Skip to content

ci(deps): bump the github-actions group with 4 updates - #122

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-337625b3d1
Closed

ci(deps): bump the github-actions group with 4 updates#122
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-337625b3d1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 4 updates: anthropics/claude-code-action, SonarSource/sonarqube-quality-gate-action, actions/cache and astral-sh/setup-uv.

Updates anthropics/claude-code-action from 1.0.85 to 1.0.89

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.89

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1...v1.0.89

v1.0.88

Full Changelog: anthropics/claude-code-action@v1...v1.0.88

v1.0.87

Full Changelog: anthropics/claude-code-action@v1...v1.0.87

v1.0.86

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.86

Commits
  • 6e2bd52 fix: pin bun runtime config and improve log hygiene (#1174)
  • 3534c32 chore: fix prettier formatting in parse-sdk-options.test.ts (#1176)
  • 6685b26 chore: fix prettier formatting (#1171)
  • 5150ea9 fix: snapshot PR's .claude/ to .claude-pr/ before security restore (#1172)
  • eb8baa4 fix: strip shell comment lines before parsing claude_args (#1055)
  • f328a5c fix: prevent hang in restoreConfigFromBase on repos with .gitmodules (#1166)
  • b15d475 fix: allow # in branch names for PR checkout and base restore (#1167)
  • d5db820 fix: restore ripgrep execute bits after bun install --production (#1163)
  • d8af4e9 fix: skip retries for non-retryable errors in retryWithBackoff (#1082)
  • f37c786 Strip OIDC token request env vars from Claude session (#1011)
  • Additional commits viewable in compare view

Updates SonarSource/sonarqube-quality-gate-action from 1.1.0 to 1.2.0

Release notes

Sourced from SonarSource/sonarqube-quality-gate-action's releases.

v1.2.0

What's Changed

Full Changelog: SonarSource/sonarqube-quality-gate-action@v1.1.0...v1.2.0

Commits
  • cf038b0 BUILD-8073 Migrate public repositories workflows to large runners
  • df91423 Add Jira integration
  • adc518a SC-19792 Change code owner
  • 5a8df80 SQRP-122 Reference SonarQube Community Build (#61)
  • 2a53a0f SQQGGHA-9 Revert action name to avoid unexpected URL change
  • 424137d SQQGGHA-9 Use new SonarQube (Server, Cloud) product names
  • 07d1da2 Update README.md to consider the correct polling timeout property
  • 721debf Update README.md to checkout v4
  • 8406f4f BUILD-6088 Create SECURITY.md
  • dc2f7b0 Add a polling timeout (#50)
  • Additional commits viewable in compare view

Updates actions/cache from 4.3.0 to 5.0.4

Release notes

Sourced from actions/cache's releases.

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

What's Changed

v5.0.0

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

Updates astral-sh/setup-uv from 7.6.0 to 8.0.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.0.0 🌈 Immutable releases and secure tags

This is the first immutable release of setup-uv 🥳

All future releases are also immutable, if you want to know more about what this means checkout the docs.

This release also has two breaking changes

New format for manifest-file

The previously deprecated way of defining a custom version manifest to control which uv versions are available and where to download them from got removed. The functionality is still there but you have to use the new format.

No more major and minor tags

To increase security even more we will stop publishing minor tags. You won't be able to use @v8 or @v8.0 any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to tj-actions.

[!TIP] Use the immutable tag as a version astral-sh/setup-uv@v8.0.0 Or even better the githash astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57

🚨 Breaking changes

🧰 Maintenance

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci(deps): bump the github-actions group with 4 updates
e097de5 
Bumps the github-actions group with 4 updates: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action), [SonarSource/sonarqube-quality-gate-action](https://github.com/sonarsource/sonarqube-quality-gate-action), [actions/cache](https://github.com/actions/cache) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `anthropics/claude-code-action` from 1.0.85 to 1.0.89
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@58dbe8e...6e2bd52)

Updates `SonarSource/sonarqube-quality-gate-action` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/sonarsource/sonarqube-quality-gate-action/releases)
- [Commits](SonarSource/sonarqube-quality-gate-action@d304d05...cf038b0)

Updates `actions/cache` from 4.3.0 to 5.0.4
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0057852...6682284)

Updates `astral-sh/setup-uv` from 7.6.0 to 8.0.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@37802ad...cec2083)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.89
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: SonarSource/sonarqube-quality-gate-action
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Apr 6, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from Tony363 as a code owner April 6, 2026 09:26
@github-actions

github-actions Bot commented Apr 6, 2026

Copy link
Copy Markdown
Contributor

GitNexus Impact Analysis

⚪ NONE Overall Risk Level

Metric Value
Files Analyzed 9
Total Impacted Symbols 0
Affected Processes 1
Affected Modules 1

Per-File Impact

File Risk
.github/workflows/ai-code-review.yml ⚪ NONE
.github/workflows/ai-issue-triage.yml ⚪ NONE
.github/workflows/ci.yml ⚪ NONE
.github/workflows/claude.yml ⚪ NONE
.github/workflows/gitnexus-impact.yml ⚪ NONE
.github/workflows/nightly-review.yml ⚪ NONE
.github/workflows/pal-consensus-review.yml ⚪ NONE
.github/workflows/release-notes.yml ⚪ NONE
.github/workflows/update-architecture.yml ⚪ NONE

Affected Processes

Affected Modules

Detailed Impact by File

Generated by GitNexus impact analysis

@dependabot @github

dependabot Bot commented on behalf of github Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 13, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-337625b3d1 branch April 13, 2026 09:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Tony363 Tony363 Awaiting requested review from Tony363 Tony363 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants