Skip to content

build(deps): bump the ci-dependencies group across 1 directory with 10 updates #1064

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump the ci-dependencies group across 1 directory with 10 updates #1064

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 10, 2025 •
edited
Loading

Bumps the ci-dependencies group with 10 updates in the / directory:

Package From To
actions/checkout 4 5
actions/setup-python 5 6
actions/github-script 7.0.1 8.0.0
docker/setup-qemu-action 3.6.0 3.7.0
astral-sh/setup-uv 6.1.0 7.1.3
pypa/cibuildwheel 3.0.0 3.2.1
actions/upload-artifact 4.6.2 5.0.0
actions/download-artifact 4.3.0 6.0.0
CodSpeedHQ/action 3.5.0 4.3.4
pypa/gh-action-pypi-publish 1.12.4 1.13.0

Updates actions/checkout from 4 to 5

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

What's Changed

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.2.0...v4.2.1

... (truncated)

Commits

Updates actions/setup-python from 5 to 6

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

What's Changed

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

What's Changed

Enhancements:

Bug fixes:

... (truncated)

Commits
  • e797f83 Upgrade to node 24 (#1164)
  • 3d1e2d2 Revert "Enhance cache-dependency-path handling to support files outside the w...
  • 65b0712 Clarify pythonLocation behavior for PyPy and GraalPy in environment variables...
  • 5b668cf Bump actions/checkout from 4 to 5 (#1181)
  • f62a0e2 Change missing cache directory error to warning (#1182)
  • 9322b3c Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIn...
  • fbeb884 Bump form-data to fix critical vulnerabilities #182 & #183 (#1163)
  • 03bb615 Bump idna from 2.9 to 3.7 in /tests/data (#843)
  • 36da51d Add version parsing from Pipfile (#1067)
  • 3c6f142 update documentation (#1156)
  • Additional commits viewable in compare view

Updates actions/github-script from 7.0.1 to 8.0.0

Release notes

Sourced from actions/github-script's releases.

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

New Contributors

Full Changelog: actions/github-script@v7...v7.1.0

Commits
  • ed59741 Merge pull request #653 from actions/sneha-krip/readme-for-v8
  • 2dc352e Bold minimum Actions Runner version in README
  • 01e118c Update README for Node 24 runtime requirements
  • 8b222ac Apply suggestion from @​salmanmkc
  • adc0eea README for updating actions/github-script from v7 to v8
  • 20fe497 Merge pull request #637 from actions/node24
  • e7b7f22 update licenses
  • 2c81ba0 Update Node.js version support to 24.x
  • f28e40c Merge pull request #610 from actions/nebuk89-patch-1
  • 1ae9958 Update README.md
  • Additional commits viewable in compare view

Updates docker/setup-qemu-action from 3.6.0 to 3.7.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v3.7.0

Full Changelog: docker/setup-qemu-action@v3.6.0...v3.7.0

Commits
  • c7c5346 Merge pull request #230 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 3a517a1 chore: update generated content
  • a5b45ed build(deps): bump @​docker/actions-toolkit from 0.62.1 to 0.67.0
  • 3a64278 Merge pull request #220 from docker/dependabot/npm_and_yarn/brace-expansion-1...
  • 94906ba chore: update generated content
  • 4027abf build(deps): bump brace-expansion from 1.1.11 to 1.1.12
  • bee0aaa Merge pull request #221 from docker/dependabot/npm_and_yarn/tmp-0.2.4
  • 0d7e257 chore: update generated content
  • b869601 build(deps): bump tmp from 0.2.3 to 0.2.4
  • 3a043ed Merge pull request #219 from docker/dependabot/npm_and_yarn/undici-5.29.0
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 6.1.0 to 7.1.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.1.3 🌈 Support act

Changes

This bug fix release adds support for https://github.com/nektos/act It was previously broken because of a too new undici version and TS transpilation target.

Compatibility with act is now automatically tested.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v7.1.2 🌈 Speed up extraction on Windows

Changes

@​lazka fixed a bug that caused extracting uv to take up to 30s. Thank you!

🐛 Bug fixes

  • Use tar for extracting the uv zip file on Windows too @​lazka (#660)

🧰 Maintenance

⬆️ Dependency updates

v7.1.1 🌈 Fix empty workdir detection and lowest resolution strategy

Changes

This release fixes a bug where the working-directory input was not used to detect an empty work dir. It also fixes the lowest resolution strategy resolving to latest when only a lower bound was specified.

Special thanks to @​tpgillam for the first contribution!

🐛 Bug fixes

... (truncated)

Commits

Updates pypa/cibuildwheel from 3.0.0 to 3.2.1

Release notes

Sourced from pypa/cibuildwheel's releases.

v3.2.1

  • 🛠 Update to CPython 3.14.0 final (#2614)
  • 🐛 Fix the default MACOSX_DEPLOYMENT_TARGET on Python 3.14 (#2613)
  • 📚 Docs improvements (#2617)

v3.2.0

  • ✨ Adds GraalPy v25 (Python 3.12) support (#2597)
  • 🛠 Update to CPython 3.14.0rc3 (#2602)
  • 🛠 Adds CPython 3.14.0 prerelease support for Android, and a number of improvements to Android builds (#2568, #2591)
  • 🛠 Improvements to testing on Android, passing environment markers when installing the venv, and providing more debug output when build-verbosity is set (#2575)
  • ⚠️ PyPy 3.10 was moved to pypy-eol in the enable option, as it is now end-of-life. (#2521)
  • 📚 Docs improvements (#2574, #2601, #2598)

v3.1.4

  • ✨ Add a --clean-cache command to clean up our cache (#2489)
  • 🛠 Update Python to 3.14rc2 and other patch version bumps (#2542, #2556)
  • 🛠 Update Pyodide to 0.28.2 (#2562, #2558)
  • 🐛 Fix resolution with pyodide-build when dependency-versions is set (#2548)
  • 🐛 Set CMAKE_FIND_ROOT_PATH_MODE_PACKAGE to BOTH on Android (#2547)
  • 🐛 Add patchelf dependency for platforms that can build Android wheels (#2552)
  • 🐛 Ignore empty values for CIBW_ARCHS like most other environment variables (#2541)
  • 💼 The color and suggest_on_error argparse options are now default in 3.14rc1+ (#2554)
  • 💼 Use the virtualenv release URL instead of blob URL (should be more robust) (#2555)
  • 🧪 For iOS, lowering to macos-14 is needed for now due to issues with GitHub's runner images (#2557)
  • 🧪 Split out platforms iOS and Android in our tests (#2519)
  • 🧪 Fix and enable doctests (#2546)
  • 📚 Improve our docs on free-threading (#2549)

v3.1.3

  • 🐛 Fix bug where "latest" dependencies couldn't update to pip 25.2 on Windows (#2537)
  • 🧪 Use pytest-rerunfailures to improve some of our iOS/Android tests (#2527, #2539)
  • 🧪 Remove some GraalPy Windows workarounds in our tests (#2501)

v3.1.2

  • ⚠️ Add an error if CIBW_FREE_THREADING_SUPPORT is set; you are likely missing 3.13t wheels, please use the enable/CIBW_ENABLE (#2520)
  • 🛠 riscv64 now enabled if you target that architecture, it's now supported on PyPI (#2509)
  • 🛠 Add warning when using cpython-experimental-riscv64 (no longer needed) (#2526, #2528)
  • 🛠 iOS versions bumped, fixing issues with 3.14 (now RC 1) (#2530)
  • 🐛 Fix bug in Android running wheel from our GitHub Action (#2517)
  • 🐛 Fix warning when using test-skip of "*-macosx_universal2:arm64" (#2522)
  • 🐛 Fix incorrect number of wheels reported in logs, again (#2517)
  • 📚 We welcome our Android platform maintainer (#2516)

v3.1.1

  • 🐛 Fix a bug showing an incorrect wheel count at the end of execution, and misrepresenting test-only runs in the GitHub Action summary (#2512)
  • 📚 Docs fix (#2510)

v3.1.0

  • 🌟 CPython 3.14 wheels are now built by default - without the "cpython-prerelease" enable set. It's time to build and upload these wheels to PyPI! This release includes CPython 3.14.0rc1, which is guaranteed to be ABI compatible with the final release. (#2507) Free-threading is no longer experimental in 3.14, so you have to skip it explicitly with 'cp31?t-*' if you don't support it yet. (#2503)
  • 🌟 Adds the ability to build wheels for Android! Set the platform option to android on Linux or macOS to try it out! (#2349)

... (truncated)

Changelog

Sourced from pypa/cibuildwheel's changelog.

title: Changelog

Changelog

v3.2.1

12 October 2025

  • 🛠 Update to CPython 3.14.0 final (#2614)
  • 🐛 Fix the default MACOSX_DEPLOYMENT_TARGET on Python 3.14 (#2613)
  • 📚 Docs improvements (#2617)

v3.2.0

22 September 2025

  • ✨ Adds GraalPy v25 (Python 3.12) support (#2597)
  • 🛠 Update to CPython 3.14.0rc3 (#2602)
  • 🛠 Adds CPython 3.14.0 prerelease support for Android, and a number of improvements to Android builds (#2568, #2591)
  • 🛠 Improvements to testing on Android, passing environment markers when installing the venv, and providing more debug output when build-verbosity is set (#2575)
  • ⚠️ PyPy 3.10 was moved to pypy-eol in the enable option, as it is now end-of-life. (#2521)
  • 📚 Docs improvements (#2574, #2601, #2598)

v3.1.4

19 August 2025

  • ✨ Add a --clean-cache command to clean up our cache (#2489)
  • 🛠 Update Python to 3.14rc2 and other patch version bumps (#2542, #2556)
  • 🛠 Update Pyodide to 0.28.2 (#2562, #2558)
  • 🐛 Fix resolution with pyodide-build when dependency-versions is set (#2548)
  • 🐛 Set CMAKE_FIND_ROOT_PATH_MODE_PACKAGE to BOTH on Android (#2547)
  • 🐛 Add patchelf dependency for platforms that can build Android wheels (#2552)
  • 🐛 Ignore empty values for CIBW_ARCHS like most other environment variables (#2541)
  • 💼 The color and suggest_on_error argparse options are now default in 3.14rc1+ (#2554)
  • 💼 Use the virtualenv release URL instead of blob URL (should be more robust) (#2555)
  • 🧪 For iOS, lowering to macos-14 is needed for now due to issues with GitHub's runner images (#2557)
  • 🧪 Split out platforms iOS and Android in our tests (#2519)
  • 🧪 Fix and enable doctests (#2546)
  • 📚 Improve our docs on free-threading (#2549)

v3.1.3

1 August 2025

  • 🐛 Fix bug where "latest" dependencies couldn't update to pip 25.2 on Windows (#2537)
  • 🧪 Use pytest-rerunfailures to improve some of our iOS/Android tests (#2527, #2539)

... (truncated)

Commits

Updates actions/upload-artifact from 4.6.2 to 5.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/upload-artifact@v4...v5.0.0

Commits
  • 330a01c Merge pull request #734 from actions/danwkennedy/prepare-5.0.0
  • 03f2824 Update github.dep.yml
  • 905a1ec Prepare v5.0.0
  • 2d9f9cd Merge pull request #725 from patrikpolyak/patch-1
  • 9687587 Merge branch 'main' into patch-1
  • 2848b2c Merge pull request #727 from danwkennedy/patch-1
  • 9b51177 Spell out the first use of GHES
  • cd231ca Update GHES guidance to include reference to Node 20 version
  • de65e23 Merge pull request #712 from actions/nebuk89-patch-1
  • 8747d8c Update README.md
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 6.0.0

Release notes

Sourced from actions/download-artifact's releases.

v6.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/download-artifact@v5...v6.0.0

v5.0.0

What's Changed

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

  • By name: name: my-artifact → extracted to path/ (direct)
  • By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

  • By name: name: my-artifact → extracted to path/ (unchanged)
  • By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:
  • You download artifacts by name
  • You download multiple artifacts by ID
  • You already use merge-multiple: true as a workaround
⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

... (truncated)

Commits
  • 018cc2c Merge pull request #438 from actions/danwkennedy/prepare-6.0.0
  • 815651c Revert "Remove github.dep.yml"
  • bb3a066 Remove github.dep.yml
  • fa1ce46 Prepare v6.0.0
  • 4a24838 Merge pull request #431 from danwkennedy/patch-1
  • 5e3251c Readme: spell out the first use of GHES
  • abefc31 Merge pull request #424 from actions/yacaovsnc/update_readme
  • ac43a60 Update README with artifact extraction details
  • de96f46 Merge pull request #417 from actions/yacaovsnc/update_readme
  • 7993cb4 Remove migration guide for artifact download changes
  • Additional commits viewable in compare view

Updates CodSpeedHQ/action from 3.5.0 to 4.3.4

Release notes

Sourced from CodSpeedHQ/action's releases.

v4.3.4

Release Notes

🚀 Features

🐛 Bug Fixes

⚙️ Internals

@dependabot dependabot bot added dependencies github_actions Pull requests that update GitHub Actions code labels Nov 10, 2025
@dependabot dependabot bot force-pushed the dependabot/github_actions/ci-dependencies-36f941d4a8 branch from 0e61faf to b9ea5a7 Compare November 17, 2025 21:19
@dependabot dependabot bot force-pushed the dependabot/github_actions/ci-dependencies-36f941d4a8 branch from b9ea5a7 to 06cb0fe Compare December 8, 2025 21:11
@dependabot dependabot bot force-pushed the dependabot/github_actions/ci-dependencies-36f941d4a8 branch from 06cb0fe to 76cbd77 Compare December 15, 2025 21:13
@dependabot
build(deps): bump the ci-dependencies group across 1 directory with 1…
d1b91ed 
…0 updates

Bumps the ci-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `5` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `8.0.0` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.6.0` | `3.7.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.1.0` | `7.1.3` |
| [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) | `3.0.0` | `3.2.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `5.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `6.0.0` |
| [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `3.5.0` | `4.3.4` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.12.4` | `1.13.0` |



Updates `actions/checkout` from 4 to 5
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v5)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v6)

Updates `actions/github-script` from 7.0.1 to 8.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@60a0d83...ed59741)

Updates `docker/setup-qemu-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)

Updates `astral-sh/setup-uv` from 6.1.0 to 7.1.3
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@f0ec1fc...5a7eac6)

Updates `pypa/cibuildwheel` from 3.0.0 to 3.2.1
- [Release notes](https://github.com/pypa/cibuildwheel/releases)
- [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md)
- [Commits](pypa/cibuildwheel@5f22145...9c00cb4)

Updates `actions/upload-artifact` from 4.6.2 to 5.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...330a01c)

Updates `actions/download-artifact` from 4.3.0 to 6.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...018cc2c)

Updates `CodSpeedHQ/action` from 3.5.0 to 4.3.4
- [Release notes](https://github.com/codspeedhq/action/releases)
- [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md)
- [Commits](CodSpeedHQ/action@0010eb0...6a8e2b8)

Updates `pypa/gh-action-pypi-publish` from 1.12.4 to 1.13.0
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@76f52bc...ed0c539)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: actions/github-script
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: docker/setup-qemu-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: astral-sh/setup-uv
  dependency-version: 7.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: pypa/cibuildwheel
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: actions/upload-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: actions/download-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: CodSpeedHQ/action
  dependency-version: 4.3.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/github_actions/ci-dependencies-36f941d4a8 branch from 76cbd77 to d1b91ed Compare December 22, 2025 21:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant