Skip to content

build(deps): Bump the actions group across 1 directory with 6 updates - #113

Merged
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-1a10fbee00
Sep 14, 2026
Merged

build(deps): Bump the actions group across 1 directory with 6 updates#113
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-1a10fbee00

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 6 updates in the / directory:

Package From To
actions/checkout 4 7
julia-actions/setup-julia 2 3
actions/upload-artifact 4 7
SonarSource/sonarqube-scan-action 2 8
github/codeql-action 4.37.9 4.38.0
hyperpolymath/smtp-notify-action 0.2.0 0.3.0

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates julia-actions/setup-julia from 2 to 3

Release notes

Sourced from julia-actions/setup-julia's releases.

v3.0.0

⚠️ Breaking Changes, and Migration Guide for v2 ⟶ v3

  1. v3 requires Node 24 (compared to v2, which required Node 20).
  2. The behavior of version: min has changed between v2 and v3.
    • In v2, version: min would resolve to the minimum major/minor/patch, e.g. 1.10.0.
    • In v3, version: min resolves to the minimum major/minor but the latest patch, e.g. 1.10.11.
    • If you specifically want the minimum major/minor/patch under v3, you should specify version: min-patch. Note: v3 also adds the alias version: min-minor, which is equivalent to version: min.
  3. v3 will throw an error if x86_64 Julia binaries are requested on Apple Silicon macOS. (Under v2, this was a warning.) Under v3, if you specifically want to run x86_64 Julia binaries on Apple Silicon (under Rosetta 2), you must now opt-in by specifying the force-arch: true input.

Other Changes

We updated some dependencies, and we improved and updated the CI tooling on this repo.

Full Changelog

Full Changelog: julia-actions/setup-julia@v2.7.0...v3.0.0

v2.7.0

Documentation

Dependencies

... (truncated)

Commits
  • fa02766 Bug fix: Validate cached julia binary exists and check PATH resolution (#389)
  • ff78161 Bump julia-actions/setup-julia from 2.7.0 to 3.0.1 in the all-github-actions ...
  • fe02cb7 README: Add a link to the v2-to-v3 release notes (#388)
  • f6f565d Bugfix: Fix an error seen when using min-minor or min-patch (#387)
  • 4a12c5f Breaking: Change min to return the latest patch (but still the minimum majo...
  • a8c65a2 Bump the all-github-actions group across 1 directory with 2 updates (#381)
  • 92d77f5 Bump picomatch from 2.3.1 to 2.3.2 (#379)
  • 679f144 Bump handlebars from 4.7.8 to 4.7.9 (#377)
  • 7c976c8 Add workflow to run make everything-from-scratch (#378)
  • 101e139 Breaking: Migrate from Node 20 to Node 24 (#374)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates SonarSource/sonarqube-scan-action from 2 to 8

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v8.0.0

What's Changed

Breaking change

Full Changelog: SonarSource/sonarqube-scan-action@v7...v8.0.0

v7.2.1

What's Changed

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.2.1

v7.2.0

What's Changed

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.2.0

v7.1.0

What's Changed

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.1.0

v7.0.0

What's Changed

New Contributors

Full Changelog: SonarSource/sonarqube-scan-action@v6.0.0...v7.0.0

... (truncated)

Commits
  • 2291811 SQSCANGHA-156 GPG signature verification fails when temporary directory path ...
  • 7cdc154 SQSCANGHA-153 NO-JIRA Bump actions/checkout from 6.0.2 to 7.0.0 (#255)
  • 45f2736 SQSCANGHA-151 Change Code Owners (#254)
  • 7138816 SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows (#251)
  • 3581139 SQSCANGHA-135 Fix scanner binaries always re-downloaded due to incompatible 4...
  • c9d327c SQSCANGHA-84 Remove outdated wget/curl references
  • b243e51 SQSCANGHA-88 Deprecate the SONARCLOUD_URL env variable support
  • 375c3f5 SQSCANGHA-149 Add scannerBinariesAuthHeader input for authenticated binary do...
  • 9c78323 SQSCANGHA-144 Add gate jobs to QA workflows for branch protection
  • 7006c44 Update SonarScanner CLI to 8.1.0.6389
  • Additional commits viewable in compare view

Updates github/codeql-action from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action's releases.

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Changelog

Sourced from github/codeql-action's changelog.

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Commits
  • b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
  • 02d5093 Update changelog for v4.38.0
  • 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
  • bfcc52b Run slow macOS checks on larger runners
  • 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
  • 0b7ca40 Add changelog note
  • 40484b3 Update default bundle to codeql-bundle-v2.27.0
  • 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
  • 40a6b38 Address toolcache cleanup review feedback
  • deece8f Apply suggestion from @​henrymercer
  • Additional commits viewable in compare view

Updates hyperpolymath/smtp-notify-action from 0.2.0 to 0.3.0

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.3.0

Static, byte-reproducible smtp-notify binaries. CI rebuilt them from this tag and verified they hash to exactly the SHA-256 pins inside this tag's action.yml before publishing.

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

== v0.3.0 — 2026-09-09

[IMPORTANT]

main is not a release, and pinning @main is not supported.

Between a release commit landing on main and its tag being pushed, action.yml on main names assets that do not exist yet, so @main fails at the download step. This window is unavoidable rather than an oversight: the release workflow refuses to publish unless the asset URL in the tagged commit already names the tag being released, so the commit must precede the tag. The window is minutes long and is one more reason @main is not a supported ref.

Pin a tag, or a commit SHA that is an ancestor of one.

=== Added

  • STARTTLS on the submission port. secure: false or secure: starttls now starts in the clear on port 587 and upgrades the same connection in place per RFC 3207, including the mandatory second EHLO after the upgrade. The upgrade is not opportunistic: a server that does not advertise STARTTLS fails the step, and that check runs before the command is sent, so no credential is ever written to a cleartext stream. Certificate verification is identical on both TLS paths.
  • EHLO capability parsing (issue #9). The EHLO reply is parsed into a Capabilities value — STARTTLS, the AUTH mechanism list (including the Exchange AUTH=LOGIN spelling), SIZE and 8BITMIME — and an AUTH failure now names what the server actually advertised. A mechanism mismatch and a wrong password no longer look alike in the log.
  • The proven state machine now carries two tables, selected by transport, each proven separately: the implicit-TLS table is proven to contain no upgrade rows, and the STARTTLS table is proven to reach them from the start state. A row that is present but unreachable would have authenticated in the clear while every prior proof stayed green.
  • AUTH LOGIN, and mechanism selection (issue #10). The mechanism is chosen from the advertised list instead of assumed: PLAIN where offered (one round trip), LOGIN otherwise. On the STARTTLS path the choice is made from the post-upgrade advertisement, so rewriting the cleartext greeting cannot steer it. A server offering neither is refused before any credential byte is written, naming what was on offer. XOAUTH2 is not implemented and is not planned — it needs an OAuth token, which a repository secret cannot supply. The two 334 challenges are driven outside the proven table by design; the terminal reply is still checked against it. See KNOWN-DEFECTS.adoc, "Scope of the proof".

Microsoft 365 and Google Workspace are reachable from this release on port 587 with secure: starttls. Port 465 has no listener at Microsoft 365 and never will work. The STARTTLS handshake is verified against both providers' live submission ports — smtp.office365.com:587 and smtp.gmail.com:587, on 2026-09-09 —

... (truncated)

Commits
  • 22e7bdb release: v0.3.0 — action.yml fetches the STARTTLS binaries
  • 11c4ba9 feat: reach Microsoft 365 and Google Workspace on the submission port (STARTT...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): Bump the actions group across 1 directory with 6 updates
1342126 
Bumps the actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia) | `2` | `3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `2` | `8` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.37.9` | `4.38.0` |
| [hyperpolymath/smtp-notify-action](https://github.com/hyperpolymath/smtp-notify-action) | `0.2.0` | `0.3.0` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `julia-actions/setup-julia` from 2 to 3
- [Release notes](https://github.com/julia-actions/setup-julia/releases)
- [Commits](julia-actions/setup-julia@v2...v3)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `SonarSource/sonarqube-scan-action` from 2 to 8
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](SonarSource/sonarqube-scan-action@v2...v8)

Updates `github/codeql-action` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v4.37.9...v4.38.0)

Updates `hyperpolymath/smtp-notify-action` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/hyperpolymath/smtp-notify-action/releases)
- [Changelog](https://github.com/hyperpolymath/smtp-notify-action/blob/main/CHANGELOG.adoc)
- [Commits](hyperpolymath/smtp-notify-action@v0.2.0...v0.3.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: julia-actions/setup-julia
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: SonarSource/sonarqube-scan-action
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: hyperpolymath/smtp-notify-action
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 13, 2026
@coderabbitai

coderabbitai Bot commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: bb5a9cc4-4fc9-4e5d-ad57-7cdf9e1fed6a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit a5e53a0 into main Sep 14, 2026
5 of 6 checks passed
@hyperpolymath
hyperpolymath deleted the dependabot/github_actions/actions-1a10fbee00 branch September 14, 2026 04:00
@hyperpolymath hyperpolymath mentioned this pull request Sep 17, 2026
Closed
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath