From 300c9e43af8725bc4189027da2b19b5e758671da Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Nov 2026 18:06:06 +0000 Subject: [PATCH] ci: bump the github-actions group across 1 directory with 5 updates Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.1.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.4` | `7.1.1` | | [expo/expo-github-action](https://github.com/expo/expo-github-action) | `8.2.1` | `9.0.1` | | [changesets/action](https://github.com/changesets/action) | `1.8.0` | `2.1.2` | Updates `actions/checkout` from 4.3.1 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-node` from 4.4.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `codecov/codecov-action` from 5.5.4 to 7.1.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/75cd11691c0faa626561e295848008c8a7dddffe...303a32d7a59b442fa8d48b6a1cc6825c09c847a5) Updates `expo/expo-github-action` from 8.2.1 to 9.0.1 - [Release notes](https://github.com/expo/expo-github-action/releases) - [Changelog](https://github.com/expo/expo-github-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/expo/expo-github-action/compare/c7b66a9c327a43a8fa7c0158e7f30d6040d2481e...9da89d3617bb88139671bad31b09c65714c2ee06) Updates `changesets/action` from 1.8.0 to 2.1.2 - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](https://github.com/changesets/action/compare/63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b...ae32849d5ba541f9ae29e40e22a623bc13562f51) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: changesets/action dependency-version: 2.1.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: expo/expo-github-action dependency-version: 9.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/cicd.yml | 6 +++--- .github/workflows/dependabot-changeset.yml | 6 +++--- .github/workflows/expo-bundle.yml | 4 ++-- .github/workflows/expo-native.yml | 6 +++--- .github/workflows/integration.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- .github/workflows/zizmor.yml | 2 +- 7 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml index a97129c46..5db844e10 100644 --- a/.github/workflows/cicd.yml +++ b/.github/workflows/cicd.yml @@ -18,11 +18,11 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24.x" registry-url: "https://registry.npmjs.org" @@ -49,7 +49,7 @@ jobs: run: yarn test:ci - name: Upload results to Codecov - uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: token: ${{ secrets.CODECOV_TOKEN }} slug: knocklabs/javascript diff --git a/.github/workflows/dependabot-changeset.yml b/.github/workflows/dependabot-changeset.yml index ea33ff220..5ffa1a93d 100644 --- a/.github/workflows/dependabot-changeset.yml +++ b/.github/workflows/dependabot-changeset.yml @@ -47,7 +47,7 @@ jobs: # Checkout the PR branch for package.json analysis and committing. # The final step pushes with these persisted credentials. - name: Checkout PR branch # zizmor: ignore[artipacked] - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ steps.pr.outputs.ref }} token: ${{ secrets.KNOCK_ENG_BOT_GITHUB_TOKEN }} @@ -57,7 +57,7 @@ jobs: # This ensures we never execute code from an untrusted PR branch # when triggered via workflow_dispatch. - name: Checkout trusted script from main - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main sparse-checkout: .github/scripts @@ -65,7 +65,7 @@ jobs: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: "package.json" diff --git a/.github/workflows/expo-bundle.yml b/.github/workflows/expo-bundle.yml index e71a44a86..056feadaa 100644 --- a/.github/workflows/expo-bundle.yml +++ b/.github/workflows/expo-bundle.yml @@ -24,10 +24,10 @@ jobs: name: Metro bundle runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22.x" cache: yarn diff --git a/.github/workflows/expo-native.yml b/.github/workflows/expo-native.yml index 489187f2a..3f8fa5dd2 100644 --- a/.github/workflows/expo-native.yml +++ b/.github/workflows/expo-native.yml @@ -38,10 +38,10 @@ jobs: github.event.label.name == 'expo:native-build' runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22.x" cache: yarn @@ -52,7 +52,7 @@ jobs: - name: Build packages run: yarn build:packages - name: Setup Expo and EAS - uses: expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e # 8.2.1 + uses: expo/expo-github-action@9da89d3617bb88139671bad31b09c65714c2ee06 # 9.0.1 with: # Dependabot can't update this, so bump it by hand. eas-version: 27.1.0 diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index d0ae202e9..2aa6af7bb 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -16,11 +16,11 @@ jobs: name: React ${{ matrix.react-version }} steps: - name: Checkout Latest - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: "package.json" cache: "yarn" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2b8e2087a..84bd8ae87 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,7 +34,7 @@ jobs: # Changesets can generate changelogs and tag new releases appropriately. # The prerelease-exit step pushes with these persisted credentials. - name: Checkout Repo # zizmor: ignore[artipacked] - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true fetch-depth: 0 @@ -58,7 +58,7 @@ jobs: # Set up Node.js using the version specified in package.json, # and cache Yarn dependencies for faster installs. - name: Setup Node.js 20.x - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: "package.json" cache: "yarn" @@ -125,7 +125,7 @@ jobs: # Publishing authenticates through npm trusted publishing, so no npm token # is configured. Yarn uses `npmAuthToken` ahead of OIDC when one is set. - name: Create release PR or publish - uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0 + uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2 with: commit: "chore(repo): version packages for ${{ steps.release-type.outputs.release-type }}" title: "chore(repo): version packages for ${{ steps.release-type.outputs.release-type }}" diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 5b4bef9ce..944d11ae3 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -23,7 +23,7 @@ jobs: name: zizmor runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false