Bump the github-actions-deps group across 1 directory with 4 updates by dependabot[bot] · Pull Request #339 · ASFHyP3/actions

dependabot · 2026-07-20T12:34:24Z

Bumps the github-actions-deps group with 4 updates in the / directory: actions/checkout, actions/setup-python, akhilerm/tag-push-action and trufflesecurity/trufflehog.

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in actions/checkout#2475

Bump actions/setup-node from 4 to 6 by @dependabot[bot] in actions/checkout#2477

Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in actions/checkout#2478

Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2479

Bump actions/checkout from 6 to 7 by @dependabot[bot] in actions/checkout#2488

Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in actions/checkout#2476

eslint 9 by @dependabot[bot] in actions/checkout#2474

Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in actions/checkout#2499

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
See full diff in compare view

Updates actions/setup-python from 6 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-python#1330

Pin SHA commits and update docs with latest versions by @HarithaVattikuti in actions/setup-python#1338

Remove the pip-install input by @gowridurgad in actions/setup-python#1336

Bug Fix

Fix to Classify stderr warning messages as warnings instead of errors in annotations by @lmvysakh in actions/setup-python#1335

Validate and retry manifest fetch to prevent silent failures by @priyagupta108 in actions/setup-python#1332

Dependency Upgrade

Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @dependabot in actions/setup-python#1328

Remove EOL Python versions and Bumps numpy text fixture by @priya-kinthali in actions/setup-python#1333

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-python#1337

New Contributors

@lmvysakh made their first contribution in actions/setup-python#1335

@philip-gai made their first contribution in actions/setup-python#1337

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Add RHEL support and include Linux distro in cache keys by @priyagupta108 in actions/setup-python#1323

Fix pip cache error handling on Windows by @priyagupta108 in actions/setup-python#1040

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-python#1281

Upgrade actions dependencies by @gowridurgad with @Copilot in actions/setup-python#1303

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-python#1324

Upgrade dependency versions and test workflow configuration by @HarithaVattikuti in actions/setup-python#1322

Documentation

Update advanced-usage.md by @Dunky-Z in actions/setup-python#811

New Contributors

@gowridurgad with @Copilot made their first contribution in actions/setup-python#1303

@jasongin made their first contribution in actions/setup-python#1324

@Dunky-Z made their first contribution in actions/setup-python#811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

Upgrade dependencies to Node 24 compatible versions by @salmanmkc in actions/setup-python#1259

... (truncated)

Commits

5fda3b9 Pin SHA commits and update docs with latest versions (#1338)
4ab7e95 Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-0
0f3a009 Remove the pip-install input (#1336)
f8cf429 Migrate to ESM and upgrade dependencies (#1330)
54baeea Validate and retry manifest fetch to prevent silent failures (#1332)
c709277 Annotation code fix (#1335)
6849080 remove EOL Python versions and Bumps numpy text fixture (#1333)
0903b46 Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)
See full diff in compare view

Updates akhilerm/tag-push-action from 2.2.0 to 2.3.0

Release notes

Sourced from akhilerm/tag-push-action's releases.

v2.3.0

Highlights

The action now runs on the Node 24 runtime.

What's Changed

internal split into src/index.ts / src/main.ts for cleaner testing.

Dependency updates:

Bump typescript from 4.8.4 to 4.9.5 by @dependabot in akhilerm/tag-push-action#363

Bump actions/checkout from 4 to 6 by @dependabot in akhilerm/tag-push-action#375

Bump prettier from 3.1.0 to 3.8.4 by @dependabot in akhilerm/tag-push-action#376, akhilerm/tag-push-action#385

Bump @types/node from 20.10.5 to 25.9.2 by @dependabot in akhilerm/tag-push-action#377

Bump csv-parse from 5.3.1 to 6.2.1 by @dependabot in akhilerm/tag-push-action#378

Bump @vercel/ncc from 0.34.0 to 0.44.0 by @dependabot in akhilerm/tag-push-action#379, akhilerm/tag-push-action#390

Bump docker/login-action from 1 to 4 by @akhilerm in akhilerm/tag-push-action#380

Bump ts-jest from 27.1.5 to 29.4.11 by @dependabot in akhilerm/tag-push-action#382

Bump eslint-plugin-prettier from 5.1.2 to 5.5.6 by @dependabot in akhilerm/tag-push-action#383

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot in akhilerm/tag-push-action#384

Bump eslint-plugin-github from 4.4.1 to 6.0.0 by @dependabot in akhilerm/tag-push-action#386

Bump jest-circus from 29.7.0 to 30.4.2 by @dependabot in akhilerm/tag-push-action#389

Bump eslint-plugin-jest from 27.9.0 to 29.15.2 by @dependabot in akhilerm/tag-push-action#391

Bump jest and @types/jest by @dependabot in akhilerm/tag-push-action#392

CI / testing

Added a self-contained copy test against a local authenticated registry.

Moved the live docker.io <> quay.io copy test to a daily scheduled run

Full changelog: akhilerm/tag-push-action@v2.2.0...v2.3.0

Commits

eadeefe Merge pull request #389 from akhilerm/dependabot/npm_and_yarn/jest-circus-30.4.2
8962cb7 Bump jest-circus from 29.7.0 to 30.4.2
28c3d7f Merge pull request #390 from akhilerm/dependabot/npm_and_yarn/vercel/ncc-0.44.0
0ecaec2 Merge pull request #391 from akhilerm/dependabot/npm_and_yarn/eslint-plugin-j...
c248b0c Merge pull request #392 from akhilerm/dependabot/npm_and_yarn/multi-cbfe5253e3
d702ee0 Merge pull request #393 from akhilerm/fix-verify-multiarch-digest
efcee57 Verify registry digests instead of local image IDs
a5909e0 Bump jest and @types/jest
231bdfa Bump eslint-plugin-jest from 27.9.0 to 29.15.2
d15340e Bump @vercel/ncc from 0.38.4 to 0.44.0
Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.95.4 to 3.95.9

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.9

What's Changed

feat: add OpenRouter detector by @McPatate in trufflesecurity/trufflehog#4500

Integrations fully codeowns detectors by @trufflesteeeve in trufflesecurity/trufflehog#5104

[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in trufflesecurity/trufflehog#4778

[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4795

[INS-341] Added Shippo detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4820

[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in trufflesecurity/trufflehog#4970

fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in trufflesecurity/trufflehog#5112

[INS-468] Add improved lob detector to defaults.go by @mustansir14 in trufflesecurity/trufflehog#4971

feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in trufflesecurity/trufflehog#4965

feat: Support archived repo exclusion from GH org scans by @hibare in trufflesecurity/trufflehog#4875

[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in trufflesecurity/trufflehog#5117

[INS-410] Added batch token detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4824

[INT-650] Don't log as error when git diff is too long by @bill-rich in trufflesecurity/trufflehog#5113

New Contributors

@McPatate made their first contribution in trufflesecurity/trufflehog#4500

@eightseventhreethree made their first contribution in trufflesecurity/trufflehog#4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in trufflesecurity/trufflehog#5068

fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in trufflesecurity/trufflehog#5043

Add prometheus metrics for engine channels and workers by @mcastorina in trufflesecurity/trufflehog#5095

[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5072

[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4787

Fix Syntax error in feature.go by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5109

Include encoded resume info instead of clobbering it by @bill-rich in trufflesecurity/trufflehog#5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in trufflesecurity/trufflehog#5041

test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in trufflesecurity/trufflehog#5053

fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in trufflesecurity/trufflehog#5029

Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in trufflesecurity/trufflehog#4774

fix: add git worktree support in PrepareRepo by @andoniaf in trufflesecurity/trufflehog#4690

[INS-406] Braintrust detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4826

huggingface: add bucket scanning by @julien-c in trufflesecurity/trufflehog#5017

Skip reverification results during deduplication by @mcastorina in trufflesecurity/trufflehog#5069

chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in trufflesecurity/trufflehog#5044

Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in trufflesecurity/trufflehog#4775

Expose SecretParts in the JSON output by @bradlarsen in trufflesecurity/trufflehog#5073

[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4993

[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4995

... (truncated)

Commits

27b0417 Don't log as error when git diff is too long (#5113)
d328285 [INS-410] Added batch token detector (#4824)
33d9dad [INT-715] Retry transient failures when verifying OpenAI keys (#5117)
d7dcc6d feat: Support archived repo exclusion from GH org scans (#4875)
f845f18 feat(action): add image input to allow registry mirror overrides (#4965)
6c97970 [INS-468] Add improved lob detector to defaults.go (#4971)
1675e17 fix: reject --include-repos/--exclude-repos with --repo in github scan (#5112)
5c27626 [INS-467] Add IPinfo detector to default detectors list (#4970)
53e6391 [INS-341] Added Shippo detector (#4820)
d3b5487 [INS-351] Added Duffel Token Detector (#4795)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions-deps group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-python](https://github.com/actions/setup-python), [akhilerm/tag-push-action](https://github.com/akhilerm/tag-push-action) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) Updates `actions/setup-python` from 6 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) Updates `akhilerm/tag-push-action` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/akhilerm/tag-push-action/releases) - [Commits](akhilerm/tag-push-action@v2.2.0...v2.3.0) Updates `trufflesecurity/trufflehog` from 3.95.4 to 3.95.9 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@v3.95.4...v3.95.9) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-deps - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-deps - dependency-name: akhilerm/tag-push-action dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-deps - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added bumpless Changes to documentation, CI/CD pipelines, etc that don't affect the project's version major Bump the major version number of this project labels Jul 20, 2026

dependabot Bot requested review from a team as code owners July 20, 2026 12:34

dependabot Bot added bumpless Changes to documentation, CI/CD pipelines, etc that don't affect the project's version major Bump the major version number of this project labels Jul 20, 2026

Navigation Menu

Uh oh!

Bump the github-actions-deps group across 1 directory with 4 updates - #339

Bump the github-actions-deps group across 1 directory with 4 updates#339
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/github_actions/github-actions-deps-8ebe600274

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.0

What's Changed

New Contributors

v6.0.3

What's Changed

New Contributors

v6.0.2

What's Changed

v6.0.1

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

v6.2.0

What's Changed

Dependency Upgrades

v2.3.0

Highlights

What's Changed

CI / testing

v3.95.9

What's Changed

New Contributors

v3.95.8

What's Changed

v3.95.7

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading