Skip to content

build(deps): bump the actions group across 1 directory with 9 updates - #5243

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-c26ec2d97c
Open

build(deps): bump the actions group across 1 directory with 9 updates#5243
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-c26ec2d97c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 9 updates in the / directory:

Package From To
github/gh-aw-actions/setup 0.86.2 0.87.0
actions/github-script 7 9
github/gh-aw-actions/setup-cli 0.86.2 0.87.0
actions/download-artifact 4 8
actions/upload-artifact 4 7
actions/setup-dotnet 5 6
github/codeql-action 4.37.4 4.37.7
github/gh-aw 0.83.4 0.86.2
jdx/mise-action 4.2.4 4.2.5

Updates github/gh-aw-actions/setup from 0.86.2 to 0.87.0

Release notes

Sourced from github/gh-aw-actions/setup's releases.

v0.87.0

Sync of actions from gh-aw at v0.87.0.

v0.86.3

Sync of actions from gh-aw at v0.86.3.

Commits

Updates actions/github-script from 7 to 9

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

... (truncated)

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates github/gh-aw-actions/setup-cli from 0.86.2 to 0.87.0

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.87.0

Sync of actions from gh-aw at v0.87.0.

v0.86.3

Sync of actions from gh-aw at v0.86.3.

Commits

Updates actions/download-artifact from 4 to 8

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/setup-dotnet from 5 to 6

Release notes

Sourced from actions/setup-dotnet's releases.

v6.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-dotnet@v5...v6.0.0

v5.4.0

What's Changed

Enhancements

The action now validates the sdk.version field in global.json when rollForward is specified. The version must be a fully-qualified SDK version (e.g., 8.0.100, 10.0.100). Wildcard versions (e.g., 10.0.*) and runtime-style versions (e.g., 8.0.0) will now fail. See the .NET SDK version specification for details.

Documentation

Bug Fixes

Dependency Updates

New Contributors

Full Changelog: actions/setup-dotnet@v5.3.0...v5.4.0

v5.3.0

What's Changed

Enhancements

Dependency Updates

... (truncated)

Commits

Updates github/codeql-action from 4.37.4 to 4.37.7

Release notes

Sourced from github/codeql-action's releases.

v4.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061
Changelog

Sourced from github/codeql-action's changelog.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061
Commits
  • ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
  • 951a133 Update changelog for v4.37.7
  • be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
  • 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
  • b4d8a54 Rebuild
  • ab5db25 Bump the npm-minor group across 1 directory with 8 updates
  • 38055a3 Drop logger from databaseInitCluster in interface
  • 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
  • dc1b98a Make logger available to getCodeQLForCmd
  • 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
  • Additional commits viewable in compare view

Updates github/gh-aw from 0.83.4 to 0.86.2

Release notes

Sourced from github/gh-aw's releases.

v0.86.2

🌟 Release Highlights

This release focuses on hardening the sandbox and MCP gateway, smoothing out safe-output and threat-detection reliability, and shipping a steady stream of security and quality fixes across the compiler and CLI.

✨ What's New

  • Docker sandbox (docker-sbx) rollout continues — the sandboxed execution environment now runs for a larger share of agentic workflows, with fixes for pre-flight step naming, gVisor false positives, and Docker Hub secret handling (#51264, #51294, #51341, #51439, #51949). See the sandbox reference.
  • Agent runtime trackingsandbox.agent.runtime is now stored in aw_info.json, and gh aw logs/gh aw audit gained a --runtime filter for easier debugging across engines (#51465, #52076). See agent runtimes.
  • MCP gateway hardening — explicit mount policy allowlisting for the safeoutputs backend server, plus a bump to gh-aw-mcpg v0.4.9 and github-mcp-server v1.9.0 (#51870, #51828).
  • Skills frontmatter flexibility — non-SHA refs are now allowed in skills frontmatter and pinned automatically at compile time, and an explicit end-marker syntax was added for inline skills/sub-agents (#51455, #51446).
  • Threat detection improvements — inline threat detection for Code Scanning Fixer, rendered detection logs with group/mask macros, and gh-aw's own <system> prompt block is no longer flagged as prompt injection (#51277, #51255, #51818). See threat detection.

🐛 Bug Fixes & Improvements

  • Fixed silent failures in the Copilot session data fetcher and in gh aw mcp inspect pagination (#51195, #51193).
  • Fixed Claude harness retrying invalid-JSON body errors with --continue instead of starting a fresh run (#51793).
  • Fixed a CGO/CJS workflow cache key collision that caused widespread job failures (#51342).
  • Fixed recurring gh-aw-firewall digest-pin loss on default firewall version bumps (#51423).
  • Fixed Windows MCP server timeouts by propagating context through GitHub CLI subprocess calls (#51426).
  • Fixed retry handling and denials in the Contribution Check proxy (#51631).
  • Added support for HEAD-only bundles when pushing to pull request branches (#51833).
  • Fixed safe-output run summary classification so entries are always linked and correctly attributed (#51484, #51478).

📚 Documentation

  • Documented the --runtime flag for gh aw logs/gh aw audit, agent runtime selection/troubleshooting, and clarified Claude engine selection in automated bootstrap (#52076, #51427, #52099).
  • Improved overall documentation discoverability and trimmed troubleshooting guides (#52065, #51251).

🔧 Internal

A large batch of custom-linter hardening, dependency bumps, test-parallelization, and dependency vulnerability remediations (container image pinning, ip-address patch, deprecated MCP container replacements) round out this release — thanks to the automated maintenance workflows keeping the codebase clean and secure.> Generated by 🚀 Release · auto · 20.7 AIC · ⊞ 11.3K


What's Changed

... (truncated)

Commits
  • 48e5fa3 Clarify Claude engine selection in automated bootstrap (#52099)
  • 9699516 Fix inverted strict: mode documentation in frontmatter reference (#52100)
  • fa5e232 Improve GitHub Agentic Workflows documentation discoverability (#52065)
  • 85f9048 Normalize report formatting in video-analyzer, plan, and centralization-drill...
  • 1dd49c6 Suppress benign workflow exfiltration findings (#52083)
  • c636d5f docs: document --runtime flag for gh aw logs and gh aw audit (#52076)
  • 62647ef Harden scanner/relaunch exec trust boundaries and argument validation (#52032)
  • 9922b2f Harden remote workflow import fallbacks to prevent cross-host downgrade to pu...
  • 81a1321 Remediate dynamic regexp pattern findings (#51941)
  • 485f970 [aw] Reduce Daily PR review tool-denial failures in Copilot SDK runs (#52060)
  • Additional commits viewable in compare view

Updates jdx/mise-action from 4.2.4 to 4.2.5

Release notes

Sourced from jdx/mise-action's releases.

v4.2.5: Resilient mise downloads with automatic retries

A small patch release that makes setup more resilient to transient network failures when downloading mise.

Fixed

Retry mise downloads after transient failures (#597 by @​jdx)

The download helpers previously made a single curl or wget attempt, so a transient GitHub release-asset HTTP or TLS failure would abort setup before mise or any user command could run (see #596).

Downloads now run through a retry wrapper that makes up to five attempts with a 2s pause between failures, logging a warning on each retry. This applies consistently to binary, checksum, signature, and version fetches. Checksum and minisign verification still run only after a successful download — never inside the retry loop — so integrity guarantees are unchanged.

Full Changelog: jdx/mise-action@v4.2.4...v4.2.5

Changelog

Sourced from jdx/mise-action's changelog.

Changelog


4.2.5 - 2026-08-12

🐛 Bug Fixes


4.2.4 - 2026-08-01

🐛 Bug Fixes

  • locking support detection with force-colored output (#580) by @​scop in #580

4.2.3 - 2026-07-24

🐛 Bug Fixes


4.2.2 - 2026-07-24

🐛 Bug Fixes

📚 Documentation

New Contributors


4.2.1 - 2026-07-16

🐛 Bug Fixes

🔍 Other Changes

... (truncated)

Commits
  • 3c2e0cf chore: release v4.2.5 (#598)
  • 9dda395 fix: retry mise downloads after transient failures (#597)
  • 9d2b311 chore(deps): update github/codeql-action action to v4.37.6 (#593)
  • 4213fbb chore(deps): update jdx/mise-action action to v4.2.4 (#594)
  • 672dbd2 chore(deps): update zizmorcore/zizmor-action action to v0.6.2 (#595)
  • 5159765 chore(deps): lock file maintenance (#592)
  • c75b4f6 chore(deps): update jdx/mise-action action to v4.2.3 (#590)
  • 367cc0d chore(deps): update github/codeql-action action to v4.37.3 (#589)
  • 90e6e66 chore(deps): update zizmorcore/zizmor-action action to v0.6.1 (#591)
  • 7350bb8 chore(deps): lock file maintenance (#588)
  • See full diff in compare view

@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

📦 Package size report

✅ No notable package size changes compared to the base branch.

13 package(s) with no notable change
Package Packed (base → head) Δ Packed Unpacked (base → head) Δ Unpacked
@azure-tools/typespec-java 13.51 MB → 13.51 MB +31 B (+0.0%) 15.03 MB → 15.03 MB
@azure-tools/azure-http-specs 146.63 KB → 146.63 KB 1.16 MB → 1.16 MB
@azure-tools/typespec-autorest 80.93 KB → 80.93 KB 395.06 KB → 395.06 KB
@azure-tools/typespec-autorest-canonical 7.42 KB → 7.42 KB 26.00 KB → 26.00 KB
@azure-tools/typespec-azure-core 129.43 KB → 129.43 KB 702.77 KB → 702.77 KB
@azure-tools/typespec-azure-portal-core 42.40 KB → 42.40 KB 192.91 KB → 192.91 KB
@azure-tools/typespec-azure-resource-manager 171.92 KB → 171.92 KB 1.04 MB → 1.04 MB
@azure-tools/typespec-azure-rulesets 5.16 KB → 5.16 KB 32.09 KB → 32.09 KB
@azure-tools/typespec-client-generator-core 227.76 KB → 227.76 KB 1.23 MB → 1.23 MB
@azure-tools/typespec-go 258.42 KB → 258.42 KB 1.32 MB → 1.32 MB
@azure-tools/typespec-metadata 15.91 KB → 15.91 KB 62.26 KB → 62.26 KB
@azure-tools/typespec-python 42.20 KB → 42.20 KB 164.85 KB → 164.85 KB
@azure-tools/typespec-ts 527.17 KB → 527.17 KB 2.54 MB → 2.54 MB

Packed = gzipped .tgz published to npm. Unpacked = total extracted size. 🆕 added, 🗑️ removed. Packages from the core/ submodule are not included.
🔴 grew · 🟢 shrank — only changes of at least 512 B and 0.5% are marked.

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

Bumps the actions group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) | `0.86.2` | `0.87.0` |
| [actions/github-script](https://github.com/actions/github-script) | `7` | `9` |
| [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) | `0.86.2` | `0.87.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5` | `6` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.37.4` | `4.37.7` |
| [github/gh-aw](https://github.com/github/gh-aw) | `0.83.4` | `0.86.2` |
| [jdx/mise-action](https://github.com/jdx/mise-action) | `4.2.4` | `4.2.5` |



Updates `github/gh-aw-actions/setup` from 0.86.2 to 0.87.0
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@6aab9e5...b77e0d5)

Updates `actions/github-script` from 7 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v7...v9)

Updates `github/gh-aw-actions/setup-cli` from 0.86.2 to 0.87.0
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@6aab9e5...b77e0d5)

Updates `actions/download-artifact` from 4 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v8)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `actions/setup-dotnet` from 5 to 6
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@v5...v6)

Updates `github/codeql-action` from 4.37.4 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v4.37.4...v4.37.7)

Updates `github/gh-aw` from 0.83.4 to 0.86.2
- [Release notes](https://github.com/github/gh-aw/releases)
- [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw@v0.83.4...v0.86.2)

Updates `jdx/mise-action` from 4.2.4 to 4.2.5
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](jdx/mise-action@7e36c90...3c2e0cf)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-dotnet
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: github/gh-aw
  dependency-version: 0.86.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/gh-aw-actions/setup
  dependency-version: 0.86.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/gh-aw-actions/setup-cli
  dependency-version: 0.86.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: jdx/mise-action
  dependency-version: 4.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-c26ec2d97c branch from f263efb to 98e412b Compare August 20, 2026 05:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants