Denis Kasak
5776c401b4
Add a global read-only permission block to push_complement_image.yml
2026-07-14 15:52:19 +02:00
Denis Kasak
194168aecb
Globally restrict permissions in docker.yml and relax only at job level
2026-07-14 15:52:19 +02:00
Denis Kasak
215068374b
Make permissions block global in triage_labelled.yml
2026-07-14 15:52:19 +02:00
Denis Kasak
2e8f48c464
Fix broad permissions in the docs-pr.yaml workflow
2026-07-14 15:52:19 +02:00
Denis Kasak
935557d5cb
Fix broad permissions in the fix_lint.yaml workflow
2026-07-14 15:52:19 +02:00
Denis Kasak
252e8f833d
Fix broad permissions in the poetry_lockfile.yaml workflow
2026-07-14 15:52:19 +02:00
Denis Kasak
8dd4a5ffbf
Fix broad permissions in the schema.yaml workflow
2026-07-14 15:52:19 +02:00
Denis Kasak
4fd159d099
Fix broad permissions in the latest_deps.yml workflow
2026-07-14 15:52:19 +02:00
Denis Kasak
2e43b56284
Fix broad permissions in the triage-incoming.yml workflow
2026-07-14 15:52:19 +02:00
Denis Kasak
be13e1e506
Fix broad permissions in the twisted_trunk.yml workflow
2026-07-14 15:52:19 +02:00
Denis Kasak
dfaa9fda62
Fix broad permissions in the tests.yml workflow
2026-07-14 15:52:19 +02:00
Denis Kasak
47ddad6e90
Fix broad permissions in the docs.yaml workflow
2026-07-14 15:52:19 +02:00
dependabot[bot] and GitHub
1979fcca52
Bump actions/checkout from 6.0.3 to 7.0.0 ( #19921 )
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-07-14 11:19:15 +00:00
dependabot[bot] and GitHub
ff7c3b9418
Bump actions/cache from 5.0.5 to 6.1.0 ( #19920 )
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-07-14 09:25:28 +00:00
dependabot[bot] and GitHub
60aa4466c8
Bump the minor-and-patches group with 2 updates ( #19919 )
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-07-14 09:25:07 +00:00
Olivier 'reivilibre and GitHub
0ab9291c35
Add golangci-lint to CI. ( #19888 )
...
Fixes : #19857
---------
Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org >
2026-07-01 11:16:29 +01:00
Andrew Morgan and GitHub
1639c30281
Fix the cargo-test and cargo-bench CI jobs not running ( #19883 )
2026-06-30 11:46:47 +00:00
dependabot[bot] and GitHub
5248ea0bc2
Bump the minor-and-patches group across 1 directory with 6 updates ( #19863 )
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-06-24 11:38:22 +00:00
Andrew Morgan and GitHub
b38106d58b
Update poetry in CI from 2.2.1 to 2.4.1 ( #19866 )
2026-06-18 15:21:55 +00:00
Olivier 'reivilibre
e3397a9b02
Merge branch 'master' into develop
2026-06-16 16:05:25 +01:00
Andrew Ferrazzutti and GitHub
64e09f134b
Fix lint failures in Complement tests ( #19855 )
...
Running `scripts-dev/lint.sh` locally revealed a failure, so here are the fixes that the linter
applied + a manual change to address an issue that couldn't be
auto-fixed.
2026-06-15 16:31:08 -05:00
78827799df
Upload Complement CI logs as artifacts instead of flooding stdout ( #19840 )
...
The Complement integration-test job prints the full raw `go test -json`
stream straight to the GitHub Actions build log. That's an enormous,
unreadable wall of JSON, and the GitHub web UI renders very large logs
poorly — making the run hard to view and slow to load.
Instead, let's store the raw JSON and upload it as an artefact. We still
render failing test output as before.
We will still stream when tests finish (i.e. PASS / FAIL) so that people
can see that things are actually running. However, all other output
(such as logs) are hidden.
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-15 16:11:58 +01:00
c3351eede0
When building releases, don't cancel Debian package builds when one of them fails. ( #19842 )
...
When building v1.155.0rc1, flaky deb builds combined with fail-fast
behaviour
meant that I had to press the retry button 5 times to get a full set.
Without fail-fast, I suspect 1 or 2 retries would have done the job.
---------
Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org >
Co-authored-by: Eric Eastwood <erice@element.io >
2026-06-10 09:56:08 +00:00
71e07d4c75
Bump hashicorp/vault-action from 3.4.0 to 4.0.0 ( #19804 )
...
Bumps
[hashicorp/vault-action](https://github.com/hashicorp/vault-action ) from
3.4.0 to 4.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hashicorp/vault-action/releases ">hashicorp/vault-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.0.0</h2>
<h2>4.0.0 (May 12, 2026)</h2>
<p>Improvements:</p>
<ul>
<li>Bump node runtime from node20 to node24 <a
href="https://redirect.github.com/hashicorp/vault-action/pull/604 ">GH-604</a></li>
<li>Fix leading slash in secret paths causing HTTP 400 errors (e.g.
<code>/cubbyhole/test</code> → <code>v1/cubbyhole/test</code> instead of
<code>v1//cubbyhole/test</code>)</li>
<li>bump jsrsasign from 11.1.0 to 11.1.3</li>
<li>bump body-parser from 1.20.3 to 1.20.5</li>
<li>bump qs from 6.13.0 to 6.15.1</li>
<li>bump http-errors from 2.0.0 to 2.0.1</li>
<li>bump minimatch from 3.1.2 to 3.1.5</li>
<li>bump underscore from 1.13.4 to 1.13.8</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hashicorp/vault-action/blob/main/CHANGELOG.md ">hashicorp/vault-action's
changelog</a>.</em></p>
<blockquote>
<h2>4.0.0 (May 12, 2026)</h2>
<p>Improvements:</p>
<ul>
<li>Bump node runtime from node20 to node24 <a
href="https://redirect.github.com/hashicorp/vault-action/pull/604 ">GH-604</a></li>
<li>Fix leading slash in secret paths causing HTTP 400 errors (e.g.
<code>/cubbyhole/test</code> → <code>v1/cubbyhole/test</code> instead of
<code>v1//cubbyhole/test</code>)</li>
<li>bump jsrsasign from 11.1.0 to 11.1.3</li>
<li>bump body-parser from 1.20.3 to 1.20.5</li>
<li>bump qs from 6.13.0 to 6.15.1</li>
<li>bump http-errors from 2.0.0 to 2.0.1</li>
<li>bump minimatch from 3.1.2 to 3.1.5</li>
<li>bump underscore from 1.13.4 to 1.13.8</li>
</ul>
<h2>3.4.0 (June 13, 2025)</h2>
<p>Bugs:</p>
<ul>
<li>replace all dot chars during normalization (<a
href="https://redirect.github.com/hashicorp/vault-action/pull/580 ">hashicorp/vault-action#580</a>)</li>
</ul>
<p>Improvements:</p>
<ul>
<li>Prevent possible DoS via polynomial regex (<a
href="https://redirect.github.com/hashicorp/vault-action/pull/583 ">hashicorp/vault-action#583</a>)</li>
</ul>
<h2>3.3.0 (March 3, 2025)</h2>
<p>Features:</p>
<ul>
<li>Wildcard secret imports can use <code>**</code> to retain case of
exported env keys <a
href="https://redirect.github.com/hashicorp/vault-action/pull/545 ">GH-545</a></li>
</ul>
<h2>3.2.0 (March 3, 2025)</h2>
<p>Improvements:</p>
<ul>
<li>Add retry for jwt auth login to fix intermittent login failures <a
href="https://redirect.github.com/hashicorp/vault-action/pull/574 ">GH-574</a></li>
</ul>
<h2>3.1.0 (January 9, 2025)</h2>
<p>Improvements:</p>
<ul>
<li>fix wildcard handling when field contains dot <a
href="https://redirect.github.com/hashicorp/vault-action/pull/542 ">GH-542</a></li>
<li>bump body-parser from 1.20.0 to 1.20.3</li>
<li>bump braces from 3.0.2 to 3.0.3</li>
<li>bump cross-spawn from 7.0.3 to 7.0.6</li>
<li>bump micromatch from 4.0.5 to 4.0.8</li>
</ul>
<p>Features:</p>
<ul>
<li><code>secretId</code> is no longer required for approle to support
advanced use cases like machine login when <code>bind_secret_id</code>
is false. <a
href="https://redirect.github.com/hashicorp/vault-action/pull/522 ">GH-522</a></li>
<li>Use <code>pki</code> configuration to generate certificates from
Vault <a
href="https://redirect.github.com/hashicorp/vault-action/pull/564 ">GH-564</a></li>
</ul>
<h2>3.0.0 (February 15, 2024)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hashicorp/vault-action/commit/892a26828f195e65540a40b4768ae4571f51ebfc "><code>892a268</code></a>
Update copywrite headers for v.4.0.0 release (<a
href="https://redirect.github.com/hashicorp/vault-action/issues/607 ">#607</a>)</li>
<li><a
href="https://github.com/hashicorp/vault-action/commit/a7ffa26e2e6ede175ca2e4f7dec54e78425d6936 "><code>a7ffa26</code></a>
Prepare for release v4.0.0 (<a
href="https://redirect.github.com/hashicorp/vault-action/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/hashicorp/vault-action/commit/a049f0183861f1dbbd996f64b48335487cc968db "><code>a049f01</code></a>
[COMPLIANCE] Add/Update Copyright Headers (<a
href="https://redirect.github.com/hashicorp/vault-action/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/hashicorp/vault-action/commit/95977a3e2387e93244aaae1232de66fc47b379a3 "><code>95977a3</code></a>
Adding team-vault-consumption as CODEOWNERS (<a
href="https://redirect.github.com/hashicorp/vault-action/issues/600 ">#600</a>)</li>
<li><a
href="https://github.com/hashicorp/vault-action/commit/7e48e563b6a9b4b0ba8b028c5ee89c41a8ae2671 "><code>7e48e56</code></a>
Upgrade Node.js to 24 and update dependencies (<a
href="https://redirect.github.com/hashicorp/vault-action/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/hashicorp/vault-action/commit/79632e33d6953d190b940ffa440bf97821cabd80 "><code>79632e3</code></a>
[COMPLIANCE] Add Copyright and License Headers (Batch 1 of 1) (<a
href="https://redirect.github.com/hashicorp/vault-action/issues/589 ">#589</a>)</li>
<li><a
href="https://github.com/hashicorp/vault-action/commit/734c523c4fbdb289cdf26dd2dc177f3627d1e140 "><code>734c523</code></a>
README.md: Removing jwtGithubAudience default (<a
href="https://redirect.github.com/hashicorp/vault-action/issues/590 ">#590</a>)</li>
<li><a
href="https://github.com/hashicorp/vault-action/commit/2c5827061f1ad91ca97897d6257ebe638e033699 "><code>2c58270</code></a>
[Compliance] - PR Template Changes Required (<a
href="https://redirect.github.com/hashicorp/vault-action/issues/586 ">#586</a>)</li>
<li>See full diff in <a
href="https://github.com/hashicorp/vault-action/compare/4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b...892a26828f195e65540a40b4768ae4571f51ebfc ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-01 14:38:08 +02:00
dependabot[bot] and GitHub
c45096e7e8
Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 in the minor-and-patches group ( #19803 )
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-29 09:00:39 +00:00
b8d7324373
Bump the minor-and-patches group across 1 directory with 3 updates ( #19736 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-01 09:22:27 +00:00
Olivier 'reivilibre and GitHub
c376cdd2ee
Configure Dependabot to only update Python dependencies in the lockfile. ( #19743 )
...
See:
- https://github.com/element-hq/synapse/pull/19742
- https://github.com/element-hq/synapse/pull/19686
(etc)
Documentation
https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#versioning-strategy--
We were considering `lockfile-only` but it sounds like
`increase-if-necessary` would increase the upper bound for us, if we had
one. Let's try it.
---------
Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org >
2026-04-29 18:17:53 +01:00
107029da92
Bump the minor-and-patches group across 1 directory with 2 updates ( #19710 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-24 10:35:00 +00:00
Eric Eastwood and GitHub
1a949608d5
Re-usable Complement GitHub CI workflow ( #19533 )
...
Docs: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
2026-04-13 17:03:46 -05:00
dependabot[bot] and GitHub
aceb081771
Bump actions/setup-go and actions/cache. ( #19654 )
2026-04-10 18:06:39 +01:00
84b3e5aa24
Bump dorny/paths-filter from 3.0.2 to 4.0.1 ( #19625 )
...
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter ) from
3.0.2 to 4.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dorny/paths-filter/releases ">dorny/paths-filter's
releases</a>.</em></p>
<blockquote>
<h2>v4.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Support merge queue by <a
href="https://github.com/masaru-iritani "><code>@masaru-iritani</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/255 ">dorny/paths-filter#255</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/masaru-iritani "><code>@masaru-iritani</code></a>
made their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/255 ">dorny/paths-filter#255</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1 ">https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1 </a></p>
<h2>v4.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: update action runtime to node24 by <a
href="https://github.com/saschabratton "><code>@saschabratton</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/294 ">dorny/paths-filter#294</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/saschabratton "><code>@saschabratton</code></a>
made their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/294 ">dorny/paths-filter#294</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0 ">https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0 </a></p>
<h2>v3.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Add missing predicate-quantifier by <a
href="https://github.com/wardpeet "><code>@wardpeet</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/279 ">dorny/paths-filter#279</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/wardpeet "><code>@wardpeet</code></a>
made their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/279 ">dorny/paths-filter#279</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/dorny/paths-filter/compare/v3...v3.0.3 ">https://github.com/dorny/paths-filter/compare/v3...v3.0.3 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md ">dorny/paths-filter's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v4.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/294 ">Update
action runtime to node24</a></li>
</ul>
<h2>v3.0.3</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/279 ">Add
missing predicate-quantifier</a></li>
</ul>
<h2>v3.0.2</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/224 ">Add
config parameter for predicate quantifier</a></li>
</ul>
<h2>v3.0.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/133 ">Compare
base and ref when token is empty</a></li>
</ul>
<h2>v3.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/210 ">Update to
Node.js 20</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/215 ">Update
all dependencies</a></li>
</ul>
<h2>v2.11.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/167 ">Update
<code>@actions/core</code> to v1.10.0 - Fixes warning about deprecated
set-output</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/168 ">Document
need for pull-requests: read permission</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/164 ">Updating
to actions/checkout@v3</a></li>
</ul>
<h2>v2.11.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/157 ">Set
list-files input parameter as not required</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/161 ">Update
Node.js</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/162 ">Fix
incorrect handling of Unicode characters in exec()</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/163 ">Use
Octokit pagination</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/160 ">Updates
real world links</a></li>
</ul>
<h2>v2.10.2</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/91 ">Fix
getLocalRef() returns wrong ref</a></li>
</ul>
<h2>v2.10.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/85 ">Improve
robustness of change detection</a></li>
</ul>
<h2>v2.10.0</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/82 ">Add
ref input parameter</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/83 ">Fix
change detection in PR when pullRequest.changed_files is
incorrect</a></li>
</ul>
<h2>v2.9.3</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/78 ">Fix
change detection when base is a tag</a></li>
</ul>
<h2>v2.9.2</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/75 ">Fix
fetching git history</a></li>
</ul>
<h2>v2.9.1</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/74 ">Fix
fetching git history + fallback to unshallow repo</a></li>
</ul>
<h2>v2.9.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dorny/paths-filter/commit/fbd0ab8f3e69293af611ebaee6363fc25e6d187d "><code>fbd0ab8</code></a>
feat: add merge_group event support</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/efb1da7ce8d89bbc261191e5a2dc1453c3837339 "><code>efb1da7</code></a>
feat: add dist/ freshness check to PR workflow</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/d8f7b061b24c30a325ff314b76c37adb05b041ce "><code>d8f7b06</code></a>
Merge pull request <a
href="https://redirect.github.com/dorny/paths-filter/issues/302 ">#302</a>
from dorny/issue-299</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/addbc147a95845176e1bc013a012fbf1d366389a "><code>addbc14</code></a>
Update README for v4</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/9d7afb8d214ad99e78fbd4247752c4caed2b6e4c "><code>9d7afb8</code></a>
Update CHANGELOG for v4.0.0</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/782470c5d953cae2693d643172b14e01bacb71f3 "><code>782470c</code></a>
Merge branch 'releases/v3'</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/d1c1ffe0248fe513906c8e24db8ea791d46f8590 "><code>d1c1ffe</code></a>
Update CHANGELOG for v3.0.3</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/ce10459c8b92cd8901166c0a222fbb033ef39365 "><code>ce10459</code></a>
Merge pull request <a
href="https://redirect.github.com/dorny/paths-filter/issues/294 ">#294</a>
from saschabratton/master</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/5f40380c5482e806c81cec080f5192e7234d8fe9 "><code>5f40380</code></a>
feat: update action runtime to node24</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/668c092af3649c4b664c54e4b704aa46782f6f7c "><code>668c092</code></a>
Merge pull request <a
href="https://redirect.github.com/dorny/paths-filter/issues/279 ">#279</a>
from wardpeet/patch-1</li>
<li>Additional commits viewable in <a
href="https://github.com/dorny/paths-filter/compare/de90cc6fb38fc0963ad72b210f1f284cd68cea36...fbd0ab8f3e69293af611ebaee6363fc25e6d187d ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 10:20:36 +00:00
90449b915d
Bump the minor-and-patches group with 2 updates ( #19624 )
...
Bumps the minor-and-patches group with 2 updates:
[tailscale/github-action](https://github.com/tailscale/github-action )
and [Swatinem/rust-cache](https://github.com/swatinem/rust-cache ).
Updates `tailscale/github-action` from 4.1.1 to 4.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailscale/github-action/releases ">tailscale/github-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.2</h2>
<h2>What's Changed</h2>
<ul>
<li>.github/workflows: fix check to skip integration test for PRs from
forks by <a
href="https://github.com/mpminardi "><code>@mpminardi</code></a> in <a
href="https://redirect.github.com/tailscale/github-action/pull/260 ">tailscale/github-action#260</a></li>
<li>fix: Windows MSI download on self-hosted runners by <a
href="https://github.com/doringeman "><code>@doringeman</code></a> in <a
href="https://redirect.github.com/tailscale/github-action/pull/259 ">tailscale/github-action#259</a></li>
<li>Bump actions/checkout from 6.0.1 to 6.0.2 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tailscale/github-action/pull/265 ">tailscale/github-action#265</a></li>
<li>Bump actions/setup-node from 6.1.0 to 6.2.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tailscale/github-action/pull/262 ">tailscale/github-action#262</a></li>
<li><code>fix: add missing parentheses to core.isDebug()</code> by <a
href="https://github.com/git-mracek "><code>@git-mracek</code></a> in <a
href="https://redirect.github.com/tailscale/github-action/pull/268 ">tailscale/github-action#268</a></li>
<li>.github/workflows: run integration test if event is a push by <a
href="https://github.com/mpminardi "><code>@mpminardi</code></a> in <a
href="https://redirect.github.com/tailscale/github-action/pull/270 ">tailscale/github-action#270</a></li>
<li>store tailscale.tgz and tailscaled.pid in XDG cache/runtime by <a
href="https://github.com/fbrv "><code>@fbrv</code></a> in <a
href="https://redirect.github.com/tailscale/github-action/pull/273 ">tailscale/github-action#273</a></li>
<li>action,dist,src: bump default version to 1.94.2 by <a
href="https://github.com/mpminardi "><code>@mpminardi</code></a> in <a
href="https://redirect.github.com/tailscale/github-action/pull/274 ">tailscale/github-action#274</a></li>
<li>Bump actions/setup-node from 6.2.0 to 6.3.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tailscale/github-action/pull/269 ">tailscale/github-action#269</a></li>
<li>Bump <code>@actions/core</code> from 2.0.1 to 2.0.2 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tailscale/github-action/pull/258 ">tailscale/github-action#258</a></li>
<li>Bump <code>@actions/github</code> from 6.0.1 to 7.0.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tailscale/github-action/pull/257 ">tailscale/github-action#257</a></li>
<li>Bump <code>@actions/tool-cache</code> from 2.0.2 to 3.0.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tailscale/github-action/pull/256 ">tailscale/github-action#256</a></li>
<li>Bump <code>@actions/cache</code> from 5.0.1 to 5.0.2 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tailscale/github-action/pull/255 ">tailscale/github-action#255</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/doringeman "><code>@doringeman</code></a> made
their first contribution in <a
href="https://redirect.github.com/tailscale/github-action/pull/259 ">tailscale/github-action#259</a></li>
<li><a
href="https://github.com/git-mracek "><code>@git-mracek</code></a> made
their first contribution in <a
href="https://redirect.github.com/tailscale/github-action/pull/268 ">tailscale/github-action#268</a></li>
<li><a href="https://github.com/fbrv "><code>@fbrv</code></a> made their
first contribution in <a
href="https://redirect.github.com/tailscale/github-action/pull/273 ">tailscale/github-action#273</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tailscale/github-action/compare/v4.1.1...v4.1.2 ">https://github.com/tailscale/github-action/compare/v4.1.1...v4.1.2 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tailscale/github-action/commit/306e68a486fd2350f2bfc3b19fcd143891a4a2d8 "><code>306e68a</code></a>
Bump <code>@actions/cache</code> from 5.0.1 to 5.0.2</li>
<li><a
href="https://github.com/tailscale/github-action/commit/989d9be101606d756046b6c34b8a11541de0157e "><code>989d9be</code></a>
Bump <code>@actions/tool-cache</code> from 2.0.2 to 3.0.0</li>
<li><a
href="https://github.com/tailscale/github-action/commit/69584d71aecc8128e4b0fd3fd06ff4a8998c6430 "><code>69584d7</code></a>
Bump <code>@actions/github</code> from 6.0.1 to 7.0.0</li>
<li><a
href="https://github.com/tailscale/github-action/commit/cda17d523f21452f46ede1819918ad582662c078 "><code>cda17d5</code></a>
Bump <code>@actions/core</code> from 2.0.1 to 2.0.2</li>
<li><a
href="https://github.com/tailscale/github-action/commit/81231eb3b2a76c9ededb9b95ebde0c0205f609f6 "><code>81231eb</code></a>
Bump actions/setup-node from 6.2.0 to 6.3.0</li>
<li><a
href="https://github.com/tailscale/github-action/commit/48c6d0317a1f8ac4c13c0679c2f17adc61ddc827 "><code>48c6d03</code></a>
action,dist,src: bump default version to 1.94.2</li>
<li><a
href="https://github.com/tailscale/github-action/commit/cfed5b8999ac8d0ac83e4d12d56f142b96231c2b "><code>cfed5b8</code></a>
store tailscale.tgz and tailscaled.pid in XDG cache/runtime dirs instead
of t...</li>
<li><a
href="https://github.com/tailscale/github-action/commit/31d93e60e2d8b8941c12ec9bd2b58ccc6c6d3f13 "><code>31d93e6</code></a>
.github/workflows: run integration test if event is a push</li>
<li><a
href="https://github.com/tailscale/github-action/commit/564fe381c8a09ced277dfc55386a7a00ff064b73 "><code>564fe38</code></a>
chore: run make build to resolve linter error</li>
<li><a
href="https://github.com/tailscale/github-action/commit/127daded2689d2b194000d5a363b9754a774986d "><code>127dade</code></a>
<code>fix: add missing parentheses to core.isDebug()</code></li>
<li>Additional commits viewable in <a
href="https://github.com/tailscale/github-action/compare/53acf823325fe9ca47f4cdaa951f90b4b0de5bb9...306e68a486fd2350f2bfc3b19fcd143891a4a2d8 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `Swatinem/rust-cache` from 2.8.2 to 2.9.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/swatinem/rust-cache/releases ">Swatinem/rust-cache's
releases</a>.</em></p>
<blockquote>
<h2>v2.9.1</h2>
<p>Fix regression in hash calculation</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Swatinem/rust-cache/compare/v2.9.0...v2.9.1 ">https://github.com/Swatinem/rust-cache/compare/v2.9.0...v2.9.1 </a></p>
<h2>v2.9.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add support for running rust-cache commands from within a Nix shell
by <a href="https://github.com/marc0246 "><code>@marc0246</code></a> in
<a
href="https://redirect.github.com/Swatinem/rust-cache/pull/290 ">Swatinem/rust-cache#290</a></li>
<li>Bump taiki-e/install-action from 2.62.57 to 2.62.60 in the actions
group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/291 ">Swatinem/rust-cache#291</a></li>
<li>Bump the actions group across 1 directory with 5 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/296 ">Swatinem/rust-cache#296</a></li>
<li>Bump the prd-major group with 3 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/294 ">Swatinem/rust-cache#294</a></li>
<li>Bump <code>@types/node</code> from 24.10.1 to 25.0.2 in the
dev-major group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/295 ">Swatinem/rust-cache#295</a></li>
<li>Consider all installed toolchains in cache key by <a
href="https://github.com/tamird "><code>@tamird</code></a> in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/293 ">Swatinem/rust-cache#293</a></li>
<li>Compare case-insenitively for full cache key match by <a
href="https://github.com/kbriggs "><code>@kbriggs</code></a> in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/303 ">Swatinem/rust-cache#303</a></li>
<li>Migrate to <code>node24</code> runner by <a
href="https://github.com/rhysd "><code>@rhysd</code></a> in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/314 ">Swatinem/rust-cache#314</a></li>
<li>Bump the actions group across 1 directory with 7 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/312 ">Swatinem/rust-cache#312</a></li>
<li>Bump the prd-minor group across 1 directory with 2 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/307 ">Swatinem/rust-cache#307</a></li>
<li>Bump <code>@types/node</code> from 25.0.2 to 25.2.2 in the
dev-minor group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/309 ">Swatinem/rust-cache#309</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/marc0246 "><code>@marc0246</code></a>
made their first contribution in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/290 ">Swatinem/rust-cache#290</a></li>
<li><a href="https://github.com/tamird "><code>@tamird</code></a> made
their first contribution in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/293 ">Swatinem/rust-cache#293</a></li>
<li><a href="https://github.com/kbriggs "><code>@kbriggs</code></a> made
their first contribution in <a
href="https://redirect.github.com/Swatinem/rust-cache/pull/303 ">Swatinem/rust-cache#303</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Swatinem/rust-cache/compare/v2.8.2...v2.9.0 ">https://github.com/Swatinem/rust-cache/compare/v2.8.2...v2.9.0 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md ">Swatinem/rust-cache's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>2.9.1</h2>
<ul>
<li>Fix regression in hash calculation</li>
</ul>
<h2>2.9.0</h2>
<ul>
<li>Update to <code>node24</code></li>
<li>Support running from within a <code>nix</code> shell</li>
<li>Consider all installed toolchains for cache key</li>
<li>Use case-insensitive comparison to determine exact cache hit</li>
</ul>
<h2>2.8.2</h2>
<ul>
<li>Don't overwrite env for cargo-metadata call</li>
</ul>
<h2>2.8.1</h2>
<ul>
<li>Set empty <code>CARGO_ENCODED_RUSTFLAGS</code> when retrieving
metadata</li>
<li>Various dependency updates</li>
</ul>
<h2>2.8.0</h2>
<ul>
<li>Add support for <code>warpbuild</code> cache provider</li>
<li>Add new <code>cache-workspace-crates</code> feature</li>
</ul>
<h2>2.7.8</h2>
<ul>
<li>Include CPU arch in the cache key</li>
</ul>
<h2>2.7.7</h2>
<ul>
<li>Also cache <code>cargo install</code> metadata</li>
</ul>
<h2>2.7.6</h2>
<ul>
<li>Allow opting out of caching $CARGO_HOME/bin</li>
<li>Add runner OS in cache key</li>
<li>Adds an option to do lookup-only of the cache</li>
</ul>
<h2>2.7.5</h2>
<ul>
<li>Support Cargo.lock format cargo-lock v4</li>
<li>Only run macOsWorkaround() on macOS</li>
</ul>
<h2>2.7.3</h2>
<ul>
<li>Work around upstream problem that causes cache saving to hang for
minutes.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/c19371144df3bb44fab255c43d04cbc2ab54d1c4 "><code>c193711</code></a>
2.9.1</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/781e8d91ab29deb65464798965e49853f963b561 "><code>781e8d9</code></a>
try reverting pipeline change</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/3d1fa4654a5786f5537b1d31acd0f35e56de9924 "><code>3d1fa46</code></a>
add changelog</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/c676846f29d98ff6b0106d3608c7ffd4048af17b "><code>c676846</code></a>
2.9.0</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/bf71d02c11df9d5253618f39943e9dd59f7fd5a9 "><code>bf71d02</code></a>
bump dependencies and rebuild</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/8a02ed5e290d8afc7e587930243f3016b3223f50 "><code>8a02ed5</code></a>
Bump <code>@types/node</code> from 25.0.2 to 25.2.2 in the dev-minor
group (<a
href="https://redirect.github.com/swatinem/rust-cache/issues/309 ">#309</a>)</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/390157d4874246aff722dd7f77e641fcae197678 "><code>390157d</code></a>
Bump the prd-minor group across 1 directory with 2 updates (<a
href="https://redirect.github.com/swatinem/rust-cache/issues/307 ">#307</a>)</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/68500c182e89a3f56d9b1de095d7e62f0ea5b8bf "><code>68500c1</code></a>
Bump the actions group across 1 directory with 7 updates (<a
href="https://redirect.github.com/swatinem/rust-cache/issues/312 ">#312</a>)</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/1a8384176d7ed15c323a201c65073983cdb5a5be "><code>1a83841</code></a>
Migrate to <code>node24</code> runner (<a
href="https://redirect.github.com/swatinem/rust-cache/issues/314 ">#314</a>)</li>
<li><a
href="https://github.com/Swatinem/rust-cache/commit/11da8522bc3856a8fbc565f1d1530989c793d67d "><code>11da852</code></a>
Compare case-insenitively for full cache key match (<a
href="https://redirect.github.com/swatinem/rust-cache/issues/303 ">#303</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/swatinem/rust-cache/compare/779680da715d629ac1d338a641029a2f4372abb5...c19371144df3bb44fab255c43d04cbc2ab54d1c4 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 11:47:55 +02:00
4fc1b92853
Bump actions/download-artifact from 7.0.0 to 8.0.1 ( #19626 )
...
Bumps
[actions/download-artifact](https://github.com/actions/download-artifact )
from 7.0.0 to 8.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases ">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for CJK characters in the artifact name by <a
href="https://github.com/danwkennedy "><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/471 ">actions/download-artifact#471</a></li>
<li>Add a regression test for artifact name + content-type mismatches by
<a href="https://github.com/danwkennedy "><code>@danwkennedy</code></a>
in <a
href="https://redirect.github.com/actions/download-artifact/pull/472 ">actions/download-artifact#472</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v8...v8.0.1 ">https://github.com/actions/download-artifact/compare/v8...v8.0.1 </a></p>
<h2>v8.0.0</h2>
<h2>v8 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This
should be transparent to the caller but forks might need to make
significant changes.</p>
</blockquote>
<blockquote>
<p>[!IMPORTANT]
Hash mismatches will now error by default. Users can override this
behavior with a setting change (see below).</p>
</blockquote>
<h3>Direct downloads</h3>
<p>To support direct uploads in <code>actions/upload-artifact</code>,
the action will no longer attempt to unzip all downloaded files.
Instead, the action checks the <code>Content-Type</code> header ahead of
unzipping and skips non-zipped files. Callers wishing to download a
zipped file as-is can also set the new <code>skip-decompress</code>
parameter to <code>true</code>.</p>
<h3>Enforced checks (breaking)</h3>
<p>A previous release introduced digest checks on the download. If a
download hash didn't match the expected hash from the server, the action
would log a warning. Callers can now configure the behavior on mismatch
with the <code>digest-mismatch</code> parameter. To be secure by
default, we are now defaulting the behavior to <code>error</code> which
will fail the workflow run.</p>
<h3>ESM</h3>
<p>To support new versions of the @actions/* packages, we've upgraded
the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Don't attempt to un-zip non-zipped downloads by <a
href="https://github.com/danwkennedy "><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/460 ">actions/download-artifact#460</a></li>
<li>Add a setting to specify what to do on hash mismatch and default it
to <code>error</code> by <a
href="https://github.com/danwkennedy "><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/461 ">actions/download-artifact#461</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v7...v8.0.0 ">https://github.com/actions/download-artifact/compare/v7...v8.0.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/download-artifact/commit/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c "><code>3e5f45b</code></a>
Add regression tests for CJK characters (<a
href="https://redirect.github.com/actions/download-artifact/issues/471 ">#471</a>)</li>
<li><a
href="https://github.com/actions/download-artifact/commit/e6d03f67377d4412c7aa56a8e2e4988e6ec479dd "><code>e6d03f6</code></a>
Add a regression test for artifact name + content-type mismatches (<a
href="https://redirect.github.com/actions/download-artifact/issues/472 ">#472</a>)</li>
<li><a
href="https://github.com/actions/download-artifact/commit/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 "><code>70fc10c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/461 ">#461</a>
from actions/danwkennedy/digest-mismatch-behavior</li>
<li><a
href="https://github.com/actions/download-artifact/commit/f258da9a506b755b84a09a531814700b86ccfc62 "><code>f258da9</code></a>
Add change docs</li>
<li><a
href="https://github.com/actions/download-artifact/commit/ccc058e5fbb0bb2352213eaec3491e117cbc4a5c "><code>ccc058e</code></a>
Fix linting issues</li>
<li><a
href="https://github.com/actions/download-artifact/commit/bd7976ba57ecea96e6f3df575eb922d11a12a9fd "><code>bd7976b</code></a>
Add a setting to specify what to do on hash mismatch and default it to
<code>error</code></li>
<li><a
href="https://github.com/actions/download-artifact/commit/ac21fcf45e0aaee541c0f7030558bdad38d77d6c "><code>ac21fcf</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/460 ">#460</a>
from actions/danwkennedy/download-no-unzip</li>
<li><a
href="https://github.com/actions/download-artifact/commit/15999bff51058bc7c19b50ebbba518eaef7c26c0 "><code>15999bf</code></a>
Add note about package bumps</li>
<li><a
href="https://github.com/actions/download-artifact/commit/974686ed5098c7f9c9289ec946b9058e496a2561 "><code>974686e</code></a>
Bump the version to <code>v8</code> and add release notes</li>
<li><a
href="https://github.com/actions/download-artifact/commit/fbe48b1d2756394be4cd4358ed3bc1343b330e75 "><code>fbe48b1</code></a>
Update test names to make it clearer what they do</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 11:47:08 +02:00
dependabot[bot] and GitHub
57ef7b9192
Bump docker/login-action from 3.7.0 to 4.0.0 ( #19597 )
2026-03-24 10:17:30 +00:00
dependabot[bot] and GitHub
71092aa584
Bump docker/setup-buildx-action from 3.12.0 to 4.0.0 ( #19598 )
2026-03-24 10:17:14 +00:00
dependabot[bot] and GitHub
e0b08da42e
Bump docker/build-push-action from 6.19.2 to 7.0.0 ( #19599 )
2026-03-24 10:16:50 +00:00
dependabot[bot] and GitHub
963fc9e55a
Bump docker/metadata-action from 5.10.0 to 6.0.0 ( #19600 )
2026-03-24 10:16:28 +00:00
713aa7ebf0
Hide successful, skipped Complement tests in the CI ( #19590 )
...
Co-authored-by: Eric Eastwood <erice@element.io >
2026-03-23 15:16:23 +00:00
9fe7cbfe7f
Bump actions/upload-artifact from 6.0.0 to 7.0.0 ( #19565 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-18 19:24:28 +00:00
90697637a8
Bump actions/setup-go from 6.2.0 to 6.3.0 in the minor-and-patches group ( #19564 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-18 19:16:14 +00:00
Eric Eastwood and GitHub
d65ef848eb
Fix Build and push complement image CI job not having Poetry for complement.sh ( #19578 )
...
❌ `Build and push complement image`,
https://github.com/element-hq/synapse/actions/runs/23176317296/job/67339146082
```
scripts-dev/complement.sh: line 227: poetry: command not found
```
Follow-up to https://github.com/element-hq/synapse/pull/19523
This regressed in https://github.com/element-hq/synapse/pull/19476
### Testing strategy
1. Visit
https://github.com/element-hq/synapse/actions/workflows/push_complement_image.yml
1. **Run workflow**:
- **Use workflow from:**
`madlittlemods/fix-complement-push-image-ci-job-poetry`
- **Branch:** `develop`
1. Wait for CI to run and pass ✅
2026-03-17 10:51:53 -05:00
Quentin Gliech and GitHub
6a63f0dcd7
Migrate dev dependencies to PEP 735 dependency groups ( #19490 )
...
This moves the dev dependencies to PEP 735 dependency groups, to help us
move to standard project metadata, which will help us moving to `uv`
(#19566 )
This requires poetry 2.2.0
2026-03-17 14:45:28 +00:00
Eric Eastwood
c37a5bb4cd
Restore localhost/complement-synapse change from #19523
...
See https://github.com/element-hq/synapse/pull/19523#discussion_r2944133700
2026-03-16 22:20:56 -05:00
Eric Eastwood and GitHub
6254e009bb
Fix Build and push complement image CI job pointing to non-existent image ( #19523 )
...
❌
https://github.com/element-hq/synapse/actions/runs/22609655282/job/65509315002#step:8:39
```
Error response from daemon: No such image: complement-synapse:latest
```
Regressed in
https://github.com/element-hq/synapse/pull/19475#discussion_r2823157623
where we updated `complement.sh` to build `localhost/complement-synapse`
instead of `complement-synapse`.
2026-03-16 21:56:16 -05:00
Eric Eastwood and GitHub
e30001883c
Add in-repo Complement test to sanity check Synapse version matches git checkout ( #19476 )
...
This way we actually detect problems like
https://github.com/element-hq/synapse/pull/19475 as they happen instead
of being invisible until something breaks.
Sanity check that Complement is testing against your code changes
(whether it be local or from the PR in CI).
```
COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh --in-repo -run TestSynapseVersion
```
2026-03-11 15:30:32 -05:00
c2c05879bb
Bump docker/build-push-action from 6.18.0 to 6.19.2 in the minor-and-patches group ( #19514 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-03 17:30:30 +00:00
9de28df7a2
Bump docker/login-action from 3.6.0 to 3.7.0 in the minor-and-patches group ( #19493 )
...
Bumps the minor-and-patches group with 1 update:
[docker/login-action](https://github.com/docker/login-action ).
Updates `docker/login-action` from 3.6.0 to 3.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases ">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v3.7.0</h2>
<ul>
<li>Add <code>scope</code> input to set scopes for the authentication
token by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/912 ">docker/login-action#912</a></li>
<li>Add support for AWS European Sovereign Cloud ECR by <a
href="https://github.com/dphi "><code>@dphi</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/914 ">docker/login-action#914</a></li>
<li>Ensure passwords are redacted with <code>registry-auth</code> input
by <a href="https://github.com/crazy-max "><code>@crazy-max</code></a>
in <a
href="https://redirect.github.com/docker/login-action/pull/911 ">docker/login-action#911</a></li>
<li>build(deps): bump lodash from 4.17.21 to 4.17.23 in <a
href="https://redirect.github.com/docker/login-action/pull/915 ">docker/login-action#915</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v3.6.0...v3.7.0 ">https://github.com/docker/login-action/compare/v3.6.0...v3.7.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/c94ce9fb468520275223c153574b00df6fe4bcc9 "><code>c94ce9f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/915 ">#915</a>
from docker/dependabot/npm_and_yarn/lodash-4.17.23</li>
<li><a
href="https://github.com/docker/login-action/commit/8339c958ce8511f38d0c474c1886a87c802bf1ef "><code>8339c95</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/912 ">#912</a>
from docker/scope</li>
<li><a
href="https://github.com/docker/login-action/commit/c83e9320c8beb50b77dd007c46d5c8161f0cac4a "><code>c83e932</code></a>
build(deps): bump lodash from 4.17.21 to 4.17.23</li>
<li><a
href="https://github.com/docker/login-action/commit/b268aa57e39ff0a5386d2fd1eded4e2e1d60d705 "><code>b268aa5</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/a60322927812ddc99316dd6252b4fba6d8f09ac1 "><code>a603229</code></a>
documentation for scope input</li>
<li><a
href="https://github.com/docker/login-action/commit/7567f92a74b2639be1bd8bc932a112a0d81283da "><code>7567f92</code></a>
Add scope input to set scopes for the authentication token</li>
<li><a
href="https://github.com/docker/login-action/commit/0567fa5ae8c9a197cb207537dc5cbb43ca3d803f "><code>0567fa5</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/914 ">#914</a>
from dphi/add-support-for-amazonaws.eu</li>
<li><a
href="https://github.com/docker/login-action/commit/f6ef57754547a85003a0e18f789be661346d4a6e "><code>f6ef577</code></a>
feat: add support for AWS European Sovereign Cloud ECR registries</li>
<li><a
href="https://github.com/docker/login-action/commit/916386b00027d425839f8da46d302dab33f5875b "><code>916386b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/911 ">#911</a>
from crazy-max/ensure-redact</li>
<li><a
href="https://github.com/docker/login-action/commit/5b3f94a294ea5478af3af437baa6ad0d3dcd04fd "><code>5b3f94a</code></a>
chore: update generated content</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/v3.6.0...c94ce9fb468520275223c153574b00df6fe4bcc9 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-27 15:32:19 +01:00
Eric Eastwood and GitHub
04206aebdf
Log docker system info in CI ( #19480 )
...
Follow-up to
https://github.com/element-hq/synapse/pull/19460#discussion_r2819139638
and https://github.com/element-hq/synapse/pull/19475
2026-02-19 09:57:25 -06:00
69b931f305
Push Synapse docker images to Element OCI Registry ( #19420 )
...
Part of https://github.com/element-hq/serverproduct-internal/issues/1153
Pushes Synapse docker images to the Element OCI Registry in addition to
the dockerhub and ghcr registries.
Ready for review despite Draft status. See
https://github.com/element-hq/synapse/pull/19420#issuecomment-3848866071
### Pull Request Checklist
<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->
* [X] Pull request is based on the develop branch
* [X] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog ).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
- Use markdown where necessary, mostly for `code blocks`.
- End with either a period (.) or an exclamation mark (!).
- Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [X] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html ) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters ))
---------
Co-authored-by: Quentin Gliech <quenting@element.io >
2026-02-17 14:35:38 +01:00
7a765c4819
Bump the minor-and-patches group across 1 directory with 3 updates ( #19469 )
...
Bumps the minor-and-patches group with 3 updates in the / directory:
[docker/login-action](https://github.com/docker/login-action ),
[actions/setup-python](https://github.com/actions/setup-python ) and
[actions/cache](https://github.com/actions/cache ).
Updates `docker/login-action` from 3.6.0 to 3.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases ">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v3.7.0</h2>
<ul>
<li>Add <code>scope</code> input to set scopes for the authentication
token by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/912 ">docker/login-action#912</a></li>
<li>Add support for AWS European Sovereign Cloud ECR by <a
href="https://github.com/dphi "><code>@dphi</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/914 ">docker/login-action#914</a></li>
<li>Ensure passwords are redacted with <code>registry-auth</code> input
by <a href="https://github.com/crazy-max "><code>@crazy-max</code></a>
in <a
href="https://redirect.github.com/docker/login-action/pull/911 ">docker/login-action#911</a></li>
<li>build(deps): bump lodash from 4.17.21 to 4.17.23 in <a
href="https://redirect.github.com/docker/login-action/pull/915 ">docker/login-action#915</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v3.6.0...v3.7.0 ">https://github.com/docker/login-action/compare/v3.6.0...v3.7.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/c94ce9fb468520275223c153574b00df6fe4bcc9 "><code>c94ce9f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/915 ">#915</a>
from docker/dependabot/npm_and_yarn/lodash-4.17.23</li>
<li><a
href="https://github.com/docker/login-action/commit/8339c958ce8511f38d0c474c1886a87c802bf1ef "><code>8339c95</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/912 ">#912</a>
from docker/scope</li>
<li><a
href="https://github.com/docker/login-action/commit/c83e9320c8beb50b77dd007c46d5c8161f0cac4a "><code>c83e932</code></a>
build(deps): bump lodash from 4.17.21 to 4.17.23</li>
<li><a
href="https://github.com/docker/login-action/commit/b268aa57e39ff0a5386d2fd1eded4e2e1d60d705 "><code>b268aa5</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/a60322927812ddc99316dd6252b4fba6d8f09ac1 "><code>a603229</code></a>
documentation for scope input</li>
<li><a
href="https://github.com/docker/login-action/commit/7567f92a74b2639be1bd8bc932a112a0d81283da "><code>7567f92</code></a>
Add scope input to set scopes for the authentication token</li>
<li><a
href="https://github.com/docker/login-action/commit/0567fa5ae8c9a197cb207537dc5cbb43ca3d803f "><code>0567fa5</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/914 ">#914</a>
from dphi/add-support-for-amazonaws.eu</li>
<li><a
href="https://github.com/docker/login-action/commit/f6ef57754547a85003a0e18f789be661346d4a6e "><code>f6ef577</code></a>
feat: add support for AWS European Sovereign Cloud ECR registries</li>
<li><a
href="https://github.com/docker/login-action/commit/916386b00027d425839f8da46d302dab33f5875b "><code>916386b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/911 ">#911</a>
from crazy-max/ensure-redact</li>
<li><a
href="https://github.com/docker/login-action/commit/5b3f94a294ea5478af3af437baa6ad0d3dcd04fd "><code>5b3f94a</code></a>
chore: update generated content</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/5e57cd118135c172c3672efd75eb46360885c0ef...c94ce9fb468520275223c153574b00df6fe4bcc9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/setup-python` from 6.1.0 to 6.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases ">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Dependency Upgrades</h3>
<ul>
<li>Upgrade dependencies to Node 24 compatible versions by <a
href="https://github.com/salmanmkc "><code>@salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1259 ">actions/setup-python#1259</a></li>
<li>Upgrade urllib3 from 2.5.0 to 2.6.3 in <code>/__tests__/data</code>
by <a href="https://github.com/dependabot "><code>@dependabot</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1253 ">actions/setup-python#1253</a>
and <a
href="https://redirect.github.com/actions/setup-python/pull/1264 ">actions/setup-python#1264</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v6.2.0 ">https://github.com/actions/setup-python/compare/v6...v6.2.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/a309ff8b426b58ec0e2a45f0f869d46889d02405 "><code>a309ff8</code></a>
Bump urllib3 from 2.6.0 to 2.6.3 in /<strong>tests</strong>/data (<a
href="https://redirect.github.com/actions/setup-python/issues/1264 ">#1264</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/bfe8cc55a7890e3d6672eda6460ef37bfcc70755 "><code>bfe8cc5</code></a>
Upgrade <a href="https://github.com/actions "><code>@actions</code></a>
dependencies to Node 24 compatible versions (<a
href="https://redirect.github.com/actions/setup-python/issues/1259 ">#1259</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/4f41a90a1f38628c7ccc608d05fbafe701bc20ae "><code>4f41a90</code></a>
Bump urllib3 from 2.5.0 to 2.6.0 in /<strong>tests</strong>/data (<a
href="https://redirect.github.com/actions/setup-python/issues/1253 ">#1253</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-python/compare/83679a892e2d95755f2dac6acb0bfd1e9ac5d548...a309ff8b426b58ec0e2a45f0f869d46889d02405 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/cache` from 5.0.1 to 5.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases ">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33 ">https://github.com/actions/cache/security/dependabot/33 </a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.3 ">https://github.com/actions/cache/compare/v5...v5.0.3 </a></p>
<h2>v.5.0.2</h2>
<h1>v5.0.2</h1>
<h2>What's Changed</h2>
<p>When creating cache entries, 429s returned from the cache service
will not be retried.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md ">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]<br />
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json "><code>https://github.com/actions/cache/blob/main/package.json </code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md "><code>https://github.com/actions/cache/blob/main/RELEASES.md </code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml "><code>https://github.com/actions/cache/blob/main/.licensed.yml </code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases ">https://github.com/actions/cache/releases </a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml ">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml </a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33 ">https://github.com/actions/cache/security/dependabot/33 </a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.3 <a
href="https://redirect.github.com/actions/cache/pull/1692 ">#1692</a></li>
</ul>
<h3>5.0.1</h3>
<ul>
<li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via
<code>@actions/cache@5.0.1</code> <a
href="https://redirect.github.com/actions/cache/pull/1685 ">#1685</a></li>
</ul>
<h3>5.0.0</h3>
<blockquote>
<p>[!IMPORTANT]
<code>actions/cache@v5</code> runs on the Node.js 24 runtime and
requires a minimum Actions Runner version of <code>2.327.1</code>.
If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<h3>4.3.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to <a
href="https://redirect.github.com/actions/toolkit/pull/2132 ">v4.1.0</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/cdf6c1fa76f9f475f3d7449005a359c84ca0f306 "><code>cdf6c1f</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1695 ">#1695</a>
from actions/Link-/prepare-5.0.3</li>
<li><a
href="https://github.com/actions/cache/commit/a1bee22673bee4afb9ce4e0a1dc3da1c44060b7d "><code>a1bee22</code></a>
Add review for the <code>@actions/http-client</code> license</li>
<li><a
href="https://github.com/actions/cache/commit/46957638dc5c5ff0c34c0143f443c07d3a7c769f "><code>4695763</code></a>
Add licensed output</li>
<li><a
href="https://github.com/actions/cache/commit/dc73bb9f7bf74a733c05ccd2edfd1f2ac9e5f502 "><code>dc73bb9</code></a>
Upgrade dependencies and address security warnings</li>
<li><a
href="https://github.com/actions/cache/commit/345d5c2f761565bace4b6da356737147e9041e3a "><code>345d5c2</code></a>
Add 5.0.3 builds</li>
<li><a
href="https://github.com/actions/cache/commit/8b402f58fbc84540c8b491a91e594a4576fec3d7 "><code>8b402f5</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1692 ">#1692</a>
from GhadimiR/main</li>
<li><a
href="https://github.com/actions/cache/commit/304ab5a0701ee61908ccb4b5822347949a2e2002 "><code>304ab5a</code></a>
license for httpclient</li>
<li><a
href="https://github.com/actions/cache/commit/609fc19e67cd310e97eb36af42355843ffcb35be "><code>609fc19</code></a>
Update licensed record for cache</li>
<li><a
href="https://github.com/actions/cache/commit/b22231e43df11a67538c05e88835f1fa097599c5 "><code>b22231e</code></a>
Build</li>
<li><a
href="https://github.com/actions/cache/commit/93150cdfb36a9d84d4e8628c8870bec84aedcf8a "><code>93150cd</code></a>
Add PR link to releases</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/9255dc7a253b0ccc959486e2bca901246202afeb...cdf6c1fa76f9f475f3d7449005a359c84ca0f306 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-17 13:59:16 +01:00
Denis Kasak