chore(deps): bump the actions group across 3 directories with 5 updates

[dependabot]

Bumps the actions group with 1 update in the / directory: jdx/mise-action.
Bumps the actions group with 4 updates in the /.github/actions/deploy-setup directory: Infisical/secrets-action, docker/setup-qemu-action, aws-actions/configure-aws-credentials and actions/download-artifact.
Bumps the actions group with 1 update in the /.github/actions/setup directory: jdx/mise-action.

Updates jdx/mise-action from 5.1.1 to 5.2.0

Release notes

Sourced from jdx/mise-action's releases.

v5.2.0: Periodic cache rebuilds, signed packslip verification, and monorepo installs

The default cache key now rolls over every 30 days, so long-lived caches pick up newer mise releases. The action also checks the downloaded mise binary against the release's signed packslip, and it runs mise install --monorepo automatically in monorepos. Existing caches miss once after you upgrade, because the default cache key format has changed.

Added

• The cache is rebuilt every 30 days by default. GitHub never evicts a cache that keeps getting hits. Before this release, an active repo could keep the same mise binary and tools for months, until a config file changed. The default cache key now includes a period suffix (-p<N>), so the cache is rebuilt from scratch at least once per period. All repos roll over on the same calendar boundary. Use the new cache_max_age_days input to change the period, or set it to 0 to keep the old key that never expires. Custom cache_key templates can use the new {{cache_period}} variable, which {{default}} already includes. A custom key that doesn't use it behaves as before. On self-hosted runners that keep mise data between runs, you may also need auto_update: true to pick up a newer mise. (#689 by @​jdx, fixes #688)

  - uses: jdx/mise-action@v5
    with:
      cache_max_age_days: 14 # default 30; 0 disables periodic rebuilds

• Throttled cache restores and saves can be retried. Before this release, when GitHub's cache service returned HTTP 429, the action gave up right away: a restore counted as a miss and a save was skipped. The new cache_restore_retry_budget and cache_save_retry_budget inputs set how long the action may wait. Each retry waits for the Retry-After value plus some random jitter. Once the budget runs out, the action falls back to the old behavior. Retries apply to the main cache, the post-step save and the binary cache. Real cache misses and reservation conflicts are never retried. Both budgets default to 0s (no retries). @actions/cache doesn't report 429 errors directly, so the action detects throttling from its warning messages. If those messages change in a future @actions/cache release, throttling won't be detected and nothing will be retried. (#692 by @​jdx, fixes #691)

  - uses: jdx/mise-action@v5
    with:
      cache_restore_retry_budget: 60s
      cache_save_retry_budget: 120s

• The latest mise binary can fall back to a second download source. When the action downloads the latest mise version, it can fall back between GitHub and mise.jdx.dev if the first source fails. The fetch_from_github setting decides which source it tries first. Pinned versions and minimum_release_age installs are only downloaded from GitHub. The binary is still checked against the signed checksums for the resolved version, whichever source it came from. (#692 by @​jdx)
• The mise binary is checked against its signed packslip. If a mise release includes packslip.sigstore.json, the action checks the downloaded binary against it. The bundle must be signed by mise's release workflow for that exact tag. After a successful check, the log shows Verified <asset> against the signed packslip. If the check fails, the install stops instead of falling back to a weaker check. Releases without a packslip use the existing minisign and SHASUMS256 check. An explicit sha256 input still takes precedence. (#693 by @​jdx)
• Monorepo-aware installs. If your mise config sets [monorepo].config_roots, the action now adds --monorepo to mise install, so tools configured anywhere in the monorepo get installed. Repos without that setting aren't affected. To opt out, set monorepo: false. (#679 by @​zeitlinger)

Fixed

• Tool directories that mise moves to the front of PATH are now exported. The action used to find mise's PATH changes by comparing mise's PATH with the runner's. If a tool's bin directory was already on the runner's PATH, such as ~/.cargo/bin, mise only moved it to the front, so the action didn't export it. Later steps then found the mise shim first. For example, rustup resolved to the shim instead of ~/.cargo/bin/rustup. The action now asks mise for its entries with mise env --paths and exports them in the order mise reports. This fix needs a mise version that supports --paths. With older versions, the action uses the old comparison. (#685 by @​jdx)

Documentation

• The new "Release workflows" section of the README says that jobs that publish releases shouldn't restore caches. A lower-trust workflow that can write to default-branch caches could otherwise slip files into a release. In those jobs, use cache: false or GitHub's cache-mode: none. (#682 by @​jdx)
• The README explains how to cache mise's downloads, keyed on mise.lock, instead of installed tools. It includes a Windows example that sets MISE_CACHE_DIR from ${{ runner.temp }}, because actions/cache doesn't expand %TEMP%. (#686, #690 by @​zeitlinger)

Breaking Changes

• The default cache key has a new format, so the first run after upgrading is a cache miss and saves a fresh cache. After that, the cache is rebuilt every 30 days by default. To keep the old cache key that never expires, set cache_max_age_days: 0. Workflows that set a custom cache_key without {{default}} or {{cache_period}} aren't affected.

Full Changelog: jdx/mise-action@v5.1.2...v5.2.0

v5.1.2: mise_dir now sets MISE_DATA_DIR; auto_update handles a locked mise binary

The mise_dir input now also sets where mise installs tools, so those tools end up in the cache. With auto_update: true, the action no longer crashes on Windows when the mise binary is still in use.

Fixed

• mise_dir now exports MISE_DATA_DIR. Before this release, mise_dir moved the mise binary and the cache path, but mise kept installing tools to ~/.local/share/mise. The saved cache didn't include the tools. On runners where ~/.local isn't writable, the step failed with EACCES: permission denied. When mise_dir is set, the action now exports MISE_DATA_DIR=<mise_dir>, so tools are installed into the directory that gets cached. If your workflow sets a different MISE_DATA_DIR, the mise_dir input overrides it. If mise_dir isn't set, nothing changes. mise's state directory (~/.local/state/mise) stays where it is. If that path also can't be written, set MISE_STATE_DIR yourself. (#672 by @​jdx, fixes #668)

  - uses: jdx/mise-action@v5
    with:
      mise_dir: ${{ runner.tool_cache }}/mise/data

• auto_update no longer crashes when it can't replace mise.exe. On Windows, the step used to fail with a bare EPERM: operation not permitted, unlink '…\mise.exe' if another process was still using the binary. Now, if version isn't pinned and the existing binary passes verification against its recorded version, the action prints a warning and continues with that version. In any other case, the step fails with a message that says the file is in use and how to fix it. A pinned version never quietly keeps an older binary. (#665 by @​jdx, fixes #664)

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679
• Change minimum age for auto-merging release PRs by @​jdx in b511e8d

📚 Documentation

• tell release workflows not to use the cache (#682) by @​jdx in #682
• explain caching mise downloads instead of installs (#686) by @​zeitlinger in #686
• use resolved Windows downloads cache path (#690) by @​zeitlinger in #690

⚙️ Miscellaneous Tasks

• stop restoring caches in release jobs (#683) by @​jdx in #683
• replace prettier with oxfmt (#694) by @​jdx in #694

---

5.1.2 - 2026-10-12

🐛 Bug Fixes

• continue with the existing mise when auto-update cannot replace it (#665) by @​jdx in #665
• export mise_dir as MISE_DATA_DIR so mise installs tools there (#672) by @​jdx in #672

📚 Documentation

• explain MISE_ENABLE_TOOLS in GitHub Actions (#667) by @​zeitlinger in #667
• update the Rust cache section for mise 2026.9.2 (#670) by @​jdx in #670

⚙️ Miscellaneous Tasks

• (ci) update pr-closer to v1.3.0 by @​jdx in 076ebfb
• (ci) lint workflows with jactionlint (#673) by @​jdx in #673
• (ci) switch to jactionlint v2 and drop zizmor (#674) by @​jdx in #674
• update pr-closer policy by @​jdx in 88f13e0

... (truncated)

Commits

• 9b200bc chore: release v5.2.0 (#680)
• b511e8d Change minimum age for auto-merging release PRs
• 887d1f4 docs: use resolved Windows downloads cache path (#690)
• 93c62ad chore: replace prettier with oxfmt (#694)
• 04716d4 feat: verify the mise binary against its signed packslip (#693)
• 5108104 feat(cache): retry throttled cache restores and saves (#692)
• d401260 docs: explain caching mise downloads instead of installs (#686)
• e7cf35f feat(cache): rebuild the cache every 30 days by default (#689)
• cd02696 fix: export the PATH entries mise reports with mise env --paths (#685)
• 6784481 docs: tell release workflows not to use the cache (#682)
• Additional commits viewable in compare view

Updates jdx/mise-action from 5.1.1 to 5.2.0

Release notes

Sourced from jdx/mise-action's releases.

v5.2.0: Periodic cache rebuilds, signed packslip verification, and monorepo installs

The default cache key now rolls over every 30 days, so long-lived caches pick up newer mise releases. The action also checks the downloaded mise binary against the release's signed packslip, and it runs mise install --monorepo automatically in monorepos. Existing caches miss once after you upgrade, because the default cache key format has changed.

Added

• The cache is rebuilt every 30 days by default. GitHub never evicts a cache that keeps getting hits. Before this release, an active repo could keep the same mise binary and tools for months, until a config file changed. The default cache key now includes a period suffix (-p<N>), so the cache is rebuilt from scratch at least once per period. All repos roll over on the same calendar boundary. Use the new cache_max_age_days input to change the period, or set it to 0 to keep the old key that never expires. Custom cache_key templates can use the new {{cache_period}} variable, which {{default}} already includes. A custom key that doesn't use it behaves as before. On self-hosted runners that keep mise data between runs, you may also need auto_update: true to pick up a newer mise. (#689 by @​jdx, fixes #688)

  - uses: jdx/mise-action@v5
    with:
      cache_max_age_days: 14 # default 30; 0 disables periodic rebuilds

• Throttled cache restores and saves can be retried. Before this release, when GitHub's cache service returned HTTP 429, the action gave up right away: a restore counted as a miss and a save was skipped. The new cache_restore_retry_budget and cache_save_retry_budget inputs set how long the action may wait. Each retry waits for the Retry-After value plus some random jitter. Once the budget runs out, the action falls back to the old behavior. Retries apply to the main cache, the post-step save and the binary cache. Real cache misses and reservation conflicts are never retried. Both budgets default to 0s (no retries). @actions/cache doesn't report 429 errors directly, so the action detects throttling from its warning messages. If those messages change in a future @actions/cache release, throttling won't be detected and nothing will be retried. (#692 by @​jdx, fixes #691)

  - uses: jdx/mise-action@v5
    with:
      cache_restore_retry_budget: 60s
      cache_save_retry_budget: 120s

• The latest mise binary can fall back to a second download source. When the action downloads the latest mise version, it can fall back between GitHub and mise.jdx.dev if the first source fails. The fetch_from_github setting decides which source it tries first. Pinned versions and minimum_release_age installs are only downloaded from GitHub. The binary is still checked against the signed checksums for the resolved version, whichever source it came from. (#692 by @​jdx)
• The mise binary is checked against its signed packslip. If a mise release includes packslip.sigstore.json, the action checks the downloaded binary against it. The bundle must be signed by mise's release workflow for that exact tag. After a successful check, the log shows Verified <asset> against the signed packslip. If the check fails, the install stops instead of falling back to a weaker check. Releases without a packslip use the existing minisign and SHASUMS256 check. An explicit sha256 input still takes precedence. (#693 by @​jdx)
• Monorepo-aware installs. If your mise config sets [monorepo].config_roots, the action now adds --monorepo to mise install, so tools configured anywhere in the monorepo get installed. Repos without that setting aren't affected. To opt out, set monorepo: false. (#679 by @​zeitlinger)

Fixed

• Tool directories that mise moves to the front of PATH are now exported. The action used to find mise's PATH changes by comparing mise's PATH with the runner's. If a tool's bin directory was already on the runner's PATH, such as ~/.cargo/bin, mise only moved it to the front, so the action didn't export it. Later steps then found the mise shim first. For example, rustup resolved to the shim instead of ~/.cargo/bin/rustup. The action now asks mise for its entries with mise env --paths and exports them in the order mise reports. This fix needs a mise version that supports --paths. With older versions, the action uses the old comparison. (#685 by @​jdx)

Documentation

• The new "Release workflows" section of the README says that jobs that publish releases shouldn't restore caches. A lower-trust workflow that can write to default-branch caches could otherwise slip files into a release. In those jobs, use cache: false or GitHub's cache-mode: none. (#682 by @​jdx)
• The README explains how to cache mise's downloads, keyed on mise.lock, instead of installed tools. It includes a Windows example that sets MISE_CACHE_DIR from ${{ runner.temp }}, because actions/cache doesn't expand %TEMP%. (#686, #690 by @​zeitlinger)

Breaking Changes

• The default cache key has a new format, so the first run after upgrading is a cache miss and saves a fresh cache. After that, the cache is rebuilt every 30 days by default. To keep the old cache key that never expires, set cache_max_age_days: 0. Workflows that set a custom cache_key without {{default}} or {{cache_period}} aren't affected.

Full Changelog: jdx/mise-action@v5.1.2...v5.2.0

v5.1.2: mise_dir now sets MISE_DATA_DIR; auto_update handles a locked mise binary

The mise_dir input now also sets where mise installs tools, so those tools end up in the cache. With auto_update: true, the action no longer crashes on Windows when the mise binary is still in use.

Fixed

• mise_dir now exports MISE_DATA_DIR. Before this release, mise_dir moved the mise binary and the cache path, but mise kept installing tools to ~/.local/share/mise. The saved cache didn't include the tools. On runners where ~/.local isn't writable, the step failed with EACCES: permission denied. When mise_dir is set, the action now exports MISE_DATA_DIR=<mise_dir>, so tools are installed into the directory that gets cached. If your workflow sets a different MISE_DATA_DIR, the mise_dir input overrides it. If mise_dir isn't set, nothing changes. mise's state directory (~/.local/state/mise) stays where it is. If that path also can't be written, set MISE_STATE_DIR yourself. (#672 by @​jdx, fixes #668)

  - uses: jdx/mise-action@v5
    with:
      mise_dir: ${{ runner.tool_cache }}/mise/data

• auto_update no longer crashes when it can't replace mise.exe. On Windows, the step used to fail with a bare EPERM: operation not permitted, unlink '…\mise.exe' if another process was still using the binary. Now, if version isn't pinned and the existing binary passes verification against its recorded version, the action prints a warning and continues with that version. In any other case, the step fails with a message that says the file is in use and how to fix it. A pinned version never quietly keeps an older binary. (#665 by @​jdx, fixes #664)

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679
• Change minimum age for auto-merging release PRs by @​jdx in b511e8d

📚 Documentation

• tell release workflows not to use the cache (#682) by @​jdx in #682
• explain caching mise downloads instead of installs (#686) by @​zeitlinger in #686
• use resolved Windows downloads cache path (#690) by @​zeitlinger in #690

⚙️ Miscellaneous Tasks

• stop restoring caches in release jobs (#683) by @​jdx in #683
• replace prettier with oxfmt (#694) by @​jdx in #694

---

5.1.2 - 2026-10-12

🐛 Bug Fixes

• continue with the existing mise when auto-update cannot replace it (#665) by @​jdx in #665
• export mise_dir as MISE_DATA_DIR so mise installs tools there (#672) by @​jdx in #672

📚 Documentation

• explain MISE_ENABLE_TOOLS in GitHub Actions (#667) by @​zeitlinger in #667
• update the Rust cache section for mise 2026.9.2 (#670) by @​jdx in #670

⚙️ Miscellaneous Tasks

• (ci) update pr-closer to v1.3.0 by @​jdx in 076ebfb
• (ci) lint workflows with jactionlint (#673) by @​jdx in #673
• (ci) switch to jactionlint v2 and drop zizmor (#674) by @​jdx in #674
• update pr-closer policy by @​jdx in 88f13e0

... (truncated)

Commits

• 9b200bc chore: release v5.2.0 (#680)
• b511e8d Change minimum age for auto-merging release PRs
• 887d1f4 docs: use resolved Windows downloads cache path (#690)
• 93c62ad chore: replace prettier with oxfmt (#694)
• 04716d4 feat: verify the mise binary against its signed packslip (#693)
• 5108104 feat(cache): retry throttled cache restores and saves (#692)
• d401260 docs: explain caching mise downloads instead of installs (#686)
• e7cf35f feat(cache): rebuild the cache every 30 days by default (#689)
• cd02696 fix: export the PATH entries mise reports with mise env --paths (#685)
• 6784481 docs: tell release workflows not to use the cache (#682)
• Additional commits viewable in compare view

Updates Infisical/secrets-action from 1.0.16 to 1.0.18

Release notes

Sourced from Infisical/secrets-action's releases.

v1.0.18

What's Changed

• Add project-id input as an alternative to project-slug in Infisical/secrets-action#40

Full Changelog: Infisical/secrets-action@v1.0.17...v1.0.18

v1.0.17

What's Changed

• feat: add optional secret-name input to fetch a single secret by @​claude[bot] in Infisical/secrets-action#39

New Contributors

• @​claude[bot] made their first contribution in Infisical/secrets-action#39

Full Changelog: Infisical/secrets-action@v1.0.16...v1.0.17

Commits

• d2e351f Merge pull request #40 from Infisical/claude/project-id-input
• a3f95ad Add project-id input as an alternative to project-slug
• 6cd3f7c Merge pull request #39 from Infisical/claude/single-secret-fetch
• c313457 Add optional secret-name input to fetch a single secret
• See full diff in compare view

Updates docker/setup-qemu-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

• Use the shared error helper for Docker commands by @​crazy-max in docker/setup-qemu-action#345
• Bump @​docker/actions-toolkit from 0.96.0 to 0.100.0 in docker/setup-qemu-action#344
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-qemu-action#340
• Bump js-yaml from 4.3.1 to 4.3.2 in docker/setup-qemu-action#342
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-qemu-action#337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.96.0 in docker/setup-qemu-action#336
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-qemu-action#316
• Bump brace-expansion from 1.1.15 to 1.1.18 in docker/setup-qemu-action#332
• Bump js-yaml from 4.2.0 to 4.3.1 in docker/setup-qemu-action#334
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-qemu-action#331
• Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-qemu-action#317
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-qemu-action#333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

Commits

• 9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
• 9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
• 95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
• c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
• fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
• f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
• a63df2f chore: update generated content
• 3e4165f use the shared error helper for Docker commands
• 18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 896cbed [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates Infisical/secrets-action from 1.0.16 to 1.0.18

Release notes

Sourced from Infisical/secrets-action's releases.

v1.0.18

What's Changed

• Add project-id input as an alternative to project-slug in Infisical/secrets-action#40

Full Changelog: Infisical/secrets-action@v1.0.17...v1.0.18

v1.0.17

What's Changed

• feat: add optional secret-name input to fetch a single secret by @​claude[bot] in Infisical/secrets-action#39

New Contributors

• @​claude[bot] made their first contribution in Infisical/secrets-action#39

Full Changelog: Infisical/secrets-action@v1.0.16...v1.0.17

Commits

• d2e351f Merge pull request #40 from Infisical/claude/project-id-input
• a3f95ad Add project-id input as an alternative to project-slug
• 6cd3f7c Merge pull request #39 from Infisical/claude/single-secret-fetch
• c313457 Add optional secret-name input to fetch a single secret
• See full diff in compare view

Updates aws-actions/configure-aws-credentials from 6.2.3 to 6.3.0

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.3.0

6.3.0 (2026-09-11)

Features

• add translate-env-variables option (#1961) (57b8365)

v6.2.4

6.2.4 (2026-08-31)

Bug Fixes

• account-ids handling, mask proxy as secret in logs (#1943) (aa65264)
• skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.3.0 (2026-09-11)

Features

• add translate-env-variables option (#1961) (57b8365)

6.2.4 (2026-08-31)

Bug Fixes

• account-ids handling, mask proxy as secret in logs (#1943) (aa65264)
• skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

6.2.3 (2026-07-22)

Bug Fixes

• attach git credentials before Tag Major Version push (#1877) (9ae780b)
• PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

6.2.2 (2026-07-07)

Miscellaneous Chores

• release 6.2.2 (d01d678)

6.2.1 (2026-06-26)

Bug Fixes

• enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

• add additional session tags by default (#1775) (e0ba768)
• add more retry logic and better logging (#1764) (540d0c1)
• add regex validation to role-session-name (#1765) (e354499)
• Allow custom session tags to be passed when assuming a role (#1759) (61f50f6)
• expose run id in STS client user-agent (#1774) (29d1be3)

... (truncated)

Commits

• e125382 chore(main): release 6.3.0 (#1963)
• 438100a chore: add link to GH security docs (#1962)
• e92ebcc chore: Update dist
• 57b8365 feat: add translate-env-variables option (#1961)
• cc49fa7 chore(docs): README main branch guidance (#1960)
• 866cb16 chore(deps-dev): bump smol-toml from 1.7.0 to 1.7.2 (#1958)
• 6782cb1 chore(deps-dev): bump generate-license-file from 4.2.4 to 4.2.5 (#1951)
• c20509a chore: Update dist
• 7a41fc6 chore(deps): bump @​aws-sdk/client-sts from 3.1121.0 to 3.1127.0 (#1954)
• 726b713 chore(deps-dev): bump @​biomejs/biome from 2.5.11 to 2.5.12 (#1957)
• Additional commits viewable in compare view

Updates docker/setup-qemu-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

• Use the shared error helper for Docker commands by @​crazy-max in docker/setup-qemu-action#345
• Bump @​docker/actions-toolkit from 0.96.0 to 0.100.0 in docker/setup-qemu-action#344
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-qemu-action#340
• Bump js-yaml from 4.3.1 to 4.3.2 in docker/setup-qemu-action#342
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-qemu-action#337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.96.0 in docker/setup-qemu-action#336
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-qemu-action#316
• Bump brace-expansion from 1.1.15 to 1.1.18 in docker/setup-qemu-action#332
• Bump js-yaml from 4.2.0 to 4.3.1 in docker/setup-qemu-action#334
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-qemu-action#331
• Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-qemu-action#317
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-qemu-action#333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

Commits

• 9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
• 9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
• 95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
• c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
• fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
• f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
• a63df2f chore: update generated content
• 3e4165f use the shared error helper for Docker commands
• 18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 896cbed [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• 
  ^{Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a640ea37-88be-41c3-99e7-b958bf89584c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.