Skip to content

Bump the github-actions group across 1 directory with 5 updates - #2293

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1b74529bf3
Open

Bump the github-actions group across 1 directory with 5 updates#2293
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1b74529bf3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 5 updates in the / directory:

Package From To
actions/github-script 7.1.0 9.0.0
actions/download-artifact 4.3.0 8.0.2
actions/checkout 4.4.0 7.0.1
actions/setup-dotnet 4.3.1 6.0.0
microsoft/setup-msbuild 2.0.0 3.0.0

Updates actions/github-script from 7.1.0 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

... (truncated)

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • Additional commits viewable in compare view

Updates actions/checkout from 4.4.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-dotnet from 4.3.1 to 6.0.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-dotnet@v5...v6.0.0

v5.4.0

What's Changed

Enhancements

The action now validates the sdk.version field in global.json when rollForward is specified. The version must be a fully-qualified SDK version (e.g., 8.0.100, 10.0.100). Wildcard versions (e.g., 10.0.*) and runtime-style versions (e.g., 8.0.0) will now fail. See the .NET SDK version specification for details.

Documentation

Bug Fixes

Dependency Updates

New Contributors

Full Changelog: actions/setup-dotnet@v5.3.0...v5.4.0

v5.3.0

What's Changed

Enhancements

Dependency Updates

... (truncated)

Commits
  • a98b568 chore(deps): bump @​actions/cache to 6.2.0 (#756)
  • afb2931 Bump actions/checkout from 6.0.3 to 7.0.0 (#751)
  • 6df8cef Migrate to ESM and upgrade dependencies (#752)
  • 26b0ec1 Expand the CSC problem matcher to light up more errors on GitHub. (#717)
  • da5e548 docs(action): explicitly mark all optional inputs with required: false (#737)
  • 9bd3b44 Improve readability of global.json creation command (#694)
  • 4406a63 Bump @​actions/cache to 5.1.0, log cache write denied (#746)
  • dc3262d pin actions to commit SHAs in workflows (#744)
  • 95a3f8b Validate global.json SDK version before rollForward optimization (#742)
  • 9a946fd Add rollForward note in README, improve proxy health check in e2e tests and b...
  • Additional commits viewable in compare view

Updates microsoft/setup-msbuild from 2.0.0 to 3.0.0

Release notes

Sourced from microsoft/setup-msbuild's releases.

v3 Update to move to Node24

What's Changed

New Contributors

Full Changelog: microsoft/setup-msbuild@v2...v3

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 25, 2026
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Aug 25, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 25, 2026
@github-actions

github-actions Bot commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown

📋 API Surface Diff

✅ No API differences vs the baseline.

Full validation run

This comment is automatically updated on each push.

@dependabot dependabot Bot changed the title Bump the github-actions group with 5 updates Bump the github-actions group across 1 directory with 5 updates Sep 4, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-1b74529bf3 branch from 141dbcc to 46eebe9 Compare September 4, 2026 01:16
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-1b74529bf3 branch from 46eebe9 to 3c3893d Compare September 15, 2026 22:29
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-1b74529bf3 branch from 3c3893d to 15045b2 Compare October 9, 2026 01:15
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-1b74529bf3 branch 2 times, most recently from 351922a to 60eef2d Compare October 23, 2026 01:15
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-1b74529bf3 branch from 60eef2d to 2f87812 Compare October 30, 2026 01:16
@dependabot
Bump the github-actions group across 1 directory with 5 updates
b49a01b 
Bumps the github-actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/github-script](https://github.com/actions/github-script) | `7.1.0` | `9.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.2` |
| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4.3.1` | `6.0.0` |
| [microsoft/setup-msbuild](https://github.com/microsoft/setup-msbuild) | `2.0.0` | `3.0.0` |



Updates `actions/github-script` from 7.1.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@f28e40c...3a2844b)

Updates `actions/download-artifact` from 4.3.0 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...9000827)

Updates `actions/checkout` from 4.4.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11d5960...3d3c42e)

Updates `actions/setup-dotnet` from 4.3.1 to 6.0.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@67a3573...a98b568)

Updates `microsoft/setup-msbuild` from 2.0.0 to 3.0.0
- [Release notes](https://github.com/microsoft/setup-msbuild/releases)
- [Commits](microsoft/setup-msbuild@6fb0222...30375c6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-dotnet
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: microsoft/setup-msbuild
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-1b74529bf3 branch from 2f87812 to b49a01b Compare November 6, 2026 01:16

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jevansaks Jevan Saks (jevansaks) Awaiting requested review from jevansaks jevansaks is a code owner
@vineeththomasalex Vineeth Thomas Alex (vineeththomasalex) Awaiting requested review from vineeththomasalex vineeththomasalex is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants