chore(deps): bump the all-github-actions group across 1 directory with 14 updates by dependabot[bot] · Pull Request #1037 · github/gh-aw-firewall

dependabot · 2026-02-25T19:05:53Z

Bumps the all-github-actions group with 14 updates in the / directory:

Package	From	To
github/gh-aw	`0.47.0`	`0.50.3`
actions/download-artifact	`6.0.0`	`7.0.0`
actions/setup-dotnet	`4.3.1`	`5.1.0`
actions/setup-go	`5.4.0`	`6.2.0`
actions/setup-java	`4.8.0`	`5.2.0`
actions/cache	`4.3.0`	`5.0.3`
aquasecurity/trivy-action	`0.33.1`	`0.34.1`
amannn/action-semantic-pull-request	`5`	`6`
docker/login-action	`3.6.0`	`3.7.0`
docker/setup-qemu-action	`3.2.0`	`3.7.0`
sigstore/cosign-installer	`3.5.0`	`4.0.0`
docker/build-push-action	`5.4.0`	`6.19.2`
anchore/sbom-action	`0.22.2`	`0.23.0`
actions/setup-python	`5.6.0`	`6.2.0`

Updates github/gh-aw from 0.47.0 to 0.50.3

Release notes

Sourced from github/gh-aw's releases.

v0.50.3

🌟 Release Highlights

This release focuses on reliability and correctness improvements — fixing data races, MCP context management, safe-outputs permissions, and compiler diagnostics. Dependency and tooling updates keep everything fresh.

🐛 Bug Fixes & Improvements

add-comment now emits pull-requests: write by default — Previously, workflows using add-comment safe-outputs would fail with "Resource not accessible by integration" when commenting on PRs because the compiler only emitted issues: write. The compiler now correctly emits both issues: write and pull-requests: write, and provides new issues/pull-requests/discussions flags for fine-grained control. (#18318)

Eliminated a sync.Once data race in cache-clear functions — A concurrency bug that could cause non-deterministic behavior when clearing caches has been resolved. (#18280)

MCP request context propagation fixed — checkActorPermission now correctly receives the MCP request context, ensuring timeouts and cancellations propagate correctly throughout the permission-check call chain. (#18281)

MCP inspector sub-contexts released promptly — connectStdioMCPServer and connectHTTPMCPServer now release WithTimeout sub-contexts immediately after each sequential MCP operation rather than deferring, reducing timer resource hold time. (#18343)

Preserved ExitError in error chain — ExitError is no longer dropped during run-workflow validation, enabling downstream error handling to correctly inspect exit codes. (#18282 via release notes)

✨ What's New

Schema path heuristic for misplaced frontmatter fields — When a field appears in the wrong location in a workflow's frontmatter, the compiler now suggests the correct schema path, making it much easier to diagnose configuration errors. (#18320)

Suppressed actionlint SC1003 false positives — Generated AWF shell commands no longer trigger spurious actionlint SC1003 warnings, reducing noise in CI linting output. (#18316)

Cleaner footer install message — The workflow footer now links "agentic workflow" directly to the source URL and displays the install command in a formatted code block for better readability. (#18345)

🔧 Internal

Refactored MCP error construction with a newMCPError helper, eliminating 30+ repeated jsonrpc.Error struct literals across MCP tool files. (#18341)

Updated Claude Code 2.1.52 → 2.1.56 and Copilot CLI 0.0.415 → 0.0.417. (#18313)

Updated golang.org/x/tools from v0.41.0 to v0.42.0. (#18319)

🌍 Community Contributions

A huge thank you to the community members who reported issues resolved in this release:

@ViktorHofer for gh aw compile does not add pull-requests: write to safe_outputs job when add-comment is configured (#18311)

For complete details, see CHANGELOG.

Generated by Release

What's Changed

fix: preserve ExitError in error chain in run_workflow_validation.go by @Copilot in github/gh-aw#18282

Propagate MCP request context into checkActorPermission by @Copilot in github/gh-aw#18281

fix: eliminate sync.Once reset data race in cache-clear functions by @Copilot in github/gh-aw#18280

... (truncated)

Changelog

Sourced from github/gh-aw's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:
gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1
Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

b70143d Release MCP inspector sub-contexts promptly after each operation (#18343)
92baa35 fix: add pull-requests:write to safe_outputs job for add-comment (#18318)
fd0cfd0 fix: update wasm golden fixtures to Copilot CLI 0.0.417 (#18331)
6867b81 Add schema path heuristic to suggest correct location for misplaced frontmatt...
4215607 deps: update golang.org/x/tools from v0.41.0 to v0.42.0 (#18319)
57a2da4 Update Claude Code 2.1.52→2.1.56 and Copilot CLI 0.0.415→0.0.417 (#18313)
5cf594e Suppress actionlint SC1003 false positives in generated AWF commands (#18316)
322b250 docs: add Unassign from User term to glossary (#18308)
974efc0 fix: eliminate sync.Once reset data race in cache-clear functions (#18280)
7411bba Propagate MCP request context into checkActorPermission (#18281)
Additional commits viewable in compare view

Updates actions/download-artifact from 6.0.0 to 7.0.0

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

New Contributors

@patrikpolyak made their first contribution in actions/download-artifact#440

@salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

Commits

37930b1 Merge pull request #452 from actions/download-artifact-v7-release
72582b9 doc: update readme
0d2ec9d chore: release v7.0.0 for Node.js 24 support
fd7ae8f Merge pull request #451 from actions/fix-storage-blob
d484700 chore: restore minimatch.dep.yml license file
03a8080 chore: remove obsolete dependency license files
56fe6d9 chore: update @actions/artifact license file to 5.0.1
8e3ebc4 chore: update package-lock.json with @actions/artifact@5.0.1
1e3c4b4 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
458627d chore: use local @actions/artifact package for Node.js 24 testing
Additional commits viewable in compare view

Updates actions/setup-dotnet from 4.3.1 to 5.1.0

Release notes

Sourced from actions/setup-dotnet's releases.

v5.1.0

What's Changed

Documentation

Readme update for environment variable on self hosted linux runners by @priya-kinthali in actions/setup-dotnet#689

Contributor icon updates by @Falco20019 in actions/setup-dotnet#604

Dependency updates

Upgrade actions/checkout from 5 to 6 by @dependabot in actions/setup-dotnet#684

Upgrade to latest actions packages by @salmanmkc in actions/setup-dotnet#687

Upgrade dependencies in testproject and checkout in Readme by @priya-kinthali in actions/setup-dotnet#692

New Contributors

@priya-kinthali made their first contribution in actions/setup-dotnet#689

@Falco20019 made their first contribution in actions/setup-dotnet#604

Full Changelog: actions/setup-dotnet@v5...v5.1.0

v5.0.1

What's Changed

Upgrade typescript from 5.4.2 to 5.9.2 and document breaking changes in v5 by @dependabot in actions/setup-dotnet#624

Upgrade eslint-plugin-jest from 27.9.0 to 29.0.1 by @dependabot in actions/setup-dotnet#648

Upgrade actions/publish-action from 0.3.0 to 0.4.0 and update macos-13 to macos-15-intel by @dependabot in actions/setup-dotnet#665

Full Changelog: actions/setup-dotnet@v5...v5.0.1

v5.0.0

What's Changed

Breaking Changes

Upgrade to Node.js 24 and modernize async usage by @salmanmkc in actions/setup-dotnet#654

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Updates

Upgrade @action/cache from 4.0.2 to 4.0.3 by @aparnajyothi-y in actions/setup-dotnet#622

Upgrade husky from 8.0.3 to 9.1.7 by @dependabot[bot] in actions/setup-dotnet#591

Upgrade @actions/glob from 0.4.0 to 0.5.0 by @dependabot[bot] in actions/setup-dotnet#594

Upgrade eslint-config-prettier from 9.1.0 to 10.1.5 by @dependabot[bot] in actions/setup-dotnet#639

Upgrade undici from 5.28.5 to 5.29.0 by @dependabot[bot] in actions/setup-dotnet#641

Upgrade form-data to bring in fix for critical vulnerability by @gowridurgad in actions/setup-dotnet#652

Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in actions/setup-dotnet#662

Bug Fixes

Remove Support for older .NET Versions and Update installers scripts by @gowridurgad in actions/setup-dotnet#647

New Contributors

... (truncated)

Commits

baa11fb Bump test dependencies to resolve System.Net.Http vulnerability, update workf...
24ec4f2 Upgrade to latest actions packages (#687)
4c100cb Fix icons (#604)
25328d8 Bump actions/checkout from 5 to 6 (#684)
937b8dd Update README with note on setting DOTNET_INSTALL_DIR for Linux permission is...
2016bd2 Bump actions/publish-action from 0.3.0 to 0.4.0 and update macos-13 to macos-...
21e81f6 Bump eslint-plugin-jest from 27.9.0 to 29.0.1 (#648)
7403103 Bump typescript from 5.4.2 to 5.9.2 (#624)
d4c9434 Update to Node.js 24 and modernize async usage (#654)
5c125af Bump actions/checkout from 4 to 5 (#662)
Additional commits viewable in compare view

Updates actions/setup-go from 5.4.0 to 6.2.0

Release notes

Sourced from actions/setup-go's releases.

v6.2.0

What's Changed

Enhancements

Example for restore-only cache in documentation by @aparnajyothi-y in actions/setup-go#696

Update Node.js version in action.yml by @ccoVeille in actions/setup-go#691

Documentation update of actions/checkout by @deining in actions/setup-go#683

Dependency updates

Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot in actions/setup-go#682

Upgrade @actions/cache to v5 by @salmanmkc in actions/setup-go#695

Upgrade actions/checkout from 5 to 6 by @dependabot in actions/setup-go#686

Upgrade qs from 6.14.0 to 6.14.1 by @dependabot in actions/setup-go#703

New Contributors

@ccoVeille made their first contribution in actions/setup-go#691

@deining made their first contribution in actions/setup-go#683

Full Changelog: actions/setup-go@v6...v6.2.0

v6.1.0

What's Changed

Enhancements

Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by @nicholasngai in actions/setup-go#665

Add support for .tool-versions file and update workflow by @priya-kinthali in actions/setup-go#673

Add comprehensive breaking changes documentation for v6 by @mahabaleshwars in actions/setup-go#674

Dependency updates

Upgrade eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking changes in v6 by @dependabot in actions/setup-go#617

Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot in actions/setup-go#641

Upgrade semver and @types/semver by @dependabot in actions/setup-go#652

New Contributors

@nicholasngai made their first contribution in actions/setup-go#665

@priya-kinthali made their first contribution in actions/setup-go#673

@mahabaleshwars made their first contribution in actions/setup-go#674

Full Changelog: actions/setup-go@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Improve toolchain handling to ensure more reliable and consistent toolchain selection and management by @matthewhughes934 in actions/setup-go#460

Upgrade Nodejs runtime from node20 to node 24 by @salmanmkc in actions/setup-go#624

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

... (truncated)

Commits

7a3fe6c Bump qs from 6.14.0 to 6.14.1 (#703)
b9adafd Bump actions/checkout from 5 to 6 (#686)
d73f6bc README.md: correct to actions/checkout@v6 (#683)
ae252ee Bump @actions/cache to v5 (#695)
bf7446a Bump js-yaml from 3.14.1 to 3.14.2 (#682)
02aadfe Fix Node.js version in action.yml (#691)
4aaadf4 Example for restore-only cache in documentation (#696)
4dc6199 Bump semver and @types/semver (#652)
f3787be Add comprehensive breaking changes documentation for v6 (#674)
3a0c2c8 Bump actions/publish-action from 0.3.0 to 0.4.0 (#641)
Additional commits viewable in compare view

Updates actions/setup-java from 4.8.0 to 5.2.0

Release notes

Sourced from actions/setup-java's releases.

v5.2.0

What's Changed

Enhancement

Retry on HTTP 522 Connection timed out by @findepi in actions/setup-java#964

Documentation Changes

Update gradle caching by @priya-kinthali in actions/setup-java#972

Update checkout to v6 by @mahabaleshwars in actions/setup-java#973

Dependency Updates

Upgrade @actions/cache to v5 by @salmanmkc in actions/setup-java#968

Upgrade actions/checkout from 5 to 6 by @dependabot in actions/setup-java#961

New Contributors

@findepi made their first contribution in actions/setup-java#964

Full Changelog: actions/setup-java@v5...v5.2.0

v5.1.0

What's Changed

New Features

Add support for .sdkmanrc file in java-version-file parameter by @guicamest in actions/setup-java#736

Add support for Microsoft OpenJDK 25 builds by @the-mod in actions/setup-java#927

Bug Fixes & Improvements

Update Regex to Support All ASDF Versions for the supported distributions in tool-versions File by @aparnajyothi-y in actions/setup-java#767

Enhance error logging for network failures to include endpoint/IP details, add retry mechanism and update workflows to use macos-15-intel by @priya-kinthali in actions/setup-java#946

Update SapMachine URLs by @RealCLanger in actions/setup-java#955

Add GitHub Token Support for GraalVM and Refactor Code by @mahabaleshwars in actions/setup-java#849

Documentation changes

Update documentation to use checkout and Java v5 by @lmvysakh in actions/setup-java#903

Clarify JAVA_HOME and PATH setup in README by @chiranjib-swain in actions/setup-java#841

Dependency updates

Upgrade prettier from 2.8.8 to 3.6.2 and document breaking changes in v5 by @dependabot in actions/setup-java#873

Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot in actions/setup-java#912

New Contributors

@lmvysakh made their first contribution in actions/setup-java#903

@chiranjib-swain made their first contribution in actions/setup-java#841

@the-mod made their first contribution in actions/setup-java#927

@priya-kinthali made their first contribution in actions/setup-java#946

@guicamest made their first contribution in actions/setup-java#736

Full Changelog: actions/setup-java@v5...v5.1.0

... (truncated)

Commits

be666c2 Chore: Version Update and Checkout Update to v6 (#973)
f7a6fef Bump actions/checkout from 5 to 6 (#961)
d81c4e4 Upgrade @actions/cache to v5 (#968)
1b1bbe1 readme update (#972)
5d7b214 Retry on HTTP 522 Connection timed out (#964)
f2beeb2 Bump actions/publish-action from 0.3.0 to 0.4.0 (#912)
4e7e684 feat: Add support for .sdkmanrc file in java-version-file parameter (#736)
46c56d6 Add GitHub Token Support for GraalVM and Refactor Code (#849)
66b9457 Update SapMachine URLs (#955)
6ba5449 Enhance error logging for network failures to include endpoint/IP details, ad...
Additional commits viewable in compare view

Updates actions/cache from 4.3.0 to 5.0.3

Release notes

Sourced from actions/cache's releases.

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

What's Changed

fix: update @actions/cache for Node.js 24 punycode deprecation by @salmanmkc in actions/cache#1685

prepare release v5.0.1 by @salmanmkc in actions/cache#1686

v5.0.0

What's Changed

Upgrade to use node24 by @salmanmkc in actions/cache#1630

Prepare v5.0.0 release by @salmanmkc in actions/cache#1684

Full Changelog: actions/cache@v5...v5.0.1

v5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

What's Changed

Upgrade to use node24 by @salmanmkc in actions/cache#1630

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

4.3.0

Bump @actions/cache to v4.1.0

... (truncated)

Commits

cdf6c1f Merge pull request #1695 from actions/Link-/prepare-5.0.3
a1bee22 Add review for the @actions/http-client license
4695763 Add licensed output
dc73bb9 Upgrade dependencies and address security warnings
345d5c2 Add 5.0.3 builds
8b402f5 Merge pull request #1692 from GhadimiR/main
304ab5a license for httpclient
609fc19 Update licensed record for cache
b22231e Build
93150cd Add PR link to releases
Additional commits viewable in compare view

Updates aquasecurity/trivy-action from 0.33.1 to 0.34.1

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.34.1

What's Changed

ci(test): add zizmor security linter for GitHub Actions by @DmitriyLewen in aquasecurity/trivy-action#502

Full Changelog: aquasecurity/trivy-action@0.34.0...0.34.1

v0.34.0

What's Changed

ci: use setup-bats in bump-trivy workflow by @nikpivkin in aquasecurity/trivy-action#494

chore: update README by @nikpivkin in aquasecurity/trivy-action#493

ci: install trivy in bump-trivy workflow and update tests by @nikpivkin in aquasecurity/trivy-action#495

chore(deps): Update trivy to v0.68.1 by @aqua-bot in aquasecurity/trivy-action#496

ci: use checks bundle v2 in sync workflow by @nikpivkin in aquasecurity/trivy-action#505

chore(deps): Update trivy to v0.69.1 by @aqua-bot in aquasecurity/trivy-action#506

Full Changelog: aquasecurity/trivy-action@0.33.1...0.34.0

Commits

e368e32 ci(test): add zizmor security linter for GitHub Actions (#502)
c1824fd chore(deps): Update trivy to v0.69.1 (#506)
bc61dc5 Merge commit from fork
5eb7ef2 ci: use checks bundle v2 in sync workflow (#505)
22438a4 Merge pull request #496 from aquasecurity/bump-trivy-1765431074
0024b3f chore(deps): Update trivy to v0.68.1
83690f7 ci: install trivy in bump-trivy workflow and update tests (#495)
df65449 chore: update README (#493)
0317097 ci: use setup-bats in bump-trivy workflow (#494)
See full diff in compare view

Updates amannn/action-semantic-pull-request from 5 to 6

Release notes

Sourced from amannn/action-semantic-pull-request's releases.

v6.0.0

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

Upgrade action to use Node.js 24 and ESM (#287)

Features

Upgrade action to use Node.js 24 and ESM (#287) (bc0c9a7)

v5.5.3

5.5.3 (2024-06-28)

Bug Fixes

Bump braces dependency (#269. by @EelcoLos) (2d952a1)

v5.5.2

5.5.2 (2024-04-24)

Bug Fixes

Bump tar from 6.1.11 to 6.2.1 (#262 by @EelcoLos) (9a90d5a)

v5.5.1

5.5.1 (2024-04-24)

Bug Fixes

Bump ip from 2.0.0 to 2.0.1 (#263 by @EelcoLos) (5e7e9ac)

v5.5.0

5.5.0 (2024-04-23)

Features

Add outputs for type, scope and subject (#261 by @bcaurel) (b05f5f6)

v5.4.0

5.4.0 (2023-11-03)

... (truncated)

Changelog

Sourced from amannn/action-semantic-pull-request's changelog.

Changelog

6.1.1 (2025-08-22)

Bug Fixes

Parse headerPatternCorrespondence properly (#295) (800da4c)

6.1.0 (2025-08-19)

Features

Support providing regexps for types (#292) (a30288b)

Bug Fixes

Remove trailing whitespace from "unknown release type" error message (#291) (afa4edb)

6.0.1 (2025-08-13)

Bug Fixes

Actually execute action (#289) (58e4ab4)

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

Upgrade action to use Node.js 24 and ESM (#287)

Features

Upgrade action to use Node.js 24 and ESM (#287) (bc0c9a7)

5.5.3 (2024-06-28)

Bug Fixes

Bump braces dependency (#269. by @EelcoLos) (2d952a1)

5.5.2 (2024-04-24)

Bug Fixes

Bump tar from 6.1.11 to 6.2.1 (#262 by @EelcoLos) (9a90d5a)

5.5.1 (2024-04-24)

... (truncated)

Commits

48f2562 chore: Release 6.1.1 [skip ci]
800da4c fix: Parse headerPatternCorrespondence properly (#295)
677b895 test: Fix broken test
24e6f01 ci: Fix permissions for tagger
7f33ba7 chore: Release 6.1.0 [skip ci]
afa4edb fix: Remove trailing whitespace from "unknown release type" error message (#291)
a30288b feat: Support providing regexps for types (#292)
a46a7c8 build: Move Vitest to devDependencies (#290)
fdd4d3d chore: Release 6.0.1 [skip ci]
58e4ab4 fix: Actually execute action (#289)
Additional commits viewable in compare view

Updates docker/login-action from 3.6.0 to 3.7.0

Release notes

Sourced from docker/login-action's releases.

v3.7.0

Add scope input to set scopes for the authentication token by @crazy-max in docker/login-action#912

Add support for AWS European Sovereign Cloud ECR by @dphi in docker/lo...
Description has been truncated

…h 14 updates Bumps the all-github-actions group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/gh-aw](https://github.com/github/gh-aw) | `0.47.0` | `0.50.3` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `6.0.0` | `7.0.0` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4.3.1` | `5.1.0` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.4.0` | `6.2.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `4.8.0` | `5.2.0` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.3` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.33.1` | `0.34.1` | | [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request) | `5` | `6` | | [docker/login-action](https://github.com/docker/login-action) | `3.6.0` | `3.7.0` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.2.0` | `3.7.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.5.0` | `4.0.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `5.4.0` | `6.19.2` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.22.2` | `0.23.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `6.2.0` | Updates `github/gh-aw` from 0.47.0 to 0.50.3 - [Release notes](https://github.com/github/gh-aw/releases) - [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md) - [Commits](github/gh-aw@v0.47.0...v0.50.3) Updates `actions/download-artifact` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@018cc2c...37930b1) Updates `actions/setup-dotnet` from 4.3.1 to 5.1.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v4.3.1...baa11fb) Updates `actions/setup-go` from 5.4.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v5.4.0...7a3fe6c) Updates `actions/setup-java` from 4.8.0 to 5.2.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v4.8.0...be666c2) Updates `actions/cache` from 4.3.0 to 5.0.3 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...cdf6c1f) Updates `aquasecurity/trivy-action` from 0.33.1 to 0.34.1 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@b6643a2...e368e32) Updates `amannn/action-semantic-pull-request` from 5 to 6 - [Release notes](https://github.com/amannn/action-semantic-pull-request/releases) - [Changelog](https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md) - [Commits](amannn/action-semantic-pull-request@e32d7e6...48f2562) Updates `docker/login-action` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@5e57cd1...c94ce9f) Updates `docker/setup-qemu-action` from 3.2.0 to 3.7.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@49b3bc8...c7c5346) Updates `sigstore/cosign-installer` from 3.5.0 to 4.0.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@59acb62...faadad0) Updates `docker/build-push-action` from 5.4.0 to 6.19.2 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@ca052bb...10e90e3) Updates `anchore/sbom-action` from 0.22.2 to 0.23.0 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@28d7154...17ae174) Updates `actions/setup-python` from 5.6.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5.6.0...a309ff8) --- updated-dependencies: - dependency-name: github/gh-aw dependency-version: 0.50.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-github-actions - dependency-name: actions/download-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions - dependency-name: actions/setup-dotnet dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions - dependency-name: actions/setup-go dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions - dependency-name: actions/setup-java dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions - dependency-name: actions/cache dependency-version: 5.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions - dependency-name: aquasecurity/trivy-action dependency-version: 0.34.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-github-actions - dependency-name: amannn/action-semantic-pull-request dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions - dependency-name: docker/login-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-github-actions - dependency-name: docker/setup-qemu-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-github-actions - dependency-name: sigstore/cosign-installer dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions - dependency-name: docker/build-push-action dependency-version: 6.19.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions - dependency-name: anchore/sbom-action dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-github-actions - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-02-25T19:06:51Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	82.39%	82.54%	📈 +0.15%
Statements	82.32%	82.46%	📈 +0.14%
Functions	82.74%	82.74%	➡️ +0.00%
Branches	74.55%	74.65%	📈 +0.10%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	83.6% → 84.1% (+0.56%)	82.8% → 83.4% (+0.54%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

dependabot · 2026-02-27T00:45:45Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Feb 25, 2026

dependabot bot closed this Feb 27, 2026

dependabot bot deleted the dependabot/github_actions/all-github-actions-145a750f58 branch February 27, 2026 00:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the all-github-actions group across 1 directory with 14 updates#1037

chore(deps): bump the all-github-actions group across 1 directory with 14 updates#1037
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/all-github-actions-145a750f58

dependabot bot commented on behalf of github Feb 25, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

dependabot bot commented on behalf of github Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.50.3

🌟 Release Highlights

🐛 Bug Fixes & Improvements

✨ What's New

🔧 Internal

🌍 Community Contributions

What's Changed

Changelog

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

v7.0.0

v7 - What's new

Node.js 24

What's Changed

New Contributors

v5.1.0

What's Changed

Documentation

Dependency updates

New Contributors

v5.0.1

What's Changed

v5.0.0

What's Changed

Breaking Changes

Dependency Updates

Bug Fixes

New Contributors

v6.2.0

What's Changed

Enhancements

Dependency updates

New Contributors

v6.1.0

What's Changed

Enhancements

Dependency updates

New Contributors

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

v5.2.0

What's Changed

Enhancement

Documentation Changes

Dependency Updates

New Contributors

v5.1.0

What's Changed

New Features

Bug Fixes & Improvements

Documentation changes

Dependency updates

New Contributors

v5.0.3

What's Changed

v.5.0.2

v5.0.2

What's Changed

v5.0.1

v5.0.1

What's Changed

v5.0.0

What's Changed

v5.0.0

What's Changed

Releases

How to prepare a release

Changelog

5.0.3

5.0.2

dependabot bot commented on behalf of github Feb 25, 2026 •

edited

Loading

Add discussion interaction to smoke workflows; compiler now serializes the `discussion` flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include `discussions: write` where applicable.

Add discussion interaction to smoke workflows; deprecate the `discussion` flag and