Skip to content

Bump the actions group across 2 directories with 9 updates - #1061

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/actions-171c0ed593
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/actions-171c0ed593

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 8 updates in the / directory:

Package From To
anthropics/claude-code-action 1.0.237 1.0.264
pnpm/action-setup 6.0.9 6.1.0
actions/setup-node 7.0.0 7.1.0
foundry-rs/foundry-toolchain 1.9.1 1.9.2
actions/create-github-app-token 3.2.0 3.3.0
changesets/action 1.9.0 2.1.2
0xsequence/actions/git-commit 0.0.4 0.10.0
zizmorcore/zizmor-action 0.7.1 0.8.0

Bumps the actions group with 3 updates in the /.github/actions/install-dependencies directory: pnpm/action-setup, actions/setup-node and actions/cache.

Updates anthropics/claude-code-action from 1.0.237 to 1.0.264

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.264

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.263...v1.0.264

v1.0.263

Full Changelog: anthropics/claude-code-action@v1.0.262...v1.0.263

v1.0.262

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1.0.261...v1.0.262

v1.0.261

Full Changelog: anthropics/claude-code-action@v1.0.260...v1.0.261

v1.0.260

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.259...v1.0.260

v1.0.259

Full Changelog: anthropics/claude-code-action@v1.0.258...v1.0.259

v1.0.258

Full Changelog: anthropics/claude-code-action@v1.0.257...v1.0.258

v1.0.257

Full Changelog: anthropics/claude-code-action@v1.0.256...v1.0.257

v1.0.256

Full Changelog: anthropics/claude-code-action@v1.0.255...v1.0.256

v1.0.255

Full Changelog: anthropics/claude-code-action@v1.0.254...v1.0.255

v1.0.254

Full Changelog: anthropics/claude-code-action@v1.0.253...v1.0.254

v1.0.253

Full Changelog: anthropics/claude-code-action@v1.0.252...v1.0.253

... (truncated)

Commits
  • d70510b chore: bump Claude Code to 2.1.312 and Agent SDK to 0.3.312
  • 98a9e39 docs: use claude-plugins-official in plugin examples (#1932)
  • 8041f1d chore: bump Claude Code to 2.1.311 and Agent SDK to 0.3.311
  • 925afb5 chore: bump Bun to 1.4.4 (#1916)
  • 16f9f71 chore: bump Claude Code to 2.1.310 and Agent SDK to 0.3.310
  • 8d70a0d Pin the PR version a run checks out (#1915)
  • ae68417 chore: bump Claude Code to 2.1.309 and Agent SDK to 0.3.309
  • 6b6870e chore: bump Claude Code to 2.1.308 and Agent SDK to 0.3.308
  • aa8a773 chore: bump Claude Code to 2.1.307 and Agent SDK to 0.3.307
  • a5a423f chore: bump Claude Code to 2.1.306 and Agent SDK to 0.3.306
  • Additional commits viewable in compare view

Updates pnpm/action-setup from 6.0.9 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

v6.0.10

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v6...v6.0.10

Commits

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates foundry-rs/foundry-toolchain from 1.9.1 to 1.9.2

Release notes

Sourced from foundry-rs/foundry-toolchain's releases.

v1.9.2

Security

Update the development and CI Node.js version to 24.22.1 (#193), incorporating fixes for Brotli decoder remote code execution (CVE-2026-111497), TLS hostname verification bypasses, and other vulnerabilities disclosed on October 21, 2026.

These fixes are documented in the Node.js security advisory https://nodejs.org/en/blog/vulnerability/october-2026-security-releases.

What's Changed

Full Changelog: foundry-rs/foundry-toolchain@v1.9.1...v1.9.2

Commits
  • dba66c2 fix: upgrade Node.js to patch CVE-2026-111497 (#193)
  • 2226fa3 chore(deps): bump prettier from 3.9.9 to 3.9.10 in the npm-weekly group (#192)
  • be69c4d chore(deps): bump the ci-weekly group with 4 updates (#191)
  • 3545907 chore(deps): bump @​types/node from 26.6.4 to 26.6.5 in the npm-weekly group (...
  • 2e54994 fix(ci): buffer the action update cooldown (#189)
  • 9100cd3 chore(deps): bump @​types/node from 26.6.3 to 26.6.4 in the npm-weekly group (...
  • 25c634d chore(deps): bump the ci-weekly group with 2 updates (#186)
  • 7840435 chore(deps): bump the npm-weekly group with 2 updates (#187)
  • efe890f chore: bump gh-actions to d5402286 (#185)
  • e8d3beb chore(deps): bump the npm-weekly group with 2 updates (#184)
  • Additional commits viewable in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)
Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view

Updates changesets/action from 1.9.0 to 2.1.2

Release notes

Sourced from changesets/action's releases.

v2.1.2

Patch Changes

v2.1.1

Patch Changes

v2.1.0

Minor Changes

  • #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

v2.0.0

Major Changes

  • #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

    Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

    Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

  • #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

    If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

  • #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

  • #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

    Inputs:

    • version -> version-script
    • publish -> publish-script
    • commit -> commit-message
    • title -> pr-title
    • branch -> pr-base-branch

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@​changesets/action

2.1.2

Patch Changes

2.1.1

Patch Changes

2.1.0

Minor Changes

  • #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

2.0.0

Major Changes

  • #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

    Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

    Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

  • #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

    If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

  • #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

  • #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

    Inputs:

... (truncated)

Commits

Updates 0xsequence/actions/git-commit from 0.0.4 to 0.10.0

Release notes

Sourced from 0xsequence/actions/git-commit's releases.

v0.10.0

No release notes provided.

v0.0.9

What's Changed

Full Changelog: 0xsequence/actions@v0.0.8...v0.0.9

v0.0.8

What's Changed

New Contributors

Full Changelog: 0xsequence/actions@v0.0.7...v0.0.8

v0.0.7

What's Changed

New Contributors

Full Changelog: 0xsequence/actions@v0.0.6...v0.0.7

v0.0.6

What's Changed

Full Changelog: 0xsequence/actions@v0.0.5...v0.0.6

v0.0.5

What's Changed

Full Changelog: 0xsequence/actions@v0.0.4...v0.0.5

Commits
  • 930ae70 fix(git-commit, git-copy): build API payloads with jq to escape JSON properly...
  • daee7a0 fix: correct variable interpolation in GitHub API URLs (#198)
  • 1e65d59 feat: Allow signing git commits; fix: Delete exact path instead of parent whe...
  • 4c2e8b0 chore: update company name references (#195)
  • 7f34a29 feat: gpg signature (#196)
  • 1b7fe10 Add safe.directory configuration for cloned repository
  • eccda6e git-copy: Print the destination git repository URL
  • 786807e Update README, add examples (#194)
  • 36abc59 Fix git clone when pr_base is provided (#193)
  • 5b4e0da Revert #187 in git-copy
  • Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.7.1 to 0.8.0

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.8.0

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version of zizmor or version: prerelease to get whatever latest prerelease the action knows about.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

Commits

Updates pnpm/action-setup from 6.0.9 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

v6.0.10

What's Changed

New Contributors

Bumps the actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.237` | `1.0.264` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.9` | `6.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |
| [foundry-rs/foundry-toolchain](https://github.com/foundry-rs/foundry-toolchain) | `1.9.1` | `1.9.2` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` |
| [changesets/action](https://github.com/changesets/action) | `1.9.0` | `2.1.2` |
| [0xsequence/actions/git-commit](https://github.com/0xsequence/actions) | `0.0.4` | `0.10.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.7.1` | `0.8.0` |

Bumps the actions group with 3 updates in the /.github/actions/install-dependencies directory: [pnpm/action-setup](https://github.com/pnpm/action-setup), [actions/setup-node](https://github.com/actions/setup-node) and [actions/cache](https://github.com/actions/cache).


Updates `anthropics/claude-code-action` from 1.0.237 to 1.0.264
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@fd1c128...d70510b)

Updates `pnpm/action-setup` from 6.0.9 to 6.1.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@0ebf471...ea17c68)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `foundry-rs/foundry-toolchain` from 1.9.1 to 1.9.2
- [Release notes](https://github.com/foundry-rs/foundry-toolchain/releases)
- [Changelog](https://github.com/foundry-rs/foundry-toolchain/blob/master/RELEASE.md)
- [Commits](foundry-rs/foundry-toolchain@v1.9.1...dba66c2)

Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

Updates `changesets/action` from 1.9.0 to 2.1.2
- [Release notes](https://github.com/changesets/action/releases)
- [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md)
- [Commits](changesets/action@a45c4d5...ae32849)

Updates `0xsequence/actions/git-commit` from 0.0.4 to 0.10.0
- [Release notes](https://github.com/0xsequence/actions/releases)
- [Commits](0xsequence/actions@d6560e8...930ae70)

Updates `zizmorcore/zizmor-action` from 0.7.1 to 0.8.0
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@85b2b9f...53290ba)

Updates `pnpm/action-setup` from 6.0.9 to 6.1.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@0ebf471...ea17c68)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `actions/cache` from 5.1.0 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@caa2961...55cc834)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.264
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: foundry-rs/foundry-toolchain
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: changesets/action
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: 0xsequence/actions/git-commit
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team November 3, 2026 13:45
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 3, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner November 3, 2026 13:45
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-03T13:48:05.675568Z 693f21f PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 693f21f5dc

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

permission-pull-requests: write
- name: Create release PR or stage versioned packages
uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Complete the Changesets v2 migration

On every master release run, this action fails before creating a release PR or publishing: the repository still installs @changesets/cli ^2.29.8, while v2 supports Changesets v3 only, and its startup validation explicitly rejects the retained v1 inputs (title, commit, publish, createGithubReleases, and commitMode). It also requires the app token through github-token rather than GITHUB_TOKEN; see the v2 compatibility notice and input validation. Keep the action on v1 or migrate the CLI dependency and the entire with/token configuration together.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants