Skip to content

chore(deps): actions: bump the all-actions group across 1 directory with 8 updates - #958

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-db43fa06f3
Open

chore(deps): actions: bump the all-actions group across 1 directory with 8 updates#958
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-db43fa06f3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-actions group with 8 updates in the / directory:

Package From To
jdx/mise-action 4.3.0 5.1.1
actions/setup-node 7.0.0 7.1.0
codecov/codecov-action 7.0.0 7.1.1
actions/upload-artifact 7.0.1 7.0.2
actions/download-artifact 8.0.1 8.0.2
aws-actions/configure-aws-credentials 6.2.4 6.3.0
withastro/action 6.1.2 6.1.3
github/issue-metrics 5.0.1 5.0.3

Updates jdx/mise-action from 4.3.0 to 5.1.1

Release notes

Sourced from jdx/mise-action's releases.

v5.1.1: GitHub token is no longer exported to later steps by default

mise-action no longer exports its GitHub token as MISE_GITHUB_TOKEN to every later step in the job. A new persist_github_token input lets you turn that back on, or pass a different token to later steps. This changes the default behavior. If later steps need the token, see Breaking Changes below.

Fixed

  • The GitHub token now stays inside the action by default. Before this release, the github_token input (which defaults to ${{ github.token }}) was written to GITHUB_ENV as MISE_GITHUB_TOKEN. That let any later step read the token and call the GitHub API with the job's permissions, even if the step never asked for a credential. Now the token is set only for the mise-action step and the processes it starts. The action masks the token in logs. (#658 by @​jdx, reported in #657)

Added

  • persist_github_token input (default false). It takes one of three values:

    • false: the token stays inside the action.
    • true: the token the action used is exported to later steps. If env.MISE_GITHUB_TOKEN is already set, it takes precedence over github_token.
    • A token value: that token is exported to later steps instead, for example a read-only token. The action still installs tools with github_token, or with MISE_GITHUB_TOKEN if it's already set.

    Setting false doesn't clear a MISE_GITHUB_TOKEN that was already set at the job level or exported by an earlier step. (#658 by @​jdx)

Breaking Changes

Check your workflow if a later step needs MISE_GITHUB_TOKEN, such as mise shims, mise exec, mise run or lazy tool installs that call the GitHub API. Those steps no longer get the token automatically and may hit GitHub API rate limits. To get the old behavior back, opt in:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: true

Or give later steps a separate token:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: ${{ secrets.READ_ONLY_TOKEN }}

Full Changelog: jdx/mise-action@v5.1.0...v5.1.1

v5.1.0: Tool version outputs, plugins input, and cached mise reuse

mise-action now reports the tool versions it installed as step outputs, can install mise plugins before tools, and can save the cache at the end of the job. Several caching fixes stop the action from downloading mise again on every run.

Added

  • Tool versions as step outputs. After install, the action runs mise ls --json --current and sets a versions output. This is a JSON object of the active, installed tools. Each tool maps to a list of {version, requested_version, install_path, source} entries. Each tool also gets its own output with its resolved version, such as steps.mise.outputs.node. A tool only gets its own output if its name is a valid output name and isn't cache-hit or versions. Names like npm:@scope/pkg appear only in versions. If the action can't read the versions, it prints a warning and the step still succeeds. (#655 by @​jdx) 
    - uses: jdx/mise-action@v5
  id: mise
- run: echo "node ${{ steps.mise.outputs.node }}"
  • plugins input. List plugins one per line as name or name url. Blank lines and # comments are ignored. The action runs mise plugins install -y for each one before mise install. Plugins that are already installed, for example restored from the cache, are left as they are. An unknown plugin fails the step. When plugins is set, its hash is added to the default cache key. Custom cache_key templates can use it as {{plugins_hash}}. If plugins is unset, existing cache keys don't change. (#656 by @​jdx) 
    - uses: jdx/mise-action@v5

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

5.2.0 - 2026-10-16

🚀 Features

  • (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
  • (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
  • verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

  • export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

📚 Documentation

⚙️ Miscellaneous Tasks

5.1.2 - 2026-10-12

🐛 Bug Fixes

  • continue with the existing mise when auto-update cannot replace it (#665) by @​jdx in #665
  • export mise_dir as MISE_DATA_DIR so mise installs tools there (#672) by @​jdx in #672

📚 Documentation

⚙️ Miscellaneous Tasks

... (truncated)

Commits
  • 2d8d4ca chore: release v5.1.1 (#659)
  • 3eb43e3 fix: make GitHub token persistence opt-in (#658)
  • 94c60b3 chore: release v5.1.0 (#640)
  • 4fff0c6 feat: add plugins input (#656)
  • 893fc72 docs: add matrix and external cache guides; warn on shadowed mise_toml (#654)
  • 41f5868 feat: add opt-in cache_save_post input (#649)
  • 2fe229b fix: cache mise binary for caches saved without a version record (#648)
  • abd75d9 fix: extract mise zip with PowerShell instead of unzip on Windows (#650)
  • 4b9c295 docs: explain the Rust cache caveat and workarounds (#651)
  • 7927c6f feat: output active tool versions (#655)
  • Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 7.0.0 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

Commits

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • See full diff in compare view

Updates aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.3.0

6.3.0 (2026-09-11)

Features

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.3.0 (2026-09-11)

Features

6.2.4 (2026-08-31)

Bug Fixes

  • account-ids handling, mask proxy as secret in logs (#1943) (aa65264)
  • skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

6.2.3 (2026-07-22)

Bug Fixes

  • attach git credentials before Tag Major Version push (#1877) (9ae780b)
  • PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

6.2.2 (2026-07-07)

Miscellaneous Chores

6.2.1 (2026-06-26)

Bug Fixes

  • enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

  • add additional session tags by default (#1775) (e0ba768)
  • add more retry logic and better logging (#1764) (540d0c1)
  • add regex validation to role-session-name (#1765) (e354499)
  • Allow custom session tags to be passed when assuming a role (#1759) (61f50f6)
  • expose run id in STS client user-agent (#1774) (29d1be3)

... (truncated)

Commits
  • e125382 chore(main): release 6.3.0 (#1963)
  • 438100a chore: add link to GH security docs (#1962)
  • e92ebcc chore: Update dist
  • 57b8365 feat: add translate-env-variables option (#1961)
  • cc49fa7 chore(docs): README main branch guidance (#1960)
  • 866cb16 chore(deps-dev): bump smol-toml from 1.7.0 to 1.7.2 (#1958)
  • 6782cb1 chore(deps-dev): bump generate-license-file from 4.2.4 to 4.2.5 (#1951)
  • c20509a chore: Update dist
  • 7a41fc6 chore(deps): bump @​aws-sdk/client-sts from 3.1121.0 to 3.1127.0 (#1954)
  • 726b713 chore(deps-dev): bump @​biomejs/biome from 2.5.11 to 2.5.12 (#1957)
  • Additional commits viewable in compare view

Updates withastro/action from 6.1.2 to 6.1.3

Release notes

Sourced from withastro/action's releases.

v6.1.3

Changelog

See details of all code changes since previous release.

Commits

Updates github/issue-metrics from 5.0.1 to 5.0.3

Release notes

Sourced from github/issue-metrics's releases.

v5.0.3

Changelog

🧰 Maintenance

See details of all code changes since previous release

v5.0.2

Changelog

🐛 Bug Fixes

🧰 Maintenance

  • chore(deps): bump python from ce40764 to cad9a2c @dependabot[bot] (#820)
  • chore(deps): bump the dependencies group with 4 updates @dependabot[bot] (#821)
  • chore(deps): bump github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml from 1.2.3 to 2.0.0 @dependabot[bot] (#817)
  • chore(deps): bump the dependencies group with 2 updates @dependabot[bot] (#814)
  • chore(deps): bump the dependencies group with 2 updates @dependabot[bot] (#815)
  • chore(deps): bump github-community-projects/ospo-reusable-workflows/.github/workflows/release.yaml from 1.2.3 to 2.0.0 @dependabot[bot] (#816)
  • chore(deps): bump github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml from 1.2.3 to 2.0.0 @dependabot[bot] (#818)
  • chore(deps): bump python from 3.14.6-slim to 3.14.7-slim in the dependencies group @dependabot[bot] (#810)
  • chore(deps): bump pylint from 4.0.6 to 4.0.7 in the dependencies group @dependabot[bot] (#811)

See details of all code changes since previous release

Commits
  • 6715286 chore(deps): bump the dependencies group with 3 updates (#831)
  • 9dd2448 chore(deps): bump urllib3 from 2.7.0 to 2.8.0 (#829)
  • d14b1bb chore(deps): bump the dependencies group with 7 updates (#830)
  • 44f5cb6 chore(deps): bump cryptography from 48.0.1 to 50.0.0 (#826)
  • 22b0af4 chore(deps): bump pyjwt from 2.13.0 to 2.15.0 (#827)
  • 73cf953 chore(deps): bump isort from 8.0.1 to 9.0.1 (#824)
  • 075ba2c chore(deps): bump the dependencies group with 4 updates (#825)
  • bf348b7 chore(deps): bump step-security/harden-runner in the dependencies group (#823)
  • c7a6bf1 chore(deps): bump pylint from 4.0.7 to 4.0.8 in the dependencies group (#822)
  • a7dc2fb fix: paginate discussion comments so MAX_COMMENTS_EVAL is honored (#803)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): actions: bump the all-actions group across 1 directory w…
a943f69 
…ith 8 updates

Bumps the all-actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [jdx/mise-action](https://github.com/jdx/mise-action) | `4.3.0` | `5.1.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `7.0.0` | `7.1.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.4` | `6.3.0` |
| [withastro/action](https://github.com/withastro/action) | `6.1.2` | `6.1.3` |
| [github/issue-metrics](https://github.com/github/issue-metrics) | `5.0.1` | `5.0.3` |



Updates `jdx/mise-action` from 4.3.0 to 5.1.1
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](jdx/mise-action@c2a8761...2d8d4ca)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `codecov/codecov-action` from 7.0.0 to 7.1.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@fb8b358...303a32d)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

Updates `aws-actions/configure-aws-credentials` from 6.2.4 to 6.3.0
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@cbe3b39...e125382)

Updates `withastro/action` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/withastro/action/releases)
- [Commits](withastro/action@e84f40b...3eafd00)

Updates `github/issue-metrics` from 5.0.1 to 5.0.3
- [Release notes](https://github.com/github/issue-metrics/releases)
- [Commits](github-community-projects/issue-metrics@61084fa...6715286)

---
updated-dependencies:
- dependency-name: jdx/mise-action
  dependency-version: 5.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: withastro/action
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: github/issue-metrics
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 17, 2026 06:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 17, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants