Skip to content

Comments

chore(deps): bump the all-github-actions group across 1 directory with 13 updates#1017

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/all-github-actions-62f2d50de6
Open

chore(deps): bump the all-github-actions group across 1 directory with 13 updates#1017
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/all-github-actions-62f2d50de6

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 23, 2026

Bumps the all-github-actions group with 13 updates in the / directory:

Package From To
github/gh-aw 0.47.0 0.49.5
actions/download-artifact 6.0.0 7.0.0
actions/setup-dotnet 4.3.1 5.1.0
actions/setup-go 5.4.0 6.2.0
actions/setup-java 4.8.0 5.2.0
actions/cache 4.3.0 5.0.3
aquasecurity/trivy-action 0.33.1 0.34.1
amannn/action-semantic-pull-request 5 6
docker/login-action 3.6.0 3.7.0
docker/setup-qemu-action 3.2.0 3.7.0
sigstore/cosign-installer 3.5.0 4.0.0
docker/build-push-action 5.4.0 6.19.2
actions/setup-python 5.6.0 6.2.0

Updates github/gh-aw from 0.47.0 to 0.49.5

Release notes

Sourced from github/gh-aw's releases.

v0.49.5

🌟 Release Highlights

This release focuses on correctness and reliability — fixing propagation bugs in threat detection, stabilizing compiled output ordering, and expanding schema coverage so configurations behave exactly as documented.

✨ What's New

  • Expanded runtime & permission schema coverage — RuntimeConfig and RuntimesConfig typed structs now cover all 11 supported runtimes (including bun, deno, uv, and more) plus action-repo/action-version fields. repository-projects and organization-projects permission scopes are now correctly included in the schema, preventing silent validation failures. (#17911, #17951)
  • storage.googleapis.com added to node ecosystem — Deno and Bun workflows that depend on Google Cloud Storage (e.g., deno/fresh, deno/postgres) can now reach storage.googleapis.com without extra network configuration. (#17944)
  • MCP observability pipeline alignment — The daily observability report now uses rpc-messages.jsonl as the canonical telemetry fallback, eliminating false 🔴 Critical alerts for Copilot-engine MCP runs. (#17950)
  • MCPServerID semantic type — MCP server ID constants are now compile-time typed, preventing accidental mixing with arbitrary string values. (#17897)

🐛 Bug Fixes & Improvements

  • Threat detection no longer inherits --agent flag — engine.agent was being propagated into the threat detection job via pointer copy, causing "No such agent" failures. The detection job now correctly ignores agent configuration. (#17949)
  • Stable compiled lock file ordering — Non-deterministic import and job dependency ordering caused noisy, spurious diffs in .lock.yml files on each recompile. Output ordering is now stable. (#17927)
  • Safe-outputs: 11 missing operation types restored — hasSafeOutputType() was missing cases for 11 operation types, plural YAML tags were mismatched, and meta fields were not being merged. All resolved. (#17908)
  • Network/firewall schema fixes — Schema description no longer incorrectly states firewall is Copilot-only; cleanup-script is now included; log-level hyphen casing corrected. (#17909)

📚 Documentation

  • Network docs updated for Codex & Gemini — The network.md reference now documents firewall and network feature support across all four engines. (#17910)
  • Playwright allowed_domains removed from docs — This field was deprecated in v0.9.0; the docs now correctly direct users to the top-level network: field. (#17942)

🌍 Community Contributions

A huge thank you to the community member who reported an issue resolved in this release:

For complete details, see CHANGELOG.

Generated by Release

What's Changed

... (truncated)

Changelog

Sourced from github/gh-aw's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0

gh extension upgrade --all
[aw]: already up to date


gh extension remove gh-aw


gh extension install github/gh-aw
✓ Installed extension github/gh-aw


gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits
  • a93e36e Fix: engine.agent propagates to threat detection job causing "No such agent" ...
  • b4d5106 update docs
  • d7f5b2f update docs
  • 782c7da Merge branch 'main' of https://github.com/github/gh-aw
  • 34ed00d add docs
  • a98c64f Add missing permission scopes to schema and handle all meta-key in scope co...
  • aa6ae35 Align MCP observability pipeline: treat rpc-messages.jsonl as canonical telem...
  • 913d9a2 update docs
  • 3f318d9 remove dummy files
  • 8a7090e Fix safe-outputs: missing op types in hasSafeOutputType, plural YAML tags, un...
  • Additional commits viewable in compare view

Updates actions/download-artifact from 6.0.0 to 7.0.0

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

Commits
  • 37930b1 Merge pull request #452 from actions/download-artifact-v7-release
  • 72582b9 doc: update readme
  • 0d2ec9d chore: release v7.0.0 for Node.js 24 support
  • fd7ae8f Merge pull request #451 from actions/fix-storage-blob
  • d484700 chore: restore minimatch.dep.yml license file
  • 03a8080 chore: remove obsolete dependency license files
  • 56fe6d9 chore: update @​actions/artifact license file to 5.0.1
  • 8e3ebc4 chore: update package-lock.json with @​actions/artifact@​5.0.1
  • 1e3c4b4 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
  • 458627d chore: use local @​actions/artifact package for Node.js 24 testing
  • Additional commits viewable in compare view

Updates actions/setup-dotnet from 4.3.1 to 5.1.0

Release notes

Sourced from actions/setup-dotnet's releases.

v5.1.0

What's Changed

Documentation

Dependency updates

New Contributors

Full Changelog: actions/setup-dotnet@v5...v5.1.0

v5.0.1

What's Changed

Full Changelog: actions/setup-dotnet@v5...v5.0.1

v5.0.0

What's Changed

Breaking Changes

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Updates

Bug Fixes

New Contributors

... (truncated)

Commits
  • baa11fb Bump test dependencies to resolve System.Net.Http vulnerability, update workf...
  • 24ec4f2 Upgrade to latest actions packages (#687)
  • 4c100cb Fix icons (#604)
  • 25328d8 Bump actions/checkout from 5 to 6 (#684)
  • 937b8dd Update README with note on setting DOTNET_INSTALL_DIR for Linux permission is...
  • 2016bd2 Bump actions/publish-action from 0.3.0 to 0.4.0 and update macos-13 to macos-...
  • 21e81f6 Bump eslint-plugin-jest from 27.9.0 to 29.0.1 (#648)
  • 7403103 Bump typescript from 5.4.2 to 5.9.2 (#624)
  • d4c9434 Update to Node.js 24 and modernize async usage (#654)
  • 5c125af Bump actions/checkout from 4 to 5 (#662)
  • Additional commits viewable in compare view

Updates actions/setup-go from 5.4.0 to 6.2.0

Release notes

Sourced from actions/setup-go's releases.

v6.2.0

What's Changed

Enhancements

Dependency updates

New Contributors

Full Changelog: actions/setup-go@v6...v6.2.0

v6.1.0

What's Changed

Enhancements

Dependency updates

New Contributors

Full Changelog: actions/setup-go@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

... (truncated)

Commits

Updates actions/setup-java from 4.8.0 to 5.2.0

Release notes

Sourced from actions/setup-java's releases.

v5.2.0

What's Changed

Enhancement

Documentation Changes

Dependency Updates

New Contributors

Full Changelog: actions/setup-java@v5...v5.2.0

v5.1.0

What's Changed

New Features

Bug Fixes & Improvements

Documentation changes

Dependency updates

New Contributors

Full Changelog: actions/setup-java@v5...v5.1.0

... (truncated)

Commits
  • be666c2 Chore: Version Update and Checkout Update to v6 (#973)
  • f7a6fef Bump actions/checkout from 5 to 6 (#961)
  • d81c4e4 Upgrade @​actions/cache to v5 (#968)
  • 1b1bbe1 readme update (#972)
  • 5d7b214 Retry on HTTP 522 Connection timed out (#964)
  • f2beeb2 Bump actions/publish-action from 0.3.0 to 0.4.0 (#912)
  • 4e7e684 feat: Add support for .sdkmanrc file in java-version-file parameter (#736)
  • 46c56d6 Add GitHub Token Support for GraalVM and Refactor Code (#849)
  • 66b9457 Update SapMachine URLs (#955)
  • 6ba5449 Enhance error logging for network failures to include endpoint/IP details, ad...
  • Additional commits viewable in compare view

Updates actions/cache from 4.3.0 to 5.0.3

Release notes

Sourced from actions/cache's releases.

v5.0.3

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

What's Changed

v5.0.0

What's Changed

Full Changelog: actions/cache@v5...v5.0.1

v5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

4.3.0

  • Bump @actions/cache to v4.1.0

... (truncated)

Commits

Updates aquasecurity/trivy-action from 0.33.1 to 0.34.1

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.34.1

What's Changed

Full Changelog: aquasecurity/trivy-action@0.34.0...0.34.1

v0.34.0

What's Changed

Full Changelog: aquasecurity/trivy-action@0.33.1...0.34.0

Commits
  • e368e32 ci(test): add zizmor security linter for GitHub Actions (#502)
  • c1824fd chore(deps): Update trivy to v0.69.1 (#506)
  • bc61dc5 Merge commit from fork
  • 5eb7ef2 ci: use checks bundle v2 in sync workflow (#505)
  • 22438a4 Merge pull request #496 from aquasecurity/bump-trivy-1765431074
  • 0024b3f chore(deps): Update trivy to v0.68.1
  • 83690f7 ci: install trivy in bump-trivy workflow and update tests (#495)
  • df65449 chore: update README (#493)
  • 0317097 ci: use setup-bats in bump-trivy workflow (#494)
  • See full diff in compare view

Updates amannn/action-semantic-pull-request from 5 to 6

Release notes

Sourced from amannn/action-semantic-pull-request's releases.

v6.0.0

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

  • Upgrade action to use Node.js 24 and ESM (#287)

Features

  • Upgrade action to use Node.js 24 and ESM (#287) (bc0c9a7)

v5.5.3

5.5.3 (2024-06-28)

Bug Fixes

v5.5.2

5.5.2 (2024-04-24)

Bug Fixes

v5.5.1

5.5.1 (2024-04-24)

Bug Fixes

v5.5.0

5.5.0 (2024-04-23)

Features

v5.4.0

5.4.0 (2023-11-03)

... (truncated)

Changelog

Sourced from amannn/action-semantic-pull-request's changelog.

Changelog

6.1.1 (2025-08-22)

Bug Fixes

  • Parse headerPatternCorrespondence properly (#295) (800da4c)

6.1.0 (2025-08-19)

Features

Bug Fixes

  • Remove trailing whitespace from "unknown release type" error message (#291) (afa4edb)

6.0.1 (2025-08-13)

Bug Fixes

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

  • Upgrade action to use Node.js 24 and ESM (#287)

Features

  • Upgrade action to use Node.js 24 and ESM (#287) (bc0c9a7)

5.5.3 (2024-06-28)

Bug Fixes

5.5.2 (2024-04-24)

Bug Fixes

5.5.1 (2024-04-24)

... (truncated)

Commits
  • 48f2562 chore: Release 6.1.1 [skip ci]
  • 800da4c fix: Parse headerPatternCorrespondence properly (#295)
  • 677b895 test: Fix broken test
  • 24e6f01 ci: Fix permissions for tagger
  • 7f33ba7 chore: Release 6.1.0 [skip ci]
  • afa4edb fix: Remove trailing whitespace from "unknown release type" error message (#291)
  • a30288b feat: Support providing regexps for types (#292)
  • a46a7c8 build: Move Vitest to devDependencies (#290)
  • fdd4d3d chore: Release 6.0.1 [skip ci]
  • 58e4ab4 fix: Actually execute action (#289)
  • Additional commits viewable in

@dependabot
chore(deps): bump the all-github-actions group across 1 directory wit…
2937664 
…h 13 updates

Bumps the all-github-actions group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github/gh-aw](https://github.com/github/gh-aw) | `0.47.0` | `0.49.5` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `6.0.0` | `7.0.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4.3.1` | `5.1.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5.4.0` | `6.2.0` |
| [actions/setup-java](https://github.com/actions/setup-java) | `4.8.0` | `5.2.0` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.3` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.33.1` | `0.34.1` |
| [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request) | `5` | `6` |
| [docker/login-action](https://github.com/docker/login-action) | `3.6.0` | `3.7.0` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.2.0` | `3.7.0` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.5.0` | `4.0.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `5.4.0` | `6.19.2` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `6.2.0` |



Updates `github/gh-aw` from 0.47.0 to 0.49.5
- [Release notes](https://github.com/github/gh-aw/releases)
- [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw@v0.47.0...v0.49.5)

Updates `actions/download-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@018cc2c...37930b1)

Updates `actions/setup-dotnet` from 4.3.1 to 5.1.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@v4.3.1...baa11fb)

Updates `actions/setup-go` from 5.4.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5.4.0...7a3fe6c)

Updates `actions/setup-java` from 4.8.0 to 5.2.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v4.8.0...be666c2)

Updates `actions/cache` from 4.3.0 to 5.0.3
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0057852...cdf6c1f)

Updates `aquasecurity/trivy-action` from 0.33.1 to 0.34.1
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@b6643a2...e368e32)

Updates `amannn/action-semantic-pull-request` from 5 to 6
- [Release notes](https://github.com/amannn/action-semantic-pull-request/releases)
- [Changelog](https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md)
- [Commits](amannn/action-semantic-pull-request@e32d7e6...48f2562)

Updates `docker/login-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

Updates `docker/setup-qemu-action` from 3.2.0 to 3.7.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@49b3bc8...c7c5346)

Updates `sigstore/cosign-installer` from 3.5.0 to 4.0.0
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@59acb62...faadad0)

Updates `docker/build-push-action` from 5.4.0 to 6.19.2
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@ca052bb...10e90e3)

Updates `actions/setup-python` from 5.6.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5.6.0...a309ff8)

---
updated-dependencies:
- dependency-name: github/gh-aw
  dependency-version: 0.49.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-github-actions
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
- dependency-name: actions/setup-dotnet
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
- dependency-name: actions/setup-go
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
- dependency-name: actions/setup-java
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.34.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-github-actions
- dependency-name: amannn/action-semantic-pull-request
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-github-actions
- dependency-name: docker/setup-qemu-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-github-actions
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Feb 23, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Feb 23, 2026

✅ Coverage Check Passed

Overall Coverage

Metric Base PR Delta
Lines 82.30% 82.45% 📈 +0.15%
Statements 82.23% 82.37% 📈 +0.14%
Functions 82.74% 82.74% ➡️ +0.00%
Branches 74.46% 74.55% 📈 +0.09%
📁 Per-file Coverage Changes (1 files)
File Lines (Before → After) Statements (Before → After)
src/docker-manager.ts 83.2% → 83.8% (+0.55%) 82.5% → 83.0% (+0.54%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants