Skip to content

Bump the all-actions group across 1 directory with 7 updates#1859

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-75f1734634
Open

Bump the all-actions group across 1 directory with 7 updates#1859
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-75f1734634

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the all-actions group with 7 updates in the / directory:

Package From To
actions/checkout 3 6
EmbarkStudios/cargo-deny-action 2.0.15 2.0.20
stellar/binaries 45 72
actions/upload-artifact 4 7
actions/download-artifact 5 8
denoland/setup-deno 2.0.2 2.0.4
stellar/stellar-cli 23.1.4 26.1.0

Updates actions/checkout from 3 to 6

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

... (truncated)

Commits
  • df4cb1c Update changelog for v6.0.3 (#2446)
  • 1cce339 Fix checkout init for SHA-256 repositories (#2439)
  • 900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
  • 0c366fd Update changelog (#2357)
  • de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
  • 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
  • 8e8c483 Clarify v6 README (#2328)
  • 033fa0d Add worktree support for persist-credentials includeIf (#2327)
  • c2d88d3 Update all references from v5 and v4 to v6 (#2314)
  • 1af3b93 update readme/changelog for v6 (#2311)
  • Additional commits viewable in compare view

Updates EmbarkStudios/cargo-deny-action from 2.0.15 to 2.0.20

Commits

Updates stellar/binaries from 45 to 72

Release notes

Sourced from stellar/binaries's releases.

v72

What's Changed

Full Changelog: stellar/binaries@v71...v72

v71

What's Changed

Full Changelog: stellar/binaries@v70...v71

v70

What's Changed

Full Changelog: stellar/binaries@v68...v70

v68

What's Changed

Full Changelog: stellar/binaries@v67...v68

v67

What's Changed

Full Changelog: stellar/binaries@v66...v67

v66

What's Changed

Full Changelog: stellar/binaries@v65...v66

v65

What's Changed

Full Changelog: stellar/binaries@v64...v65

... (truncated)

Commits
  • 4394e62 Update dependency sccache to v0.15.0 (#77)
  • 9bf79e9 Update dependency wasm-pack to v0.14.0 (#78)
  • ab67688 Update dependency cargo-deny to v0.19.4 (#80)
  • c0d154b Update dependency cargo-expand to v1.0.121 (#81)
  • bd0afe7 pin crate tools to exact version via semver versioning (#79)
  • 241471a add retry logic to binary download (#75)
  • e7270af Disable separateMinorPatch to upgrade to latest version (#72)
  • af6f069 Update dependency cargo-sweep to 0.8.0 (#70)
  • 74e9bd2 disable renovate dependency dashboard (#69)
  • 6179cb4 disable renovate vulnerability alerts (#68)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/download-artifact from 5 to 8

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates denoland/setup-deno from 2.0.2 to 2.0.4

Release notes

Sourced from denoland/setup-deno's releases.

v2.0.4

Full Changelog: denoland/setup-deno@v2.0.3...v2.0.4

v2.0.3

Full Changelog: denoland/setup-deno@v2.0.2...v2.0.3

Commits
  • 667a34c 2.0.3
  • 3f17b4e feat: upgrade Node.js runtime from node20 to node24 (#123)
  • 06fd750 docs: fix identifier for latest stable release (#115)
  • 587bed9 docs: condense Deno version information in one section (#100)
  • 2af9d57 docs: add lts as possible release-channel output (#99)
  • 0c3e771 Update actions/checkout (#106)
  • e95548e 2.0.3 (#102)
  • 8273ddd fix: switch back to package.json as it's necessary for GH actions (#101)
  • 609c005 feat: include a hash of deno.lock files in the cache key automatically (#98)
  • aa0fea1 feat: add built-in caching via inputs (#89)
  • Additional commits viewable in compare view

Updates stellar/stellar-cli from 23.1.4 to 26.1.0

Release notes

Sourced from stellar/stellar-cli's releases.

26.1.0

Ledger hardware wallets, end-to-end

  • Derive and display addresses with stellar keys address --ledger (#2557).
  • Fund accounts directly from Ledger-derived public keys with stellar keys fund --ledger (#2558).
  • Register Ledger identities with stellar keys add --ledger (#2563).
  • Pick the derivation path consistently with --hd-path across all of the above (#2539, #2540).
  • Sign contract authorization entries from Ledger identities, enabling multi-auth contract invocations entirely from a hardware wallet — no secret material ever leaves the device (#2569).

Smaller wasm by default

  • stellar contract build now optimizes wasm output by default (#2581).
  • The --optimize flag is no longer required — what comes out of build is production-ready bytecode you can deploy as-is.

New: stellar contract info hash

  • Returns the wasm hash for a deployed contract (#2576).
  • Useful for scripting verification flows, comparing deployments across networks, or confirming that two contracts run the exact same bytecode.

Organized, discoverable help output

  • --help output now groups flags into logical sections instead of dumping them in a single flat list (#2567).
  • Finding the right network, signing, output, or identity flag is much faster — especially for high-surface commands like contract invoke.

Security hardening across the board

This release closes a number of paths where secrets, credentials, or untrusted input could surface in places they shouldn't:

  • Secret values are no longer echoed in error messages, help output, signing previews, or RPC headers.
  • Passwords embedded in RPC URLs are redacted in cached config, network display output, and the remaining places URLs were printed.
  • Config, cache, and identity files are now created with 0600 permissions, and permissions are correctly reset when overwriting via --config-dir.
  • STELLAR_SECRET_KEY is validated before being persisted and is rejected entirely when --secure-store is in use, preventing accidental disk writes of secret material.
  • Keyring entries are cleaned up properly when overwriting a key, eliminating stale credential leftovers.
  • stellar tx edit is hardened against temp-file swap attacks, and stellar contract build --print-commands-only now shell-escapes its output so it can be safely piped into a shell.
  • Authorization entries are validated before signing, and the transaction source is no longer silently mixed into auth signing logic.
  • Several dependency advisories were addressed (rustls-webpki, astral-tokio-tar, and others).

Quality-of-life and bug fixes

  • Identity aliases now resolve inside nested invoke arguments (#2552).
  • The CLI hints when a contract ID looks like a wasm hash (#2550).
  • Secure-store public keys are cached in identity files, so you don't re-hit the keyring on every read (#2533).
  • --hd-path is now persisted on plain seed-phrase keys (#2540).
  • --docker-host is honored for TCP/HTTP Docker connections (#2503).
  • Control characters in signed messages are escaped in previews.
  • Fixed a panic when the global config directory didn't exist.
  • Fixed an early-EOF bug in SkipWhitespace on whitespace-only chunks.

New Contributors

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 3, 2026
@dependabot dependabot Bot requested review from Copilot and removed request for Copilot May 3, 2026 02:11
@dependabot dependabot Bot changed the title Bump the all-actions group with 7 updates Bump the all-actions group across 1 directory with 7 updates May 10, 2026
Copilot AI review requested due to automatic review settings May 10, 2026 02:13
@dependabot dependabot Bot force-pushed the dependabot/github_actions/all-actions-75f1734634 branch from dae7dce to 634a702 Compare May 10, 2026 02:13
@dependabot dependabot Bot review requested due to automatic review settings May 10, 2026 02:13
@dependabot dependabot Bot force-pushed the dependabot/github_actions/all-actions-75f1734634 branch from 634a702 to 1215da2 Compare May 17, 2026 02:14
Copilot AI review requested due to automatic review settings May 31, 2026 02:14
@dependabot dependabot Bot force-pushed the dependabot/github_actions/all-actions-75f1734634 branch from 1215da2 to 7ff8a04 Compare May 31, 2026 02:14
Copilot AI reviewed May 31, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@leighmcculloch

leighmcculloch commented Jun 3, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot dependabot Bot force-pushed the dependabot/github_actions/all-actions-75f1734634 branch from 7ff8a04 to ad2714e Compare June 3, 2026 06:07
@dependabot
Bump the all-actions group across 1 directory with 7 updates
67a4df3 
Bumps the all-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `3` | `6` |
| [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) | `2.0.15` | `2.0.20` |
| [stellar/binaries](https://github.com/stellar/binaries) | `45` | `72` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `5` | `8` |
| [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.2` | `2.0.4` |
| [stellar/stellar-cli](https://github.com/stellar/stellar-cli) | `23.1.4` | `26.1.0` |



Updates `actions/checkout` from 3 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v6)

Updates `EmbarkStudios/cargo-deny-action` from 2.0.15 to 2.0.20
- [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases)
- [Commits](EmbarkStudios/cargo-deny-action@3fd3802...bb137d7)

Updates `stellar/binaries` from 45 to 72
- [Release notes](https://github.com/stellar/binaries/releases)
- [Commits](stellar/binaries@v45...v72)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `actions/download-artifact` from 5 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v5...v8)

Updates `denoland/setup-deno` from 2.0.2 to 2.0.4
- [Release notes](https://github.com/denoland/setup-deno/releases)
- [Commits](denoland/setup-deno@909cc5a...667a34c)

Updates `stellar/stellar-cli` from 23.1.4 to 26.1.0
- [Release notes](https://github.com/stellar/stellar-cli/releases)
- [Commits](stellar/stellar-cli@v23.1.4...v26.1.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: denoland/setup-deno
  dependency-version: 2.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: EmbarkStudios/cargo-deny-action
  dependency-version: 2.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: stellar/binaries
  dependency-version: '55'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: stellar/stellar-cli
  dependency-version: 26.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/all-actions-75f1734634 branch from ad2714e to 67a4df3 Compare June 7, 2026 02:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@leighmcculloch