chore(deps): bump the actions-version-updates group across 1 directory with 14 updates by dependabot[bot] · Pull Request #81 · zitadel/client-ruby

dependabot · 2026-03-09T09:17:07Z

Bumps the actions-version-updates group with 14 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.12.0`	`2.15.1`
actions/checkout	`4.2.2`	`6.0.2`
actions/dependency-review-action	`4.7.1`	`4.9.0`
docker/setup-buildx-action	`3.10.0`	`4.0.0`
docker/build-push-action	`6.17.0`	`7.0.0`
ruby/setup-ruby	`1.288.0`	`1.290.0`
stefanzweifel/git-auto-commit-action	`5.2.0`	`7.1.0`
actions/download-artifact	`4.3.0`	`8.0.0`
JetBrains/qodana-action	`201551778d1453e36c5c0aa26f89a94775cb1acc`	`f5aa2889b113c16bd6aee47817b027537ee33ac7`
ossf/scorecard-action	`2.4.1`	`2.4.3`
github/codeql-action	`3.28.18`	`4.32.6`
mridang/action-test-reporter	`1.2.5`	`1.7.0`
actions/upload-artifact	`4.6.2`	`7.0.0`
dorny/test-reporter	`2.0.0`	`2.6.0`

Updates step-security/harden-runner from 2.12.0 to 2.15.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.15.1

What's Changed

Fixes step-security/harden-runner#642 bug due to which post step was failing on Windows ARM runners

Updates npm packages

Full Changelog: step-security/harden-runner@v2.15.0...v2.15.1

v2.15.0

What's Changed

Windows and macOS runner support

We are excited to announce that Harden Runner now supports Windows and macOS runners, extending runtime security beyond Linux for the first time.

Insights for Windows and macOS runners will be displayed in the same consistent format you are already familiar with from Linux runners, giving you a unified view of runtime activity across all platforms.

Full Changelog: step-security/harden-runner@v2.14.2...v2.15.0

v2.14.2

What's Changed

Security fix: Fixed a medium severity vulnerability where outbound network connections using sendto, sendmsg, and sendmmsg socket system calls could bypass audit logging when using egress-policy: audit. This issue only affects the Community Tier in audit mode; block mode and Enterprise Tier were not affected. See GHSA-cpmj-h4f6-r6pq for details.

Full Changelog: step-security/harden-runner@v2.14.1...v2.14.2

v2.14.1

What's Changed

In some self-hosted environments, the agent could briefly fall back to public DNS resolvers during startup if the system DNS was not yet available. This behavior was unintended for GitHub-hosted runners and has now been fixed to prevent any use of public DNS resolvers.

Fixed npm audit vulnerabilities

Full Changelog: step-security/harden-runner@v2.14.0...v2.14.1

v2.14.0

What's Changed

Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.

Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

What's Changed

Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

What's Changed

... (truncated)

Commits

58077d3 Release v2.15.1 (#641)
a90bcbc Update readme (#637)
f0a59d8 Release v2.15.0 (#639)
5ef0c07 Merge pull request #635 from step-security/rc-34
eb43c7b update agent
e3f713f Merge pull request #631 from step-security/rc-31
423acdd chore: fix npm audit vulnerabilities
0ddb86c update agent
20cf305 Merge pull request #622 from step-security/feature/custom-property-skip
c51e8ee feat: skip agent install and post step on subsequent runs for GitHub-hosted r...
Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

update readme/changelog for v6 by @ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

Prepare v5.0.0 release by @salmanmkc in actions/checkout#2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

... (truncated)

Commits

de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
8e8c483 Clarify v6 README (#2328)
033fa0d Add worktree support for persist-credentials includeIf (#2327)
c2d88d3 Update all references from v5 and v4 to v6 (#2314)
1af3b93 update readme/changelog for v6 (#2311)
71cf226 v6-beta (#2298)
069c695 Persist creds to a separate file (#2286)
ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
08c6903 Prepare v5.0.0 release (#2238)
Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.7.1 to 4.9.0

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @felickz!

Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @jantiebot!

There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @juxtin!

What's Changed

Compare normalized purls to account for encoding quirks by @juxtin in actions/dependency-review-action#1056

Make purl comparisons case insensitive by @juxtin in actions/dependency-review-action#1057

Feat: Add Patched Version to Vulnerabilities summary by @felickz in actions/dependency-review-action#1045

fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @jantiebot in actions/dependency-review-action#1060

Bump actions/stale from 10.1.0 to 10.2.0 by @dependabot[bot] in actions/dependency-review-action#1058

Bump actions/checkout from 4 to 6 by @dependabot[bot] in actions/dependency-review-action#1021

Updates for release 4.9.0 by @ahpook in actions/dependency-review-action#1064

New Contributors

@jantiebot made their first contribution in actions/dependency-review-action#1060

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

4.8.3

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

GitHub Actions can't push to our protected main by @dangoor in actions/dependency-review-action#1017

Bump actions/stale from 9.1.0 to 10.1.0 by @dependabot[bot] in actions/dependency-review-action#995

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in actions/dependency-review-action#1003

Bump actions/setup-node from 4 to 6 by @dependabot[bot] in actions/dependency-review-action#1005

Upgrade glob to address a vulnerability by @brrygrdn in actions/dependency-review-action#1024

Bump js-yaml by @dependabot[bot] in actions/dependency-review-action#1020

Addressing vulnerabilities by @Ahmed3lmallah in actions/dependency-review-action#1036

Bump fast-xml-parser from 5.3.3 to 5.3.5 by @dependabot[bot] in actions/dependency-review-action#1050

Bump fast-xml-parser from 5.3.5 to 5.3.6 by @dependabot[bot] in actions/dependency-review-action#1053

Properly truncate long summaries and catch errors by @juxtin in actions/dependency-review-action#1052

Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by @dependabot[bot] in actions/dependency-review-action#931

Changes for Release 4.8.3 by @ahpook in actions/dependency-review-action#1054

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

v4.8.2

Minor fixes:

Fix PURL parsing for scoped packages (#1008 from @danielhardej)

Fix for large summaries (#1007 from @gitulisca)

... (truncated)

Commits

2031cfc Merge pull request #1064 from actions/ahpook/release-4.9.0
d02fa39 Updates for release 4.9.0
4038a34 Merge pull request #1021 from actions/dependabot/github_actions/actions/check...
a632b83 Merge pull request #1058 from actions/dependabot/github_actions/actions/stale...
57a3d46 Merge pull request #1060 from jantiebot/main
5ecdc4b Merge pull request #1045 from forks-felickz/main
e8c2f9a fix: remove inferrable type annotation to pass eslint
0e129e1 Prettier - Refactor summary table rendering for improved readability
aa60746 Add 'show-patched-versions' option to configuration and update summary handling
e404798 Merge upstream actions/dependency-review-action main
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.10.0 to 4.0.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/setup-buildx-action#483

Remove deprecated inputs/outputs by @crazy-max in docker/setup-buildx-action#464

Switch to ESM and update config/test wiring by @crazy-max in docker/setup-buildx-action#481

Bump @actions/core from 1.11.1 to 3.0.0 in docker/setup-buildx-action#475

Bump @docker/actions-toolkit from 0.63.0 to 0.79.0 in docker/setup-buildx-action#482 docker/setup-buildx-action#485

Bump js-yaml from 4.1.0 to 4.1.1 in docker/setup-buildx-action#452

Bump lodash from 4.17.21 to 4.17.23 in docker/setup-buildx-action#472

Bump minimatch from 3.1.2 to 3.1.5 in docker/setup-buildx-action#480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

v3.12.0

Deprecate install input by @crazy-max in docker/setup-buildx-action#455

Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/setup-buildx-action#434

Bump brace-expansion from 1.1.11 to 1.1.12 in docker/setup-buildx-action#436

Bump form-data from 2.5.1 to 2.5.5 in docker/setup-buildx-action#432

Bump undici from 5.28.4 to 5.29.0 in docker/setup-buildx-action#435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

v3.11.1

Fix keep-state not being respected by @crazy-max in docker/setup-buildx-action#429

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

Keep BuildKit state support by @crazy-max in docker/setup-buildx-action#427

Remove aliases created when installing by default by @hashhar in docker/setup-buildx-action#139

Bump @docker/actions-toolkit from 0.56.0 to 0.62.1 in docker/setup-buildx-action#422 docker/setup-buildx-action#425

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

Commits

4d04d5d Merge pull request #485 from docker/dependabot/npm_and_yarn/docker/actions-to...
cd74e05 chore: update generated content
eee38ec build(deps): bump @docker/actions-toolkit from 0.77.0 to 0.79.0
7a83f65 Merge pull request #484 from docker/dependabot/github_actions/docker/setup-qe...
a5aa967 Merge pull request #464 from crazy-max/rm-deprecated
e73d53f build(deps): bump docker/setup-qemu-action from 3 to 4
28a438e Merge pull request #483 from crazy-max/node24
034e9d3 chore: update generated content
b4664d8 remove deprecated inputs/outputs
a8257de node 24 as default runtime
Additional commits viewable in compare view

Updates docker/build-push-action from 6.17.0 to 7.0.0

Release notes

Sourced from docker/build-push-action's releases.

v7.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/build-push-action#1470

Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @crazy-max in docker/build-push-action#1473

Remove legacy export-build tool support for build summary by @crazy-max in docker/build-push-action#1474

Switch to ESM and update config/test wiring by @crazy-max in docker/build-push-action#1466

Bump @actions/core from 1.11.1 to 3.0.0 in docker/build-push-action#1454

Bump @docker/actions-toolkit from 0.62.1 to 0.79.0 in docker/build-push-action#1453 docker/build-push-action#1472 docker/build-push-action#1479

Bump minimatch from 3.1.2 to 3.1.5 in docker/build-push-action#1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

v6.19.2

Preserve port in GIT_AUTH_TOKEN host by @crazy-max in docker/build-push-action#1458

Full Changelog: docker/build-push-action@v6.19.1...v6.19.2

v6.19.1

Derive GIT_AUTH_TOKEN host from GitHub server URL by @crazy-max in docker/build-push-action#1456

Full Changelog: docker/build-push-action@v6.19.0...v6.19.1

v6.19.0

Scope default git auth token to github.com by @crazy-max in docker/build-push-action#1451

Bump brace-expansion from 1.1.11 to 1.1.12 in docker/build-push-action#1396

Bump form-data from 2.5.1 to 2.5.5 in docker/build-push-action#1391

Bump js-yaml from 3.14.1 to 3.14.2 in docker/build-push-action#1429

Bump lodash from 4.17.21 to 4.17.23 in docker/build-push-action#1446

Bump tmp from 0.2.3 to 0.2.4 in docker/build-push-action#1398

Bump undici from 5.28.4 to 5.29.0 in docker/build-push-action#1397

Full Changelog: docker/build-push-action@v6.18.0...v6.19.0

v6.18.0

Bump @docker/actions-toolkit from 0.61.0 to 0.62.1 in docker/build-push-action#1381

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

Commits

d08e5c3 Merge pull request #1479 from docker/dependabot/npm_and_yarn/docker/actions-t...
cbd2dff chore: update generated content
f76f51f chore(deps): Bump @docker/actions-toolkit from 0.78.0 to 0.79.0
7d03e66 Merge pull request #1473 from crazy-max/rm-deprecated-envs
98f853d chore: update generated content
cadccf6 remove deprecated envs
03fe877 Merge pull request #1478 from docker/dependabot/github_actions/docker/setup-b...
827e366 chore(deps): Bump docker/setup-buildx-action from 3 to 4
e25db87 Merge pull request #1474 from crazy-max/rm-export-build-tool
1ac2573 Merge pull request #1470 from crazy-max/node24
Additional commits viewable in compare view

Updates ruby/setup-ruby from 1.288.0 to 1.290.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.290.0

What's Changed

Improve Windows version detection and HOME variable export by @jbaiza in ruby/setup-ruby#883

New Contributors

@jbaiza made their first contribution in ruby/setup-ruby#883

Full Changelog: ruby/setup-ruby@v1.289.0...v1.290.0

v1.289.0

What's Changed

Bump actions/checkout from 4 to 6 by @dependabot[bot] in ruby/setup-ruby#874

Bump fast-xml-parser from 5.3.3 to 5.3.4 by @dependabot[bot] in ruby/setup-ruby#869

Document the role of the setup-ruby release team and maintainers by @eregon in ruby/setup-ruby#876

Bump fast-xml-parser from 5.3.4 to 5.3.6 by @dependabot[bot] in ruby/setup-ruby#877

Bump minimatch from 3.1.2 to 3.1.4 by @dependabot[bot] in ruby/setup-ruby#878

Bump fast-xml-parser from 5.3.6 to 5.4.1 by @dependabot[bot] in ruby/setup-ruby#879

Add jruby-10.0.4.0 by @ruby-builder-bot in ruby/setup-ruby#881

Full Changelog: ruby/setup-ruby@v1.288.0...v1.289.0

Commits

6ca151f Leave only basic comment about env variable change
7413847 Set HOME variable from OS information
b3cff1b Add support for Windows Server Standard Evaluation
19a43a6 Add jruby-10.0.4.0
896e71e Bump fast-xml-parser from 5.3.6 to 5.4.1
0fa9651 Bump minimatch from 3.1.2 to 3.1.4
19a9bab Bump fast-xml-parser from 5.3.4 to 5.3.6
7f562e2 Update Credits in README
0fc657d Document the role of the setup-ruby release team and maintainers
9fd324a Bump fast-xml-parser from 5.3.3 to 5.3.4
Additional commits viewable in compare view

Updates stefanzweifel/git-auto-commit-action from 5.2.0 to 7.1.0

Release notes

Sourced from stefanzweifel/git-auto-commit-action's releases.

v7.1.0

Added

Add skip_push input option (#401) @kvanzuijlen

Changes

docs: fix typo in README.md (#400) @GideonBear

Dependency Updates

Bump actions/checkout from 5 to 6 (#399) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

Bump bats from 1.12.0 to 1.13.0 (#398) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.0.0

Added

Restore skip_fetch, skip_checkout, create_branch (#388) @stefanzweifel

Restore Detached State Detection (#393) @stefanzweifel

Add Support for Tag Messages (#391) @EliasBoulharts

Changed

Run Action on Node 24 (#389) @stefanzweifel

Dependency Updates

Bump actions/checkout from 4 to 5 (#386) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v6.0.1

Fixed

Disable Check if Repo is in Detached State (#379) @stefanzweifel

v6.0.0

Added

Throw error early if repository is in a detached state (#357)

Fixed

Fix PAT instructions with Dependabot (#376) @Dreamsorcerer

Removed

Remove support for create_branch, skip_checkout, skip_Fetch (#314)

Changelog

Sourced from stefanzweifel/git-auto-commit-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

TBD

v7.1.0 - 2025-12-17

Added

Add skip_push input option (#401) @kvanzuijlen

Changes

docs: fix typo in README.md (#400) @GideonBear

Dependency Updates

Bump actions/checkout from 5 to 6 (#399) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

Bump bats from 1.12.0 to 1.13.0 (#398) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.0.0 - 2025-10-12

Added

Restore skip_fetch, skip_checkout, create_branch (#388) @stefanzweifel

Restore Detached State Detection (#393) @stefanzweifel

Add Support for Tag Messages (#391) @EliasBoulharts

Changed

Run Action on Node 24 (#389) @stefanzweifel

Dependency Updates

Bump actions/checkout from 4 to 5 (#386) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v6.0.1 - 2025-06-11

Fixed

Disable Check if Repo is in Detached State (#379) @stefanzweifel

v6.0.0 - 2025-06-10

... (truncated)

Commits

04702ed Bump actions/checkout from 5 to 6 (#399)
1e49d50 Add skip_push input option (#401)
65c5677 docs: fix typo in README.md (#400)
547c140 Bump bats from 1.12.0 to 1.13.0 (#398)
8fa7f5a Update CHANGELOG
28e16e8 Release preparations for v7 (#394)
698fd76 Merge pull request #391 from EliasBoulharts/custom-tag-message
c40819a Update README
d7ee275 Change internal variable names
e8684eb Fix Tests
Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 8.0.0

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to false.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in actions/download-artifact#460

Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

New Contributors

@patrikpolyak made their first contribution in

…y with 14 updates Bumps the actions-version-updates group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.0` | `2.15.1` | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `6.0.2` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.7.1` | `4.9.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `4.0.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.17.0` | `7.0.0` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.288.0` | `1.290.0` | | [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) | `5.2.0` | `7.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.0` | | [JetBrains/qodana-action](https://github.com/jetbrains/qodana-action) | `201551778d1453e36c5c0aa26f89a94775cb1acc` | `f5aa2889b113c16bd6aee47817b027537ee33ac7` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.28.18` | `4.32.6` | | [mridang/action-test-reporter](https://github.com/mridang/action-test-reporter) | `1.2.5` | `1.7.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.0` | | [dorny/test-reporter](https://github.com/dorny/test-reporter) | `2.0.0` | `2.6.0` | Updates `step-security/harden-runner` from 2.12.0 to 2.15.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@0634a26...58077d3) Updates `actions/checkout` from 4.2.2 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...de0fac2) Updates `actions/dependency-review-action` from 4.7.1 to 4.9.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@da24556...2031cfc) Updates `docker/setup-buildx-action` from 3.10.0 to 4.0.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@b5ca514...4d04d5d) Updates `docker/build-push-action` from 6.17.0 to 7.0.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@1dc7386...d08e5c3) Updates `ruby/setup-ruby` from 1.288.0 to 1.290.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@09a7688...6ca151f) Updates `stefanzweifel/git-auto-commit-action` from 5.2.0 to 7.1.0 - [Release notes](https://github.com/stefanzweifel/git-auto-commit-action/releases) - [Changelog](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md) - [Commits](stefanzweifel/git-auto-commit-action@b863ae1...04702ed) Updates `actions/download-artifact` from 4.3.0 to 8.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...70fc10c) Updates `JetBrains/qodana-action` from 201551778d1453e36c5c0aa26f89a94775cb1acc to f5aa2889b113c16bd6aee47817b027537ee33ac7 - [Release notes](https://github.com/jetbrains/qodana-action/releases) - [Commits](JetBrains/qodana-action@2015517...f5aa288) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...4eaacf0) Updates `github/codeql-action` from 3.28.18 to 4.32.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff0a06e...0d579ff) Updates `mridang/action-test-reporter` from 1.2.5 to 1.7.0 - [Release notes](https://github.com/mridang/action-test-reporter/releases) - [Changelog](https://github.com/mridang/action-test-reporter/blob/master/release.config.mjs) - [Commits](mridang/action-test-reporter@v1.2.5...v1.7.0) Updates `actions/upload-artifact` from 4.6.2 to 7.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...bbbca2d) Updates `dorny/test-reporter` from 2.0.0 to 2.6.0 - [Release notes](https://github.com/dorny/test-reporter/releases) - [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md) - [Commits](dorny/test-reporter@6e6a65b...3d76b34) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/dependency-review-action dependency-version: 4.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: docker/setup-buildx-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: docker/build-push-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: ruby/setup-ruby dependency-version: 1.290.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: stefanzweifel/git-auto-commit-action dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/download-artifact dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: JetBrains/qodana-action dependency-version: f5aa2889b113c16bd6aee47817b027537ee33ac7 dependency-type: direct:production dependency-group: actions-version-updates - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-version-updates - dependency-name: github/codeql-action dependency-version: 4.32.6 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: mridang/action-test-reporter dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: dorny/test-reporter dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the actions-version-updates group across 1 directory with 14 updates#81

chore(deps): bump the actions-version-updates group across 1 directory with 14 updates#81
dependabot[bot] wants to merge 1 commit intobetafrom
dependabot/github_actions/actions-version-updates-9860eba28c

dependabot bot commented on behalf of github Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 9, 2026

v2.15.1

What's Changed

v2.15.0

What's Changed

Windows and macOS runner support

v2.14.2

What's Changed

v2.14.1

What's Changed

v2.14.0

What's Changed

v2.13.3

What's Changed

v2.13.2

What's Changed

v6.0.2

What's Changed

v6.0.1

What's Changed

v6.0.0

What's Changed

v6-beta

What's Changed

v5.0.1

What's Changed

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

Dependency Review Action 4.9.0

What's Changed

New Contributors

4.8.3

Dependency Review Action v4.8.3

What's Changed

v4.8.2

v4.0.0

v3.12.0

v3.11.1

v3.11.0

v7.0.0

v6.19.2

v6.19.1

v6.19.0

v6.18.0

v1.290.0

What's Changed

New Contributors

v1.289.0

What's Changed

v7.1.0

Added

Changes

Dependency Updates

v7.0.0

Added

Changed

Dependency Updates

v6.0.1

Fixed

v6.0.0

Added

Fixed

Removed

Changelog

Unreleased