Update GitHub Actions (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v2.4.0 → v7.0.1
actions/checkout	action	major	v3 → v7
actions/setup-dotnet	action	major	v1 → v6
actions/setup-node	action	major	v2 → v7
actions/stale	action	major	v4 → v11
codecov/codecov-action	action	major	v2 → v7
node	uses-with	major	14 → 24
suzuki-shunsuke/github-action-renovate-config-validator	action	major	v0.1.2 → v2.1.0

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v5.1.0

Compare Source

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v5.0.0

Compare Source

• Update actions checkout to use node 24 by @​salmanmkc in #​2226

v4.4.0

Compare Source

v4.3.1

Compare Source

• Port v6 cleanup to v4 by @​ericsciple in #​2305

v4.3.0

Compare Source

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236

v4.2.2

Compare Source

• url-helper.ts now leverages well-known environment variables by @​jww3 in #​1941
• Expand unit test coverage for isGhes by @​jww3 in #​1946

v4.2.1

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in #​1924

v4.2.0

Compare Source

• Add Ref and Commit outputs by @​lucacome in #​1180
• Dependency updates by @​dependabot- #​1777, #​1872

v4.1.7

Compare Source

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in #​1739
• Bump actions/checkout from 3 to 4 by @​dependabot in #​1697
• Check out other refs/* by commit by @​orhantoy in #​1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in #​1776

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in #​1732

v4.1.5

Compare Source

• Update NPM dependencies by @​cory-miller in #​1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in #​1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in #​1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in #​1695
• README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @​cory-miller in #​1707

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in #​1692
• Add dependabot config by @​cory-miller in #​1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in #​1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in #​1643

v4.1.3

Compare Source

• Check git version before attempting to disable sparse-checkout by @​jww3 in #​1656
• Add SSH user parameter by @​cory-miller in #​1685
• Update actions/checkout version in update-main-version.yml by @​jww3 in #​1650

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598

v4.1.1

Compare Source

• Correct link to GitHub Docs by @​peterbe in #​1511
• Link to release page from what's new section by @​cory-miller in #​1514

v4.1.0

Compare Source

• Add support for partial checkout filters

v4.0.0

Compare Source

• Support fetching without the --progress option
• Update to node20

v3.7.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v3 by @​aiqiaoy in #​2503
• backport fixes to releases-v3 by @​aiqiaoy in #​2525

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v3.6.0...v3.7.0

v3.6.0

Compare Source

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

v3.5.3

Compare Source

• Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in
• Fix typos found by codespell
• Add support for sparse checkouts

v3.5.2

Compare Source

• Fix api endpoint for GHES

v3.5.1

Compare Source

• Fix slow checkout on Windows

v3.5.0

Compare Source

• Add new public key for known_hosts

v3.4.0

Compare Source

• Upgrade codeql actions to v2
• Upgrade dependencies
• Upgrade @​actions/io

v3.3.0

Compare Source

• Implement branch list using callbacks from exec function
• Add in explicit reference to private checkout options
• Fix comment typos (that got added in #​770)

v3.2.0

Compare Source

• Add GitHub Action to perform release
• Fix status badge
• Replace datadog/squid with ubuntu/squid Docker image
• Wrap pipeline commands for submoduleForeach in quotes
• Update @​actions/io to 1.1.2
• Upgrading version to 3.2.0

v3.1.0

Compare Source

• Use @​actions/core saveState and getState
• Add github-server-url input

v3.0.2

Compare Source

• Add input set-safe-directory

v3.0.1

Compare Source

• Fixed an issue where checkout failed to run in container jobs due to the new git setting safe.directory
• Bumped various npm package versions

v3.0.0

Compare Source

• Update to node 16

v2.8.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v2 by @​aiqiaoy in #​2504
• backport fixes to releases-v2 by @​aiqiaoy in #​2526

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v2.7.0...v2.8.0

v2.7.0

Compare Source

What's Changed

• Add new public key for known_hosts (#​1237) by @​TingluoHuang in #​1238

Full Changelog: actions/checkout@v2.6.0...v2.7.0

v2.6.0

Compare Source

What's Changed

• Add backports to v2 branch by @​cory-miller in #​1040
  • Includes backports from the following changes: #​964, #​1002, #​1029
  • Upgraded the licensed version to match what is used in v3.

Full Changelog: actions/checkout@v2.5.0...v2.6.0

v2.5.0

Compare Source

What's Changed

• Update @​actions/core to 1.10.0 by @​rentziass in #​962

Full Changelog: actions/checkout@v2...v2.5.0

v2.4.2

Compare Source

What's Changed

• Add set-safe-directory input to allow customers to take control. (#​770) by @​TingluoHuang in #​776
• Prepare changelog for v2.4.2. by @​TingluoHuang in #​778

Full Changelog: actions/checkout@v2...v2.4.2

v2.4.1

Compare Source

• Fixed an issue where checkout failed to run in container jobs due to the new git setting safe.directory

actions/setup-dotnet (actions/setup-dotnet)

v6.0.0

Compare Source

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​752
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​751
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​756

New Contributors

• @​philip-gai made their first contribution in #​756

Full Changelog: actions/setup-dotnet@v5...v6.0.0

v5.4.0

Compare Source

What's Changed

Enhancements

• Improve global.json SDK version validation for rollForward by @​priyagupta108 in #​742
• Pin actions to commit SHAs in workflows by @​priya-kinthali in #​744
• Expand the CSC problem matcher to light up more errors on GitHub. by @​StephenCleary in #​717

Documentation

• Docs(action): Explicitly mark all optional inputs with required: false by @​kranthipoturaju in #​737

Bug Fixes

• Fix global.json creation command by @​michal2612 in #​694

Dependency Updates

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​746

New Contributors

• @​jasongin made their first contribution in #​746
• @​michal2612 made their first contribution in #​694
• @​kranthipoturaju made their first contribution in #​737
• @​StephenCleary made their first contribution in #​717

Full Changelog: actions/setup-dotnet@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

Enhancements

• Add dotnet-version: latest support with dotnet-channel input by @​mahabaleshwars in #​730
• Support global.json's rollForward latest* variants by @​js6pak in #​538
• Improve version resolution by @​akoeplinger in #​560

Dependency Updates

• Upgrade @​actions/* and fast-xml-parser dependencies by @​Copilot in #​728
• Update install scripts to v2026.05.19 (preserve archive links) by @​MichaelSimons in #​736
• Add rollForward note in README, improve proxy health check in e2e tests and bump version to v5.3.0 by @​priyagupta108 in #​738

Bug Fixes

• Update Test Proxy job by @​priya-kinthali in #​703

New Contributors

• @​Copilot made their first contribution in #​728
• @​akoeplinger made their first contribution in #​560
• @​MichaelSimons made their first contribution in #​736
• @​js6pak made their first contribution in #​538

Full Changelog: actions/setup-dotnet@v5...v5.3.0

v5.2.0

Compare Source

What's changed

Enhancements

• Add support for workloads input by @​gowridurgad in #​693
• Add support for optional architecture input for cross-architecture .NET installs by @​priya-kinthali in #​700

Dependency Updates

• Upgrade fast-xml-parser from 4.4.1 to 5.3.6 by @​dependabot in #​671
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​705

Full Changelog: actions/setup-dotnet@v5...v5.2.0

v5.1.0

Compare Source

What's Changed

Documentation

• Readme update for environment variable on self hosted linux runners by @​priya-kinthali in #​689
• Contributor icon updates by @​Falco20019 in #​604

Dependency updates

• Upgrade actions/checkout from 5 to 6 by @​dependabot in #​684
• Upgrade to latest actions packages by @​salmanmkc in #​687
• Upgrade dependencies in testproject and checkout in Readme by @​priya-kinthali in #​692

New Contributors

• @​priya-kinthali made their first contribution in #​689
• @​Falco20019 made their first contribution in #​604

Full Changelog: actions/setup-dotnet@v5...v5.1.0

v5.0.1

Compare Source

What's Changed

• Upgrade typescript from 5.4.2 to 5.9.2 and document breaking changes in v5 by @​dependabot in #​624
• Upgrade eslint-plugin-jest from 27.9.0 to 29.0.1 by @​dependabot in #​648
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 and update macos-13 to macos-15-intel by @​dependabot in #​665

Full Changelog: actions/setup-dotnet@v5...v5.0.1

v5.0.0

Compare Source

What's Changed

Breaking Changes

• Upgrade to Node.js 24 and modernize async usage by @​salmanmkc in #​654

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Updates

• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​aparnajyothi-y in #​622
• Upgrade husky from 8.0.3 to 9.1.7 by @​dependabot[bot] in #​591
• Upgrade @​actions/glob from 0.4.0 to 0.5.0 by @​dependabot[bot] in #​594
• Upgrade eslint-config-prettier from 9.1.0 to 10.1.5 by @​dependabot[bot] in #​639
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in #​641
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in #​652
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​662

Bug Fixes

• Remove Support for older .NET Versions and Update installers scripts by @​gowridurgad in #​647

New Contributors

• @​gowridurgad made their first contribution in #​647
• @​salmanmkc made their first contribution in #​654

Full Changelog: actions/setup-dotnet@v4...v5.0.0

v4.3.1

Compare Source

What's Changed

• v4 - Remove azureedge.net fallback logic and update install scripts by @​zaataylor in #​572
  As outlined in Critical .NET Install Links Are Changing, remove the storage account fallback logic added for v4 in #​566 and update the install scripts accordingly.
  Related issue: dotnet/install-scripts#559
• upgrade @​actions/cache to 4.0.2 by @​HarithaVattikuti in #​615

Full Changelog: actions/setup-dotnet@v4...v4.3.1

v4.3.0

Compare Source

What's Changed

• README update - add permissions section by @​benwells in #​587
• Configure Dependabot settings by @​HarithaVattikuti in #​585
• Upgrade cache from 3.2.4 to 4.0.0 by @​aparnajyothi-y in #​586
• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot in #​590
• Upgrade @​actions/http-client from 2.2.1 to 2.2.3 by @​dependabot in #​592
• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot in #​596

New Contributors

• @​benwells made their first contribution in #​587
• @​aparnajyothi-y made their first contribution in #​586

Full Changelog: actions/setup-dotnet@v4...v4.3.0

v4.2.0

Compare Source

What's Changed

• Enhance Workflows, Update Dependencies and Installer Scripts by @​priyagupta108 in #​555
• V4 - Use new .NET CDN URLs and update to latest install scripts by @​heavymachinery in #​566

Some .NET binaries and installers currently hosted on Azure Content Delivery Network (CDN) domains ending in .azureedge.net will move to new domains as the provider, edg.io, will soon cease operations. There may be downtime or unavailability of .azureedge.net domains in the future as the .NET team is required to migrate to a new CDN and set of domains moving forward.

If your workflows are pinned to specific SHAs or minor tags, please upgrade to a major release tag to avoid service disruptions. Edgio has confirmed their services will be operational until at least January 15, 2025.

For updates, follow dotnet/core#9671.

New Contributors

• @​priyagupta108 made their first contribution in #​555
• @​heavymachinery made their first contribution in #​566

Full Changelog: actions/setup-dotnet@v4...v4.2.0

v4.1.0

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​Jcambass in #​548
• Upgrade IA Publish by @​Jcambass in #​550

Bug fixes :

• Fixed Basic Validation failure checks by @​HarithaVattikuti in #​545
• Revise isGhes logic by @​jww3 in #​556

Dependency updates :

• Bump fast-xml-parser from 4.3.6 to 4.4.1 by @​dependabot in #​540

New Contributors

• @​Jcambass made their first contribution in #​548
• @​jww3 made their first contribution in #​556

Full Changelog: actions/setup-dotnet@v4...v4.1.0

v4.0.1

Compare Source

What's Changed

Documentation changes:

• Update README.md to use latest action version by @​mikes-gh in #​502
• Update links to runner software by @​samuel-w in #​499

Dependency updates:

• Bump undici from 5.27.2 to 5.28.3 by @​dependabot in #​515
• Bump braces from 3.0.2 to 3.0.3 and other dependency updates by @​dependabot in #​533

New Contributors

• @​mikes-gh made their first contribution in #​502
• @​samuel-w made their first contribution in #​499

Full Changelog: actions/setup-dotnet@v4...v4.0.1

v4.0.0

Compare Source

What's Changed

In the scope of this release, the version of the Node.js runtime was updated to 20. The majority of dependencies were updated to the latest versions. From now on, the code for the setup-dotnet will run on Node.js 20 instead of Node.js 16.

Breaking changes

• Update Node.js runtime to version 20 by @​harithavattikuti in #​484
• Sequential version install fix by @​nikolai-laevskii in #​433
  In setup-dotnet@​v3, the dotnet executable was overwritten during each action run, sometimes leading to failures if the executable was still in use. This issue was resolved in setup-dotnet@​v4 by introducing an additional install-script run that installs the LTS version of the dotnet executable and utilizes it for all subsequent dotnet installations. The actual download is performed only once per workflow by the initial install-script run. To use older versions, utilize global.json. For more details, refer to the documentation.

Non-breaking changes

• Refactor installer by @​nikolai-laevskii in #​432
• Allow json comments by @​nikolai-laevskii in #​431
• Update fast-xml-parser and dotnet installer scripts by @​IvanZosimov in #​437
• Update dependencies by @​IvanZosimov in #​440
• Bump word-wrap from 1.2.3 to 1.2.4 by @​dependabot in #​444
• Update installers by @​nikolai-laevskii in #​462
• Update semver by @​dmitry-shibanov in #​468

New Contributors

• @​HarithaVattikuti made their first contribution in #​484

Full Changelog: actions/setup-dotnet@v3...v4.0.0

v3.4.2

Compare Source

What's Changed

• Update the file name publish-immutable-actions to publish-immutable-action by @​aparnajyothi-y in #​630

Full Changelog: actions/setup-dotnet@v3...v3.4.2

v3.4.1

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​aparnajyothi-y in #​627

Full Changelog: actions/setup-dotnet@v3...v3.4.1

v3.4.0

Compare Source

What's Changed

• Update actions/cache to 4.0.3 by @​mahabaleshwars in #​620
  In scope of this release we updated actions/cache package to ensure continuous support and compatibility, as older versions of the package are now deprecated. For more information please refer to the toolkit/cache.

New Contributors

• @​mahabaleshwars made their first contribution in #​620

Full Changelog: actions/setup-dotnet@v3...v3.4.0

v3.3.1

Compare Source

What's Changed

• v3 - Remove azureedge.net fallback logic and update install scripts by @​zaataylor in #​573
  As outlined in Critical .NET Install Links Are Changing, remove the storage account fallback logic added for v3 in #​567 and update the install scripts accordingly.
  Related issue: dotnet/install-scripts#559

Full Changelog: actions/setup-dotnet@v3...v3.3.1

v3.3.0

Compare Source

What's Changed

• V3 - Use new .NET CDN URLs and update to latest install scripts by @​HarithaVattikuti in #​567

Some .NET binaries and installers currently hosted on Azure Content Delivery Network (CDN) domains ending in .azureedge.net will move to new domains as the provider, edg.io, will soon cease operations. There may be downtime or unavailability of .azureedge.net domains in the future as the .NET team is required to migrate to a new CDN and set of domains moving forward.

If your workflows are pinned to specific SHAs or minor tags, please upgrade to a major release tag to avoid service disruptions. Edgio has confirmed their services will be operational until at least January 15, 2025.

For updates, follow dotnet/core#9671.

Full Changelog: actions/setup-dotnet@v3.2.0...v3.3.0

v3.2.0

Compare Source

What's Changed

In scope of this minor release, the ability to cache the NuGet global-packages folder was added in #​303 by @​nogic1008

For caching, the action uses the @​toolkit/cache library under the hood, which in turn allows getting rid of configuring the @​actions/cache action separately.

Such input parameters as cache and cache-dependency-path were added. The cache input is optional, and caching is turned off by default, cache-dependency-path is used to specify the path to a dependency file - packages.lock.json.

Example of use-case:

- uses: actions/setup-dotnet@v3
  with:
    dotnet-version: 6.x
    cache: true
    cache-dependency-path: subdir/packages.lock.json

More details can be found in the action's documentation.

Full Changelog: actions/setup-dotnet@v3...v3.2.0

v3.1.0

Compare Source

What's Changed

This minor release includes the following new features:

• The latest patch syntax was added in #​428 by @​IvanZosimov

- uses: actions/setup-dotnet@v3
  with:
    dotnet-version: '7.0.2xx'

More details about the new syntax can be found here.

• The global-json-file input was updated to accept absolute paths in #​396 by @​othmane-kinane-nw
• Error messages were made more informative in #​375 by @​IvanZosimov
• Notification if the global.json was not found in the root directory was added in #​344 by @​teo-tsirpanis

It also contains several infrastructure changes:

• Update to latest actions/publish-action by @​JamesMGreene in #​348
• Update version of publish-action by @​MaksimZhukov in #​368
• Update action to use reusable workflows by @​IvanZosimov in #​358
• Update workfl

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.