-python-package's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

2.17.0 - 2026-03-27

Fixed

  • The action now passes Zizmor in pedantic mode. #212

2.16.0 - 2026-03-26

Added

  • New include-free-threaded input. When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after each matching version. #208

2.15.0 - 2026-03-19

Added

  • The Python version used to build the package can now be configured using the python-version input. #191

Changed

  • Pick Python version explictly instead of "3.x" to prevent incompatibily problems like #182 in the future.

2.14.0 - 2025-10-11

Changed

  • Update tools such that they work on Python 3.14 (which is now 3.x on GitHub Actions). #182

  • The action now ignores UV_PYTHON coming from the outside. #184

... (truncated)

Commits
  • fe0a0fb v2.17.0
  • 53f0dea Access ENV variable directly (#216)
  • 2ada6ad Let Zizmor collect all
  • c587d90 ci: make ci-supported-python.yml pass pedantic Zizmor
  • e943986 ci: make ci.yml pass pedantic Zizmor
  • dd13d25 Explain write
  • 3579e59 Switch Zizmor to pedantic
  • 969aa25 update: no permissions by default
  • c9b743b The action is, in fact, useless
  • 28c7e15 update: actually do persist dependencies
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.1.8 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.12.3 to 1.14.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases...

Description has been truncated

@dependabot
Bump the ci-dependencies group with 9 updates
c66575c 
Bumps the ci-dependencies group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `6.0.2` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.5.0` | `4.9.0` |
| [darbiadev/.github/.github/workflows/generic-precommit.yaml](https://github.com/darbiadev/.github) | `14.1.0` | `15.2.0` |
| [darbiadev/.github/.github/workflows/python-lint.yaml](https://github.com/darbiadev/.github) | `14.1.0` | `15.2.0` |
| [darbiadev/.github/.github/workflows/python-test.yaml](https://github.com/darbiadev/.github) | `14.1.0` | `15.2.0` |
| [darbiadev/.github/.github/workflows/github-pages-python-sphinx.yaml](https://github.com/darbiadev/.github) | `14.1.0` | `15.2.0` |
| [hynek/build-and-inspect-python-package](https://github.com/hynek/build-and-inspect-python-package) | `2.11.0` | `2.17.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.8` | `8.0.1` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.12.3` | `1.14.0` |


Updates `actions/checkout` from 4.2.2 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...de0fac2)

Updates `actions/dependency-review-action` from 4.5.0 to 4.9.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@3b139cf...2031cfc)

Updates `darbiadev/.github/.github/workflows/generic-precommit.yaml` from 14.1.0 to 15.2.0
- [Release notes](https://github.com/darbiadev/.github/releases)
- [Commits](darbiadev/.github@4151857...4401664)

Updates `darbiadev/.github/.github/workflows/python-lint.yaml` from 14.1.0 to 15.2.0
- [Release notes](https://github.com/darbiadev/.github/releases)
- [Commits](darbiadev/.github@4151857...4401664)

Updates `darbiadev/.github/.github/workflows/python-test.yaml` from 14.1.0 to 15.2.0
- [Release notes](https://github.com/darbiadev/.github/releases)
- [Commits](darbiadev/.github@4151857...4401664)

Updates `darbiadev/.github/.github/workflows/github-pages-python-sphinx.yaml` from 14.1.0 to 15.2.0
- [Release notes](https://github.com/darbiadev/.github/releases)
- [Commits](darbiadev/.github@4151857...4401664)

Updates `hynek/build-and-inspect-python-package` from 2.11.0 to 2.17.0
- [Release notes](https://github.com/hynek/build-and-inspect-python-package/releases)
- [Changelog](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md)
- [Commits](hynek/build-and-inspect-python-package@14c7e53...fe0a0fb)

Updates `actions/download-artifact` from 4.1.8 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@fa0a91b...3e5f45b)

Updates `pypa/gh-action-pypi-publish` from 1.12.3 to 1.14.0
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@67339c7...cef2210)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: actions/dependency-review-action
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: darbiadev/.github/.github/workflows/generic-precommit.yaml
  dependency-version: 15.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: darbiadev/.github/.github/workflows/python-lint.yaml
  dependency-version: 15.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: darbiadev/.github/.github/workflows/python-test.yaml
  dependency-version: 15.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: darbiadev/.github/.github/workflows/github-pages-python-sphinx.yaml
  dependency-version: 15.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: hynek/build-and-inspect-python-package
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants