Skip to content

chore(deps): actions: bump the all-actions group across 1 directory with 5 updates - #946

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-ab294f9eca
Closed

chore(deps): actions: bump the all-actions group across 1 directory with 5 updates#946
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-ab294f9eca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-actions group with 5 updates in the / directory:

Package From To
jdx/mise-action 4.3.0 5.0.1
codecov/codecov-action 7.0.0 7.1.1
aws-actions/configure-aws-credentials 6.2.4 6.3.0
withastro/action 6.1.2 6.1.3
github/issue-metrics 5.0.1 5.0.3

Updates jdx/mise-action from 4.3.0 to 5.0.1

Release notes

Sourced from jdx/mise-action's releases.

v5.0.1: Verify cached mise binaries before running them

mise-action now checks the integrity of an already-installed mise binary before running it. This fixes a security issue that was reported privately.

Fixed

  • An existing mise binary is verified before it is run. When a mise binary is already on the runner (for example, restored from cache or in mise_dir), the action now checks it before calling it. If you set a sha256 input, the binary must match that checksum and report the requested version. Otherwise, it must match the signed release checksums for the version being installed. If the check fails, the action prints a warning, deletes the binary and installs the requested release again. Before this fix, the action could run a cached binary before checking it. (#637 by @​jdx)

Changed

Changes to how the action handles an existing binary, also from #637:

  • Switching versions uses a full install. If the cached binary doesn't match the requested version, the action downloads and installs that version. It no longer runs mise self-update.
  • Unpinned runs always pick a release. Without a version input, the action now selects a release every time, using minimum_release_age, even when mise is already installed. It then checks the existing binary against that release, and reinstalls if the binary doesn't match.
  • Older releases need a sha256 input to reuse a cached binary. Some older mise releases have no signed checksums. With the sha256 input set, a cached binary of one of these releases can still be reused without a download. Without it, the action can't verify the binary and installs it again.

Full Changelog: jdx/mise-action@v5.0.0...v5.0.1

v5.0.0: Default minimum release age of 24 hours for mise

If you don't pin a version, mise-action now installs the newest stable mise release that is at least 24 hours old. Upgrading mise on a runner that already has it is also less likely to hit GitHub API rate limits.

Breaking Changes

minimum_release_age now defaults to 24h (#632 by @​jdx)

Before this release, minimum_release_age was an opt-in setting. It now defaults to 24h. If you don't set version, the action picks the highest-numbered stable mise release published at least 24 hours ago. A mise release that just shipped won't be installed until it's a day old.

To get the latest stable release right away, as in v4, set the delay to 0s. You can also choose a longer delay:

- uses: jdx/mise-action@v5
  with:
    minimum_release_age: 0s   # or e.g. 7d
  • An explicit version input still takes precedence and skips the delay.
  • The setting applies only to the mise binary, not to tools installed by mise.
  • The action now gets the release list from a public CDN index (releases.tsv on mise.jdx.dev) instead of paging through the GitHub Releases API. Picking a release doesn't use GitHub API quota, even when an installed binary is reused. If the index is missing or malformed, the action fails instead of skipping the release-age check.
  • Replacing an older installed binary still runs mise self-update, which may call the GitHub API to fetch that exact release.

Fixed

  • mise self-update now runs with MISE_GITHUB_TOKEN. When a runner already had a different mise version installed, the action runs mise self-update to switch versions. That GitHub API call used to go out without authentication, so busy shared or self-hosted runners could hit the rate limit and fail with HTTP 403 RateLimitedError. If you already set a token in your environment, the action leaves it unchanged. (#619 by @​hegde5)

New Contributors

Full Changelog: jdx/mise-action@v4.3.0...v5.0.0

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

5.1.1 - 2026-10-04

🐛 Bug Fixes

5.1.0 - 2026-10-04

🚀 Features

🐛 Bug Fixes

  • (cache) keep a cached mise instead of re-downloading when version is unset (#642) by @​jdx in #642
  • save cache after inexact cache restore (#646) by @​jdx in #646
  • extract mise zip with PowerShell instead of unzip on Windows (#650) by @​jdx in #650
  • cache mise binary for caches saved without a version record (#648) by @​jdx in #648

📚 Documentation

  • explain the Rust cache caveat and workarounds (#651) by @​jdx in #651
  • add matrix and external cache guides; warn on shadowed mise_toml (#654) by @​jdx in #654

⚙️ Miscellaneous Tasks

5.0.1 - 2026-09-30

🐛 Bug Fixes

5.0.0 - 2026-09-28

🚀 Features

... (truncated)

Commits
  • 7a4e45a chore: release v5.0.1 (#638)
  • c4102d4 fix: verify cached mise before execution (#637)
  • baf7eb4 chore(deps): update dependency aube to latest (#636)
  • c75796c chore(deps): update dependency communique to latest (#635)
  • ec2665b chore(deps): update github actions (#633)
  • 342b4c0 chore(deps): update dependency aube to latest (#634)
  • 9149ea8 chore: release v5.0.0 (#620)
  • 279d505 feat!: default minimum release age to 24 hours (#632)
  • aa79241 chore(entire): restore lower-cost trail findings
  • 6ac0f83 chore(entire): commit claude session hooks
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 7.0.0 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

Commits

Updates aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.3.0

6.3.0 (2026-09-11)

Features

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.3.0 (2026-09-11)

Features

6.2.4 (2026-08-31)

Bug Fixes

  • account-ids handling, mask proxy as secret in logs (#1943) (aa65264)
  • skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

6.2.3 (2026-07-22)

Bug Fixes

  • attach git credentials before Tag Major Version push (#1877) (9ae780b)
  • PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

6.2.2 (2026-07-07)

Miscellaneous Chores

6.2.1 (2026-06-26)

Bug Fixes

  • enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

  • add additional session tags by default (#1775) (e0ba768)
  • add more retry logic and better logging (#1764) (540d0c1)
  • add regex validation to role-session-name (#1765) (e354499)
  • Allow custom session tags to be passed when assuming a role (#1759) (61f50f6)
  • expose run id in STS client user-agent (#1774) (29d1be3)

... (truncated)

Commits
  • e125382 chore(main): release 6.3.0 (#1963)
  • 438100a chore: add link to GH security docs (#1962)
  • e92ebcc chore: Update dist
  • 57b8365 feat: add translate-env-variables option (#1961)
  • cc49fa7 chore(docs): README main branch guidance (#1960)
  • 866cb16 chore(deps-dev): bump smol-toml from 1.7.0 to 1.7.2 (#1958)
  • 6782cb1 chore(deps-dev): bump generate-license-file from 4.2.4 to 4.2.5 (#1951)
  • c20509a chore: Update dist
  • 7a41fc6 chore(deps): bump @​aws-sdk/client-sts from 3.1121.0 to 3.1127.0 (#1954)
  • 726b713 chore(deps-dev): bump @​biomejs/biome from 2.5.11 to 2.5.12 (#1957)
  • Additional commits viewable in compare view

Updates withastro/action from 6.1.2 to 6.1.3

Release notes

Sourced from withastro/action's releases.

v6.1.3

Changelog

See details of all code changes since previous release.

Commits

Updates github/issue-metrics from 5.0.1 to 5.0.3

Release notes

Sourced from github/issue-metrics's releases.

v5.0.3

Changelog

🧰 Maintenance

See details of all code changes since previous release

v5.0.2

Changelog

🐛 Bug Fixes

🧰 Maintenance

  • chore(deps): bump python from ce40764 to cad9a2c @dependabot[bot] (#820)
  • chore(deps): bump the dependencies group with 4 updates @dependabot[bot] (#821)
  • chore(deps): bump github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml from 1.2.3 to 2.0.0 @dependabot[bot] (#817)
  • chore(deps): bump the dependencies group with 2 updates @dependabot[bot] (#814)
  • chore(deps): bump the dependencies group with 2 updates @dependabot[bot] (#815)
  • chore(deps): bump github-community-projects/ospo-reusable-workflows/.github/workflows/release.yaml from 1.2.3 to 2.0.0 @dependabot[bot] (#816)
  • chore(deps): bump github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml from 1.2.3 to 2.0.0 @dependabot[bot] (#818)
  • chore(deps): bump python from 3.14.6-slim to 3.14.7-slim in the dependencies group @dependabot[bot] (#810)
  • chore(deps): bump pylint from 4.0.6 to 4.0.7 in the dependencies group @dependabot[bot] (#811)

See details of all code changes since previous release

Commits
  • 6715286 chore(deps): bump the dependencies group with 3 updates (#831)
  • 9dd2448 chore(deps): bump urllib3 from 2.7.0 to 2.8.0 (#829)
  • d14b1bb chore(deps): bump the dependencies group with 7 updates (#830)
  • 44f5cb6 chore(deps): bump cryptography from 48.0.1 to 50.0.0 (#826)
  • 22b0af4 chore(deps): bump pyjwt from 2.13.0 to 2.15.0 (#827)
  • 73cf953 chore(deps): bump isort from 8.0.1 to 9.0.1 (#824)
  • 075ba2c chore(deps): bump the dependencies group with 4 updates (#825)
  • bf348b7 chore(deps): bump step-security/harden-runner in the dependencies group (#823)
  • c7a6bf1 chore(deps): bump pylint from 4.0.7 to 4.0.8 in the dependencies group (#822)
  • a7dc2fb fix: paginate discussion comments so MAX_COMMENTS_EVAL is honored (#803)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): actions: bump the all-actions group across 1 directory w…
d75a12e 
…ith 5 updates

Bumps the all-actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [jdx/mise-action](https://github.com/jdx/mise-action) | `4.3.0` | `5.0.1` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `7.0.0` | `7.1.1` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.4` | `6.3.0` |
| [withastro/action](https://github.com/withastro/action) | `6.1.2` | `6.1.3` |
| [github/issue-metrics](https://github.com/github/issue-metrics) | `5.0.1` | `5.0.3` |



Updates `jdx/mise-action` from 4.3.0 to 5.0.1
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](jdx/mise-action@c2a8761...7a4e45a)

Updates `codecov/codecov-action` from 7.0.0 to 7.1.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@fb8b358...303a32d)

Updates `aws-actions/configure-aws-credentials` from 6.2.4 to 6.3.0
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@cbe3b39...e125382)

Updates `withastro/action` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/withastro/action/releases)
- [Commits](withastro/action@e84f40b...3eafd00)

Updates `github/issue-metrics` from 5.0.1 to 5.0.3
- [Release notes](https://github.com/github/issue-metrics/releases)
- [Commits](github-community-projects/issue-metrics@61084fa...6715286)

---
updated-dependencies:
- dependency-name: jdx/mise-action
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: withastro/action
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: github/issue-metrics
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 10, 2026 06:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 17, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/all-actions-ab294f9eca branch October 17, 2026 06:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants