chore(deps): bump the actions group across 1 directory with 6 updates by dependabot[bot] · Pull Request #807 · combsmith/.github-private

dependabot · 2026-06-19T16:54:57Z

Bumps the actions group with 6 updates in the / directory:

Package	From	To
actions/checkout	`6.0.2`	`7.0.0`
gitleaks/gitleaks-action	`2.3.9`	`3.0.0`
petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml	`1`	`2`
petry-projects/.github/.github/workflows/dependency-audit-reusable.yml	`1`	`2`
anthropics/claude-code-action	`1.0.148`	`1.0.152`
actions/setup-java	`5.2.0`	`5.3.0`

Updates actions/checkout from 6.0.2 to 7.0.0

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

Updates gitleaks/gitleaks-action from 2.3.9 to 3.0.0

Release notes

Sourced from gitleaks/gitleaks-action's releases.

v3.0.0

What's changed

gitleaks-action v3 migrates the runtime from Node 20 to Node 24. No changes to inputs, outputs, or behavior. Update your workflow from gitleaks/gitleaks-action@v2 to gitleaks/gitleaks-action@v3.

Migration
# Before
- uses: gitleaks/gitleaks-action@v2
After

uses: gitleaks/gitleaks-action@v3
Why

GitHub is deprecating the Node 20 runtime for Actions:

June 2, 2026: GitHub flips the runner default to Node 24. Workflows using gitleaks-action@v2 (Node 20) will still run, but only if ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true is set as an environment variable.

September 16, 2026: Node 20 is removed from GitHub-hosted runners entirely. gitleaks-action@v2 stops working regardless of any opt-out flag.

Changes

action.yml: runtime node20 → node24

@actions/core: 1.10.0 → 1.11.1

dist/ rebuilt

Example workflows updated to actions/checkout@v6 and gitleaks-action@v3

README updated with v3 migration guide

Self-hosted runners

If you use self-hosted runners, ensure your runner version is >= v2.327.1 (required for Node 24 support).

Commits

e0c47f4 chore: migrate to Node 24 runtime (v3)
bf2dc8e Merge pull request #191 from Olexandr88/patch-1
b71323b Update README.md
9c66aa9 Update README.md
186c3fe Create FUNDING.yml
See full diff in compare view

Updates petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml from 1 to 2

Commits

376a4fc feat: auto-trigger PR review when all readiness criteria are met (#323)
6306793 feat(concurrency): add per-repo serialized concurrency to dev-lead stubs (#322)
0765a60 fix(compliance): track per-workflow version tags in stub checker (#302)
66c4866 chore: remove claude-code-reusable.yml and update auto-rebase references
f666f32 Merge pull request #320 from petry-projects/feat/harden-scorecard-workflow
9c9cdd3 feat: harden scorecard workflow to report malformed YAML as findings
f88d254 Merge pull request #319 from petry-projects/fix/scorecard-summary-score
57c1c5e fix: update aggregate score extraction key for scorecard v5.5.0
6fd676b Merge pull request #312 from petry-projects/fix/scorecard-workflow-v2
b1b947e fix: resolve jq parse error by iterating with index
Additional commits viewable in compare view

Updates petry-projects/.github/.github/workflows/dependency-audit-reusable.yml from 1 to 2

Commits

376a4fc feat: auto-trigger PR review when all readiness criteria are met (#323)
6306793 feat(concurrency): add per-repo serialized concurrency to dev-lead stubs (#322)
0765a60 fix(compliance): track per-workflow version tags in stub checker (#302)
66c4866 chore: remove claude-code-reusable.yml and update auto-rebase references
f666f32 Merge pull request #320 from petry-projects/feat/harden-scorecard-workflow
9c9cdd3 feat: harden scorecard workflow to report malformed YAML as findings
f88d254 Merge pull request #319 from petry-projects/fix/scorecard-summary-score
57c1c5e fix: update aggregate score extraction key for scorecard v5.5.0
6fd676b Merge pull request #312 from petry-projects/fix/scorecard-workflow-v2
b1b947e fix: resolve jq parse error by iterating with index
Additional commits viewable in compare view

Updates anthropics/claude-code-action from 1.0.148 to 1.0.152

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.152

Full Changelog: anthropics/claude-code-action@v1...v1.0.152

v1.0.151

What's Changed

fix: skip workflow validation token exchange failures by @Ryanoonan in anthropics/claude-code-action#1417

New Contributors

@Ryanoonan made their first contribution in anthropics/claude-code-action#1417

Full Changelog: anthropics/claude-code-action@v1...v1.0.151

v1.0.150

Full Changelog: anthropics/claude-code-action@v1...v1.0.150

v1.0.149

What's Changed

fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash by @alexglynn in anthropics/claude-code-action#1350

fix(mcp): align allowed-tools parser with SDK option parser by @bymle in anthropics/claude-code-action#1373

New Contributors

@alexglynn made their first contribution in anthropics/claude-code-action#1350

Full Changelog: anthropics/claude-code-action@v1...v1.0.149

Commits

51705da chore: bump Claude Code to 2.1.183 and Agent SDK to 0.3.183
806af32 chore: bump Claude Code to 2.1.181 and Agent SDK to 0.3.181
0a08a86 fix: skip workflow validation token exchange failures (#1417)
9dd8b95 chore: bump Claude Code to 2.1.179 and Agent SDK to 0.3.179
4d7e1f0 chore: bump Claude Code to 2.1.178 and Agent SDK to 0.3.178
3d9f0dc fix(mcp): align allowed-tools parser with SDK option parser (#1373)
a5e5d3b fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*...
See full diff in compare view

Updates actions/setup-java from 5.2.0 to 5.3.0

Release notes

Sourced from actions/setup-java's releases.

v5.3.0

What's Changed

chore: update Java version to 25 in setup examples by @alaahong in actions/setup-java#969

Bump minimatch from 3.1.2 to 3.1.5 by @dependabot[bot] in actions/setup-java#984

Refactor error handling and improve test logging for installers by @chiranjib-swain in actions/setup-java#989

chore: upgrade dependencies (@actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @Copilot in actions/setup-java#999

Add Oracle JDK 17 licensing limitation note by @mahabaleshwars in actions/setup-java#1001

Update readme for ubuntu sudo java_home behavior by @mahabaleshwars in actions/setup-java#1013

temurin: add support for Alpine Linux by @gdams in actions/setup-java#674

fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @gdams in actions/setup-java#1015

Bump @typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @dependabot[bot] in actions/setup-java#952

Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @dependabot[bot] in actions/setup-java#881

Bump picomatch, @types/jest, jest, jest-circus and ts-jest by @dependabot[bot] in actions/setup-java#1016

Bump @types/node from 24.1.0 to 25.9.3 by @dependabot[bot] in actions/setup-java#950

Implement pagination with link headers for Adoptium based apis by @johnoliver in actions/setup-java#1014

Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @johnoliver in actions/setup-java#522

Bump @vercel/ncc from 0.38.1 to 0.44.0 by @dependabot[bot] in actions/setup-java#1018

New Contributors

@alaahong made their first contribution in actions/setup-java#969

@Copilot made their first contribution in actions/setup-java#999

@johnoliver made their first contribution in actions/setup-java#1014

Full Changelog: actions/setup-java@v5...v5.3.0

Commits

ad2b381 Bump @vercel/ncc from 0.38.1 to 0.44.0 (#1018)
b24df5b Make the Adoptopenjdk package type look at the Temurin repo first for latest ...
43120bc Implement pagination with link headers for Adoptium based apis (#1014)
ad9d6a6 Bump @types/node from 24.1.0 to 25.9.3 (#950)
039af37 Bump picomatch, @types/jest, jest, jest-circus and ts-jest (#1016)
1756ab6 Bump eslint-config-prettier from 8.10.0 to 10.1.8 (#881)
662bb59 Bump @typescript-eslint/eslint-plugin from 8.35.1 to 8.46.2 (#952)
1071fc1 fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parse...
576b821 Merge pull request #674 from gdams/alpine
307d3a2 update readme for ubuntu sudo java_home behavior (#1013)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2.3.9` | `3.0.0` | | [petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml](https://github.com/petry-projects/.github) | `1` | `2` | | [petry-projects/.github/.github/workflows/dependency-audit-reusable.yml](https://github.com/petry-projects/.github) | `1` | `2` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.148` | `1.0.152` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.3.0` | Updates `actions/checkout` from 6.0.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6.0.2...9c091bb) Updates `gitleaks/gitleaks-action` from 2.3.9 to 3.0.0 - [Release notes](https://github.com/gitleaks/gitleaks-action/releases) - [Commits](gitleaks/gitleaks-action@ff98106...e0c47f4) Updates `petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml` from 1 to 2 - [Commits](combsmith/.github@v1...v2) Updates `petry-projects/.github/.github/workflows/dependency-audit-reusable.yml` from 1 to 2 - [Commits](combsmith/.github@v1...v2) Updates `anthropics/claude-code-action` from 1.0.148 to 1.0.152 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@d5726de...51705da) Updates `actions/setup-java` from 5.2.0 to 5.3.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@be666c2...ad2b381) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: gitleaks/gitleaks-action dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.152 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-java dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-19T17:06:58Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Dependency update PRs security Security-related PRs and issues labels Jun 19, 2026

dependabot Bot requested a review from a team as a code owner June 19, 2026 16:54

dependabot Bot added security Security-related PRs and issues dependencies Dependency update PRs labels Jun 19, 2026

combsmith-dependabot-automrg Bot approved these changes Jun 19, 2026

View reviewed changes

combsmith-dependabot-automrg Bot enabled auto-merge (squash) June 19, 2026 17:00

dependabot Bot closed this Jun 19, 2026

auto-merge was automatically disabled June 19, 2026 17:07
Pull request was closed

dependabot Bot deleted the dependabot/github_actions/actions-331cc2f5f5 branch June 19, 2026 17:07

This was referenced Jun 22, 2026

petry-projects — workflow failures detected 2026-06-22 #909

Closed

petry-projects — workflow failures detected 2026-06-24 #917

Closed

github-actions Bot mentioned this pull request Jun 2, 2026

petry-projects — workflow failures detected 2026-06-02 #419

Closed

Navigation Menu

Repository navigation

chore(deps): bump the actions group across 1 directory with 6 updates - #807

chore(deps): bump the actions group across 1 directory with 6 updates#807
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-331cc2f5f5

dependabot Bot commented on behalf of github Jun 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.0

What's Changed

New Contributors

v6.0.3

What's Changed

New Contributors

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v3.0.0

What's changed

Migration

Why

Changes

Self-hosted runners

v1.0.152

v1.0.151

What's Changed

New Contributors

v1.0.150

v1.0.149

What's Changed

New Contributors

v5.3.0

What's Changed

New Contributors

Uh oh!

dependabot Bot commented on behalf of github Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 19, 2026 •

edited

Loading