Skip to content

build(deps): Update github-actions dependencies - #431

Open
voraus-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-dependencies
Open

build(deps): Update github-actions dependencies#431
voraus-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-dependencies

Conversation

@voraus-renovate

@voraus-renovate voraus-renovate Bot commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/create-github-app-token action minor v3.2.0 → v3.3.0
astral-sh/setup-uv action minor v10.2.0 → v10.3.2
jfrog-cli uses-with minor 2.126.0 → 2.128.0
jfrog/setup-jfrog-cli action minor v5.2.0 → v5.3.1
pypa/gh-action-pypi-publish action patch v1.14.2 → v1.14.3
zizmorcore/zizmor-action action minor v0.6.4 → v0.8.0

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
astral-sh/setup-uv

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes
🧰 Maintenance
📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates
jfrog/jfrog-cli (jfrog-cli)

v2.128.0: What changed in v2.128.0

Compare Source

What changed in v2.128.0

Auto-generated from 4 repositories · 2026-10-20
Comparing v2.127.0 → v2.128.0

ℹ️ No changes in: build-info-go, gofrog, jfrog-cli-artifactory

✨ New Features
🐛 Bug Fixes
  • [jfrog-cli-security] Fix missing CA results when a watch with no CVE rule applied #​915 (@​eranturgeman)
  • [jfrog-cli-security] Fix License Violations On Unchanged Root Components During PR Diff Scans #​909 (@​orto17)
🔧 Internal Changes
  • [jfrog-cli-security] Addressed a gap in fully resolving the CVE-2026-92892 vulnerability in JFrog CLI v2.127.0.
📦 Other Changes
📊 Summary
Repository Changes
jfrog-cli-security 6
jfrog-cli 2
jfrog-cli-core 1
jfrog-client-go 1
Total 10
🔗 Module Version Changes
Module From To
jfrog-cli-core v2.60.1-0.20260925084932-b47892ded3a0 v2.60.1-0.20261016082348-25dbeb0335c0
jfrog-cli-security v1.40.0 v1.41.0
jfrog-client-go v1.55.1-0.20261013073510-6053434e9301 v1.55.1-0.20261014133608-3b4b900d8174

v2.127.0: 2.127.0

Compare Source

What changed in v2.127.0

Auto-generated from 3 repositories · 2026-10-13
Comparing v2.126.0 → v2.127.0

ℹ️ No changes in: build-info-go, gofrog, jfrog-cli-artifactory, jfrog-cli-core

✨ New Features
  • [jfrog-cli-security] Add jf xr status command to show artifact download-block status #​902 (@​orto17)
🐛 Bug Fixes
📦 Other Changes
📊 Summary
Repository Changes
jfrog-cli-security 5
jfrog-cli 1
Total 6
🔗 Module Version Changes
Module From To
jfrog-cli-security v1.39.1 v1.40.0
jfrog-client-go v1.55.1-0.20261005090941-0646d7b50f9a v1.55.1-0.20261013073510-6053434e9301

What's Changed

Other Changes 📚

Full Changelog: jfrog/jfrog-cli@v2.126.0...v2.127.0

jfrog/setup-jfrog-cli

v5.3.1

Compare Source

What's Changed

Other Changes 📚

Full Changelog: jfrog/setup-jfrog-cli@v5.3.0...v5.3.1

v5.3.0

Compare Source

What's Changed

Other Changes 📚

New Contributors

Full Changelog: jfrog/setup-jfrog-cli@v5.2.0...v5.3.0

pypa/gh-action-pypi-publish

v1.14.3

Compare Source

Keeping the community safe is a collaborative effort! 💛💙

[!important]
🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #​427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via #​420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

zizmorcore/zizmor-action

v0.8.0

Compare Source

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version
of zizmor or version: prerelease to get whatever latest
prerelease the action knows about.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

v0.7.1

Compare Source

zizmor changes

Bug Fixes 🐛🔗

  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#​2437)

  • The self-hosted-runner audit is now significantly more precise (#​2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

  • zizmor is now aware of the image_version workflow trigger (#​2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#​2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

  • Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

    Many thanks to @​marcalexiei for implementing this improvement!

  • Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

  • Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

  • Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

  • Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.6.4...v0.7.0

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@voraus-renovate voraus-renovate Bot added dependencies Pull requests that update a dependency file renovate labels Oct 9, 2026
@dokploy-2026-07-07-mi9i9n

dokploy-2026-07-07-mi9i9n Bot commented Oct 9, 2026

Copy link
Copy Markdown

🚨 Preview Deployment Blocked - Security Protection

Your pull request was blocked from triggering preview deployments

Why was this blocked?

  • User: voraus-renovate[bot]
  • Repository: vdoc
  • Permission Level: none
  • Required Level: write, maintain, or admin

How to resolve this:

Option 1: Get Collaborator Access (Recommended)
Ask a repository maintainer to invite you as a collaborator with write permissions or higher.

Option 2: Request Permission Override
Ask a repository administrator to disable security validation for this specific application if appropriate.

For Repository Administrators:

To disable this security check (⚠️ not recommended for public repositories):
Enter to preview settings and disable the security check.

This security measure protects against malicious code execution in preview deployments. Only trusted collaborators should have the ability to trigger deployments.

🛡️ Learn more about this security feature

This protection prevents unauthorized users from:

  • Executing malicious code on the deployment server
  • Accessing environment variables and secrets
  • Potentially compromising the infrastructure

Preview deployments are powerful but require trust. Only users with repository write access can trigger them.

4 similar comments
@dokploy-2026-07-07-mi9i9n

dokploy-2026-07-07-mi9i9n Bot commented Oct 9, 2026

Copy link
Copy Markdown

🚨 Preview Deployment Blocked - Security Protection

Your pull request was blocked from triggering preview deployments

Why was this blocked?

  • User: voraus-renovate[bot]
  • Repository: vdoc
  • Permission Level: none
  • Required Level: write, maintain, or admin

How to resolve this:

Option 1: Get Collaborator Access (Recommended)
Ask a repository maintainer to invite you as a collaborator with write permissions or higher.

Option 2: Request Permission Override
Ask a repository administrator to disable security validation for this specific application if appropriate.

For Repository Administrators:

To disable this security check (⚠️ not recommended for public repositories):
Enter to preview settings and disable the security check.

This security measure protects against malicious code execution in preview deployments. Only trusted collaborators should have the ability to trigger deployments.

🛡️ Learn more about this security feature

This protection prevents unauthorized users from:

  • Executing malicious code on the deployment server
  • Accessing environment variables and secrets
  • Potentially compromising the infrastructure

Preview deployments are powerful but require trust. Only users with repository write access can trigger them.

@dokploy-2026-07-07-mi9i9n

dokploy-2026-07-07-mi9i9n Bot commented Oct 9, 2026

Copy link
Copy Markdown

🚨 Preview Deployment Blocked - Security Protection

Your pull request was blocked from triggering preview deployments

Why was this blocked?

  • User: voraus-renovate[bot]
  • Repository: vdoc
  • Permission Level: none
  • Required Level: write, maintain, or admin

How to resolve this:

Option 1: Get Collaborator Access (Recommended)
Ask a repository maintainer to invite you as a collaborator with write permissions or higher.

Option 2: Request Permission Override
Ask a repository administrator to disable security validation for this specific application if appropriate.

For Repository Administrators:

To disable this security check (⚠️ not recommended for public repositories):
Enter to preview settings and disable the security check.

This security measure protects against malicious code execution in preview deployments. Only trusted collaborators should have the ability to trigger deployments.

🛡️ Learn more about this security feature

This protection prevents unauthorized users from:

  • Executing malicious code on the deployment server
  • Accessing environment variables and secrets
  • Potentially compromising the infrastructure

Preview deployments are powerful but require trust. Only users with repository write access can trigger them.

@dokploy-2026-07-07-mi9i9n

dokploy-2026-07-07-mi9i9n Bot commented Oct 9, 2026

Copy link
Copy Markdown

🚨 Preview Deployment Blocked - Security Protection

Your pull request was blocked from triggering preview deployments

Why was this blocked?

  • User: voraus-renovate[bot]
  • Repository: vdoc
  • Permission Level: none
  • Required Level: write, maintain, or admin

How to resolve this:

Option 1: Get Collaborator Access (Recommended)
Ask a repository maintainer to invite you as a collaborator with write permissions or higher.

Option 2: Request Permission Override
Ask a repository administrator to disable security validation for this specific application if appropriate.

For Repository Administrators:

To disable this security check (⚠️ not recommended for public repositories):
Enter to preview settings and disable the security check.

This security measure protects against malicious code execution in preview deployments. Only trusted collaborators should have the ability to trigger deployments.

🛡️ Learn more about this security feature

This protection prevents unauthorized users from:

  • Executing malicious code on the deployment server
  • Accessing environment variables and secrets
  • Potentially compromising the infrastructure

Preview deployments are powerful but require trust. Only users with repository write access can trigger them.

@dokploy-2026-07-07-mi9i9n

dokploy-2026-07-07-mi9i9n Bot commented Oct 9, 2026

Copy link
Copy Markdown

🚨 Preview Deployment Blocked - Security Protection

Your pull request was blocked from triggering preview deployments

Why was this blocked?

  • User: voraus-renovate[bot]
  • Repository: vdoc
  • Permission Level: none
  • Required Level: write, maintain, or admin

How to resolve this:

Option 1: Get Collaborator Access (Recommended)
Ask a repository maintainer to invite you as a collaborator with write permissions or higher.

Option 2: Request Permission Override
Ask a repository administrator to disable security validation for this specific application if appropriate.

For Repository Administrators:

To disable this security check (⚠️ not recommended for public repositories):
Enter to preview settings and disable the security check.

This security measure protects against malicious code execution in preview deployments. Only trusted collaborators should have the ability to trigger deployments.

🛡️ Learn more about this security feature

This protection prevents unauthorized users from:

  • Executing malicious code on the deployment server
  • Accessing environment variables and secrets
  • Potentially compromising the infrastructure

Preview deployments are powerful but require trust. Only users with repository write access can trigger them.

@codecov

codecov Bot commented Oct 9, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@voraus-renovate
voraus-renovate Bot force-pushed the renovate/github-actions-dependencies branch from 9f14826 to d1c0b1e Compare October 13, 2026 00:16
@voraus-renovate voraus-renovate Bot changed the title build(deps): Update astral-sh/setup-uv action to v10.3.0 build(deps): Update github-actions dependencies Oct 13, 2026
@codecov

codecov Bot commented Oct 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@voraus-renovate
voraus-renovate Bot force-pushed the renovate/github-actions-dependencies branch 6 times, most recently from 4f590fd to 262d4ff Compare October 20, 2026 16:10
@voraus-renovate
voraus-renovate Bot force-pushed the renovate/github-actions-dependencies branch 6 times, most recently from 5ff7dfe to c774d18 Compare October 23, 2026 07:15
@g3n35i5
Jan-Frederik Schmidt (g3n35i5) force-pushed the renovate/github-actions-dependencies branch from c774d18 to f951ca9 Compare October 26, 2026 12:32
@voraus-renovate

voraus-renovate Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@g3n35i5 Jan-Frederik Schmidt (g3n35i5) Awaiting requested review from g3n35i5 g3n35i5 is a code owner
@MichaelBarulin Michael Barulin (MichaelBarulin) Awaiting requested review from MichaelBarulin MichaelBarulin is a code owner
@jojolc Johanna (jojolc) Awaiting requested review from jojolc jojolc is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants