chore(deps): Bump the github-actions group with 11 updates by dependabot[bot] · Pull Request #61631 · nextcloud/server

dependabot · 2026-06-27T16:19:49Z

Bumps the github-actions group with 11 updates:

Package	From	To
actions/checkout	`6.0.2`	`7.0.0`
shivammathur/setup-php	`2.37.1`	`2.37.2`
actions/github-script	`7.0.1`	`9.0.0`
github/codeql-action/init	`4.36.0`	`4.36.2`
github/codeql-action/analyze	`4.36.0`	`4.36.2`
actions/setup-node	`6.2.0`	`6.4.0`
cypress-io/github-action	`7.3.0`	`7.4.0`
LizardByte/actions/actions/setup_python	`2026.524.145234`	`2026.625.20301`
codecov/codecov-action	`6.0.1`	`7.0.0`
actions/download-artifact	`7.0.0`	`8.0.1`
github/codeql-action/upload-sarif	`4.36.0`	`4.36.2`

Updates actions/checkout from 6.0.2 to 7.0.0

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

Updates shivammathur/setup-php from 2.37.1 to 2.37.2

Release notes

Sourced from shivammathur/setup-php's releases.

2.37.2

Changelog

Fixed macOS setup by marking shivammathur/php and shivammathur/extensions as trusted taps.

Switched to Visual Studio 18 (vs18) builds for PHP 8.6 on Windows.

Improved looking up environment variables.

Tightened security in internal GitHub action workflows.

Updated Node.js dependencies.

For the complete list of changes, please refer to the Full Changelog

Commits

f3e473d Bump version to 2.37.2
8be473c Trust brew taps
083d523 Bump the github-actions group with 2 updates (#1085)
a919ff5 Update FUNDING.yml
deb2299 Harden GitHub Actions workflows
5825be4 Harden environment lookup
8d45593 Add CODEOWNERS
ba8d163 Update PHP versions in SECURITY.md
See full diff in compare view

Updates actions/github-script from 7.0.1 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.

Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.

getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.

If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in actions/github-script#695

ci: use deployment: false for integration test environments by @salmanmkc in actions/github-script#712

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in actions/github-script#700

New Contributors

@Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

Update Node.js version support to 24.x by @salmanmkc in actions/github-script#637

README for updating actions/github-script from v7 to v8 by @sneha-krip in actions/github-script#653

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

@salmanmkc made their first contribution in actions/github-script#637

@sneha-krip made their first contribution in actions/github-script#653

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

Upgrade husky to v9 by @benelan in actions/github-script#482

Add workflow file for publishing releases to immutable action package by @Jcambass in actions/github-script#485

Upgrade IA Publish by @Jcambass in actions/github-script#486

Fix workflow status badges by @joshmgross in actions/github-script#497

Update usage of actions/upload-artifact by @joshmgross in actions/github-script#512

Clear up package name confusion by @joshmgross in actions/github-script#514

Update dependencies with npm audit fix by @joshmgross in actions/github-script#515

Specify that the used script is JavaScript by @timotk in actions/github-script#478

chore: Add Dependabot for NPM and Actions by @nschonni in actions/github-script#472

... (truncated)

Commits

3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
ca10bbd fix: use @octokit/core/types import for v7 compatibility
86e48e2 merge: incorporate main branch changes
c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
ff8117e ci: fix user-agent test to handle orchestration ID
81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
3953caf docs: update README examples from @v8 to @v9, add getOctokit docs and v9 brea...
c17d55b ci: add getOctokit integration test job
a047196 test: add getOctokit integration tests via callAsyncFunction
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.36.0 to 4.36.2

Release notes

Sourced from github/codeql-action/init's releases.

v4.36.2

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits

8aad20d Merge pull request #3949 from github/update-v4.36.2-dcb947ce1
f521b08 Add additional changelog notes
8aeff0f Update changelog for v4.36.2
dcb947c Merge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6
c251bce Add changelog note
62953c1 Update default bundle to codeql-bundle-v2.25.6
423b570 Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...
c35d1b1 Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...
cb1a588 Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoff
ba47406 Merge pull request #3943 from github/henrymercer/cache-cli-version-info
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.0 to 4.36.2

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.36.2

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits

8aad20d Merge pull request #3949 from github/update-v4.36.2-dcb947ce1
f521b08 Add additional changelog notes
8aeff0f Update changelog for v4.36.2
dcb947c Merge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6
c251bce Add changelog note
62953c1 Update default bundle to codeql-bundle-v2.25.6
423b570 Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...
c35d1b1 Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...
cb1a588 Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoff
ba47406 Merge pull request #3943 from github/henrymercer/cache-cli-version-info
Additional commits viewable in compare view

Updates actions/setup-node from 6.2.0 to 6.4.0

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in actions/setup-node#1525

Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in actions/setup-node#1533

New Contributors

@Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

Support parsing devEngines field by @susnux in actions/setup-node#1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Fix npm audit issues by @gowridurgad in actions/setup-node#1491

Replace uuid with crypto.randomUUID() by @trivikr in actions/setup-node#1378

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-node#1498

Bug fixes:

Remove hardcoded bearer for mirror-url @marco-ippolito in actions/setup-node#1467

Scope test lockfiles by package manager and update cache tests by @gowridurgad in actions/setup-node#1495

New Contributors

@susnux made their first contribution in actions/setup-node#1283

Full Changelog: actions/setup-node@v6...v6.3.0

Commits

48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
ab72c7e Upgrade @actions dependencies (#1525)
53b8394 Bump minimatch from 3.1.2 to 3.1.5 (#1498)
54045ab Scope test lockfiles by package manager and update cache tests (#1495)
c882bff Replace uuid with crypto.randomUUID() (#1378)
774c1d6 feat(node-version-file): support parsing devEngines field (#1283)
efcb663 fix: remove hardcoded bearer (#1467)
d02c89d Fix npm audit issues (#1491)
See full diff in compare view

Updates cypress-io/github-action from 7.3.0 to 7.4.0

Release notes

Sourced from cypress-io/github-action's releases.

v7.4.0

7.4.0 (2026-06-01)

Features

deps: remove Node.js 25 (#1781) (948d67d)

Changelog

Sourced from cypress-io/github-action's changelog.

Changelog

This document gives an overview of changes to the Cypress GitHub JavaScript Action cypress-io/github-action.

See Releases for full details of changes.

Version Changes

v7.4.0 Examples remove Node.js 25. End of support for Node.js 25.

v7.3.0 Add parameter expose for Cypress.expose() support

v7.2.0 Examples remove Node.js 20. End of support for Node.js 20.

v7.1.0 Add parameter package-manager-cache

v7.0.0 Action runs under Node.js 24 instead of Node.js 20

v6.10.0 Examples remove Node.js 23. End of support for Node.js 23.

v6.9.0 Add parameter validation for command

v6.8.0 Examples remove Node.js 18. End of support for Node.js 18.

v6.7.10 Examples updated to Cypress 14

v6.7.9 Migrate to @actions/cache@4.0.0 for continued access to GitHub Actions caching services

v6.7.0 Examples remove Node.js 21. End of support for Node.js 21.

v6.6.0 Add parameter summary-title

v6.5.0 Examples remove Node.js 16. End of support for Node.js 16.

v6.4.0 Action adds PR number and URL if available when recording

v6.3.0 v6 is recommended action version

v6.2.0 Examples updated to Cypress 13

v6.1.0 Examples for Cypress 9 archived in action's v5 branch

v6.0.0 Action runs under Node.js 20 instead of Node.js 16

v5.8.1 Examples remove Node.js 19. End of support for Node.js 19

v5.8.0 Add GitHub step output resultsUrl. Deprecate dashboardUrl.

v5.7.0 Add basic Yarn Modern Plug'n'Play support

v5.6.2 Examples add Node.js 20. End of support and removal of Node.js 14 examples.

v5.6.0 Add check for lockfile presence

v5.5.0 Examples add Yarn Modern

v5.4.0 Examples add Yarn Classic

v5.3.0 Add parameter publish-summary (default true)

v5.2.0 Examples add Node.js 19

v5.1.0 Add parameter auto-cancel-after-failures

v5.0.0 Examples add Node.js 18 and remove Node.js 12

v4.2.2 Dependency on GitHub set-output workflow command removed

v4.2.0 Support for pnpm added

v4.0.0 Support for Cypress 10 and later versions added

v3 Action runs under Node.js 16 instead of Node.js 12

v2 Cypress runs using the Module API

v1 This version is no longer runnable in GitHub due to security changes.

Commits

948d67d feat(deps): remove Node.js 25 (#1781)
2b7e08a chore(deps): update dependency node to v24.16.0 (#1777)
69a0c7c test: complete cypress@15.16.0 update (#1778)
e487d96 chore(deps): update node.js to v24.16.0 (#1770)
5cfba34 chore(deps): update dependency webpack to ^5.107.0 (#1771)
65ccb9f chore: add minimum release age and vulnerability alerts to renovate config (#...
5130fef chore(deps): update dependency cypress to v15.16.0 (#1773)
e910707 test: exclude Cypress from Yarn Modern npmMinimalAgeGate (#1774)
984bd80 chore(deps): update yarn to v4.15.0 (#1768)
1c3bb66 chore(deps): update dependency vite to ^8.0.14 (#1769)
Additional commits viewable in compare view

Updates LizardByte/actions/actions/setup_python from 2026.524.145234 to 2026.625.20301

Release notes

Sourced from LizardByte/actions/actions/setup_python's releases.

v2026.625.20301

What's Changed

chore(deps): update codecov/codecov-action action to v7 by @renovate[bot] in #223

feat(setup_python): make pyenv update optional by @JamesParrott in #226

chore(deps): lock file maintenance by @renovate[bot] in #225

chore(deps): update devdependencies (non-major) by @renovate[bot] in #227

chore(deps): lock file maintenance by @renovate[bot] in #228

chore(deps): update babel monorepo to v8 by @renovate[bot] in #229

chore(deps): update devdependencies (non-major) to v8.0.1 by @renovate[bot] in #230

chore(deps): update official github actions to v7 by @renovate[bot] in #232

chore(deps): update devdependencies (non-major) to v8.0.2 by @renovate[bot] in #231

chore(deps): lock file maintenance by @renovate[bot] in #233

chore(deps): update devdependencies (non-major) by @renovate[bot] in #234

refactor(sonar): fix javascript:S2699 and javascript:S5914 by @ReenigneArcher in #235

chore(deps): update official github actions by @renovate[bot] in #236

fix(release_setup): support generating notes for first release by @ReenigneArcher in #237

fix(release_homebrew): reduce test duplication by @ReenigneArcher in #238

New Contributors

@JamesParrott made their first contribution in #226

Full Changelog: LizardByte/actions@v2026.605.34721...v2026.625.20301

Contributors

v2026.605.34721

What's Changed

chore(deps): update devdependencies (non-major) to v7.29.7 by @renovate[bot] in #210

chore(deps): update dependency eslint to v10.4.1 by @renovate[bot] in #211

fix(release_homebrew): Setup Homebrew action & refactor formula by @ReenigneArcher in #212

fix(release_homebrew): auto trust tap by @ReenigneArcher in #213

chore: add dependency lock files by @ReenigneArcher in #214

style(screenshot): fix sonar warning by @ReenigneArcher in #215

test(release_homebrew): Add session cleanup for homebrew fork repo by @ReenigneArcher in

Bumps the github-actions group with 11 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [shivammathur/setup-php](https://github.com/shivammathur/setup-php) | `2.37.1` | `2.37.2` | | [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `9.0.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.4.0` | | [cypress-io/github-action](https://github.com/cypress-io/github-action) | `7.3.0` | `7.4.0` | | [LizardByte/actions/actions/setup_python](https://github.com/lizardbyte/actions) | `2026.524.145234` | `2026.625.20301` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.1` | `7.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` | Updates `actions/checkout` from 6.0.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...9c091bb) Updates `shivammathur/setup-php` from 2.37.1 to 2.37.2 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@7c071df...f3e473d) Updates `actions/github-script` from 7.0.1 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v7.0.1...3a2844b) Updates `github/codeql-action/init` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) Updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) Updates `actions/setup-node` from 6.2.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6.2.0...48b55a0) Updates `cypress-io/github-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/cypress-io/github-action/releases) - [Changelog](https://github.com/cypress-io/github-action/blob/master/CHANGELOG.md) - [Commits](cypress-io/github-action@dace029...948d67d) Updates `LizardByte/actions/actions/setup_python` from 2026.524.145234 to 2026.625.20301 - [Release notes](https://github.com/lizardbyte/actions/releases) - [Commits](LizardByte/actions@25babf9...a468509) Updates `codecov/codecov-action` from 6.0.1 to 7.0.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e79a696...fb8b358) Updates `actions/download-artifact` from 7.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@37930b1...3e5f45b) Updates `github/codeql-action/upload-sarif` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: shivammathur/setup-php dependency-version: 2.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: cypress-io/github-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: LizardByte/actions/actions/setup_python dependency-version: 2026.625.20301 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added 3. to review Waiting for reviews feature: dependencies labels Jun 27, 2026

dependabot Bot requested a review from a team as a code owner June 27, 2026 16:19

dependabot Bot added 3. to review Waiting for reviews feature: dependencies labels Jun 27, 2026

dependabot Bot requested review from Altahrim, come-nc, provokateurin and salmart-dev and removed request for a team June 27, 2026 16:19

github-actions Bot approved these changes Jun 27, 2026

View reviewed changes

susnux approved these changes Jun 27, 2026

View reviewed changes

AndyScherzinger approved these changes Jun 27, 2026

View reviewed changes

AndyScherzinger merged commit 36aac95 into master Jun 27, 2026
295 of 306 checks passed

AndyScherzinger deleted the dependabot/github_actions/github-actions-33b4247e66 branch June 27, 2026 17:13

AndyScherzinger added this to the Nextcloud 35 milestone Jun 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): Bump the github-actions group with 11 updates#61631

chore(deps): Bump the github-actions group with 11 updates#61631
AndyScherzinger merged 1 commit into
masterfrom
dependabot/github_actions/github-actions-33b4247e66

dependabot Bot commented on behalf of github Jun 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Version	Changes
v7.4.0	Examples remove Node.js 25. End of support for Node.js 25.
v7.3.0	Add parameter `expose` for `Cypress.expose()` support
v7.2.0	Examples remove Node.js 20. End of support for Node.js 20.
v7.1.0	Add parameter `package-manager-cache`
v7.0.0	Action runs under Node.js 24 instead of Node.js 20
v6.10.0	Examples remove Node.js 23. End of support for Node.js 23.
v6.9.0	Add parameter validation for `command`
v6.8.0	Examples remove Node.js 18. End of support for Node.js 18.
v6.7.10	Examples updated to Cypress 14
v6.7.9	Migrate to `@actions/cache@4.0.0` for continued access to GitHub Actions caching services
v6.7.0	Examples remove Node.js 21. End of support for Node.js 21.
v6.6.0	Add parameter `summary-title`
v6.5.0	Examples remove Node.js 16. End of support for Node.js 16.
v6.4.0	Action adds PR number and URL if available when recording
v6.3.0	v6 is recommended action version
v6.2.0	Examples updated to Cypress 13
v6.1.0	Examples for Cypress 9 archived in action's v5 branch
v6.0.0	Action runs under Node.js 20 instead of Node.js 16
v5.8.1	Examples remove Node.js 19. End of support for Node.js 19
v5.8.0	Add GitHub step output `resultsUrl`. Deprecate `dashboardUrl`.
v5.7.0	Add basic Yarn Modern Plug'n'Play support
v5.6.2	Examples add Node.js 20. End of support and removal of Node.js 14 examples.
v5.6.0	Add check for lockfile presence
v5.5.0	Examples add Yarn Modern
v5.4.0	Examples add Yarn Classic
v5.3.0	Add parameter `publish-summary` (default `true`)
v5.2.0	Examples add Node.js 19
v5.1.0	Add parameter `auto-cancel-after-failures`
v5.0.0	Examples add Node.js 18 and remove Node.js 12
v4.2.2	Dependency on GitHub `set-output` workflow command removed
v4.2.0	Support for `pnpm` added
v4.0.0	Support for Cypress 10 and later versions added
v3	Action runs under Node.js 16 instead of Node.js 12
v2	Cypress runs using the Module API
v1	This version is no longer runnable in GitHub due to security changes.

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 27, 2026

v7.0.0

What's Changed

New Contributors

v6.0.3

What's Changed

New Contributors

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

2.37.2

Changelog

v9.0.0

What's Changed

New Contributors

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

New Contributors

v7.1.0

What's Changed

v4.36.2

v4.36.1

CodeQL Action Changelog

[UNRELEASED]

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

v4.36.2

v4.36.1

CodeQL Action Changelog

[UNRELEASED]

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

v6.4.0

What's Changed

Dependency updates:

New Contributors

v6.3.0

What's Changed

Enhancements:

Dependency updates:

Bug fixes:

New Contributors

v7.4.0

7.4.0 (2026-06-01)

Features

Changelog

v2026.625.20301

What's Changed

New Contributors

Contributors

v2026.605.34721

What's Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels