chore(deps): update ci dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/add-to-project	action	major	v0.5.0 -> v1.0.1
actions/checkout	action	patch	v4.1.1 -> v4.1.4
actions/dependency-review-action	action	major	v3.1.4 -> v4.3.2
actions/setup-node	action	patch	v4.0.1 -> v4.0.2
actions/setup-python	action	minor	v5.0.0 -> v5.1.0
actions/upload-artifact	action	minor	v4.0.0 -> v4.3.3
docker/build-push-action	action	minor	v5.1.0 -> v5.3.0
docker/login-action	action	minor	v3.0.0 -> v3.1.0
docker/setup-buildx-action	action	minor	v3.0.0 -> v3.3.0
eps1lon/actions-label-merge-conflict	action	major	v2.1.0 -> v3.0.0
webiny/action-conventional-commits	action	minor	v1.2.0 -> v1.3.0

---

Release Notes

actions/add-to-project (actions/add-to-project)

v1.0.1

Compare Source

Summary

This release includes dependency updates, including security fix to undici.

What's Changed

• Dependabot/npm and yarn/undici 5.28.4 fixes by @​skw in https://github.com/actions/add-to-project/pull/550
• build(deps-dev): bump @​typescript-eslint/parser from 7.4.0 to 7.6.0 by @​dependabot in https://github.com/actions/add-to-project/pull/546
• build(deps-dev): bump @​typescript-eslint/eslint-plugin from 7.4.0 to 7.6.0 by @​dependabot in https://github.com/actions/add-to-project/pull/547
• build(deps-dev): bump typescript from 5.4.3 to 5.4.5 by @​dependabot in https://github.com/actions/add-to-project/pull/549
• build(deps-dev): bump @​types/node from 16.18.91 to 16.18.96 by @​dependabot in https://github.com/actions/add-to-project/pull/548
• build(deps): bump undici from 5.28.3 to 5.28.4 by @​dependabot in https://github.com/actions/add-to-project/pull/542

Full Changelog: actions/add-to-project@v1.0.0...v1.0.1

v1.0.0

Compare Source

Summary

This release promotes actions/add-to-projects to a major version 1 and marks the public API stable.

What's Changed

• build(deps-dev): bump eslint-plugin-github from 4.10.0 to 4.10.2 by @​dependabot in https://github.com/actions/add-to-project/pull/532
• build(deps-dev): bump prettier from 3.0.3 to 3.2.5 by @​dependabot in https://github.com/actions/add-to-project/pull/531
• build(deps-dev): bump @​vercel/ncc from 0.38.0 to 0.38.1 by @​dependabot in https://github.com/actions/add-to-project/pull/530
• build(deps-dev): bump ts-jest from 29.1.1 to 29.1.2 by @​dependabot in https://github.com/actions/add-to-project/pull/528
• build(deps-dev): bump typescript from 5.4.2 to 5.4.3 by @​dependabot in https://github.com/actions/add-to-project/pull/533
• build(deps-dev): bump @​types/jest from 29.5.7 to 29.5.12 by @​dependabot in https://github.com/actions/add-to-project/pull/534
• build(deps-dev): bump @​typescript-eslint/parser from 6.9.1 to 7.3.1 by @​dependabot in https://github.com/actions/add-to-project/pull/529
• build(deps-dev): bump @​typescript-eslint/eslint-plugin from 7.0.1 to 7.4.0 by @​dependabot in https://github.com/actions/add-to-project/pull/536
• build(deps-dev): bump @​typescript-eslint/parser from 7.3.1 to 7.4.0 by @​dependabot in https://github.com/actions/add-to-project/pull/535

Full Changelog: actions/add-to-project@v0.6.1...v1.0.0

v0.6.1

Compare Source

What's Changed

• build(deps-dev): bump eslint-plugin-prettier from 5.0.0 to 5.1.3 by @​dependabot in https://github.com/actions/add-to-project/pull/514
• build(deps-dev): bump concurrently from 8.2.1 to 8.2.2 by @​dependabot in https://github.com/actions/add-to-project/pull/498
• build(deps-dev): bump eslint from 8.49.0 to 8.57.0 by @​dependabot in https://github.com/actions/add-to-project/pull/520
• build(deps): bump github/codeql-action from 2 to 3 by @​dependabot in https://github.com/actions/add-to-project/pull/507
• build(deps): bump actions/upload-artifact from 3 to 4 by @​dependabot in https://github.com/actions/add-to-project/pull/508
• Improve output of check-dist workflow by @​camchenry in https://github.com/actions/add-to-project/pull/521
• build(deps): bump @​actions/core from 1.10.0 to 1.10.1 by @​dependabot in https://github.com/actions/add-to-project/pull/470
• build(deps): bump @​actions/github from 5.1.1 to 6.0.0 by @​dependabot in https://github.com/actions/add-to-project/pull/500
• build(deps): bump actions/setup-node from 3 to 4 by @​dependabot in https://github.com/actions/add-to-project/pull/493
• Update readme and prepare release by @​talune in https://github.com/actions/add-to-project/pull/523
• build(deps-dev): bump @​types/node from 16.18.60 to 16.18.91 by @​dependabot in https://github.com/actions/add-to-project/pull/527
• build(deps-dev): bump eslint-plugin-jest from 27.6.0 to 27.9.0 by @​dependabot in https://github.com/actions/add-to-project/pull/525
• build(deps-dev): bump @​typescript-eslint/eslint-plugin from 6.7.0 to 7.0.0 by @​dependabot in https://github.com/actions/add-to-project/pull/524
• build(deps-dev): bump typescript from 5.2.2 to 5.4.2 by @​dependabot in https://github.com/actions/add-to-project/pull/526

New Contributors

• @​camchenry made their first contribution in https://github.com/actions/add-to-project/pull/521
• @​talune made their first contribution in https://github.com/actions/add-to-project/pull/523

Full Changelog: actions/add-to-project@v0.6.0...v0.6.1

v0.6.0

Compare Source

actions/checkout (actions/checkout)

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1692
• Add dependabot config by @​cory-miller in https://github.com/actions/checkout/pull/1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in https://github.com/actions/checkout/pull/1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in https://github.com/actions/checkout/pull/1643

v4.1.3

Compare Source

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in https://github.com/actions/checkout/pull/1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1656
• Add SSH user parameter by @​cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in https://github.com/actions/checkout/pull/1598

actions/dependency-review-action (actions/dependency-review-action)

v4.3.2

Compare Source

What's Changed

• Fix package-url parsing for allow-dependencies-licenses by @​juxtin in https://github.com/actions/dependency-review-action/pull/761

Full Changelog: actions/dependency-review-action@v4.3.1...v4.3.2

v4.3.1

Compare Source

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See https://github.com/actions/dependency-review-action/pull/753.

Full Changelog: actions/dependency-review-action@V4.3.0...v4.3.1

v4.3.0

Compare Source

New Features

• The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

• Fix action variable name for scorecard by @​lukehinds in https://github.com/actions/dependency-review-action/pull/735
• Fix extra https:// in summary by @​jhutchings1 in https://github.com/actions/dependency-review-action/pull/748
• Bump typescript from 5.3.3 to 5.4.5 by @​dependabot in https://github.com/actions/dependency-review-action/pull/744
• Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @​dependabot in https://github.com/actions/dependency-review-action/pull/737
• Show denied packages with red X by @​juxtin in https://github.com/actions/dependency-review-action/pull/750
• deny-packages configuration option can deny specified version or all packages by @​febuiles and @​bteng22 in https://github.com/actions/dependency-review-action/pull/733

New Contributors

• @​bteng22 made their first contribution in https://github.com/actions/dependency-review-action/pull/733
• @​lukehinds made their first contribution in https://github.com/actions/dependency-review-action/pull/735

Full Changelog: actions/dependency-review-action@v4.2.5...V4.3.0

v4.2.5: 4.2.5

Compare Source

What's Changed

• Fixed a bug where some configuration options in external files were not being properly picked up -- https://github.com/actions/dependency-review-action/pull/722
• Bump eslint from 8.56.0 to 8.57.0

Full Changelog: actions/dependency-review-action@v4.2.4...v4.2.5

v4.2.4

Compare Source

What's Changed

Fixed a bug in the output of OpenSSF cards for GitHub Actions.

New Contributors

• @​sporkmonger made their first contribution in https://github.com/actions/dependency-review-action/pull/721

Full Changelog: actions/dependency-review-action@v4.2.3...v4.2.4

v4.2.3: 4.2.3

Compare Source

What's Changed

• Set comment as output by @​jsoref in https://github.com/actions/dependency-review-action/pull/698
• Add support for calculating OpenSSF Scorecards by @​jhutchings1 in https://github.com/actions/dependency-review-action/pull/709
• Add outputs for the changes data by @​laughedelic in https://github.com/actions/dependency-review-action/pull/707

New Contributors

• @​jhutchings1 made their first contribution in https://github.com/actions/dependency-review-action/pull/709
• @​laughedelic made their first contribution in https://github.com/actions/dependency-review-action/pull/707

Full Changelog: actions/dependency-review-action@v4.1.3...v4.2.3

v4.1.3: 4.1.3

Compare Source

Fixes a bug in 4.1.2 that would introduce comments in every pull request, regardless of the user's configuration (see https://github.com/actions/dependency-review-action/issues/697).

Full Changelog: actions/dependency-review-action@v4.1.2...v4.1.3

v4.1.2: 4.1.2

Compare Source

What's Changed

• Expose dependency comment content by @​jsoref in https://github.com/actions/dependency-review-action/pull/696

Full Changelog: actions/dependency-review-action@v4.1.1...v4.1.2

v4.1.1: 4.1.1

Compare Source

What's Changed

• Bump undici to fix GHSA-wqq4-5wpv-mx2g
• Bump @​types/node from 20.11.17 to 20.11.19 by @​dependabot in https://github.com/actions/dependency-review-action/pull/693

Full Changelog: actions/dependency-review-action@v4.1.0...v4.1.1

v4.1.0: 4.1.0

Compare Source

What's Changed

• Add warn-only by @​tgrall in https://github.com/actions/dependency-review-action/pull/432

Added a new configuration option (warn-only, boolean) that makes the action always succeed while still displaying found vulnerabilities in the log.

• Create stale.yaml by @​jonjanego in https://github.com/actions/dependency-review-action/pull/671
• Use manual codeql config by @​juxtin in https://github.com/actions/dependency-review-action/pull/678
• Multiple dependency updates (see the changelog below for more information)

New Contributors

• @​jonjanego made their first contribution in https://github.com/actions/dependency-review-action/pull/671
• @​tgrall made their first contribution in https://github.com/actions/dependency-review-action/pull/432

Full Changelog: actions/dependency-review-action@v4...v4.1.0

v4.0.0

Compare Source

• Update action to Node 20 by @​takost in https://github.com/actions/dependency-review-action/pull/639
• Dependabot updates, see the full changelog for more details.

New Contributors

• @​takost made their first contribution in https://github.com/actions/dependency-review-action/pull/639

Full Changelog: actions/dependency-review-action@v3.1.5...v4.0.0

v3.1.5: 3.1.5

Compare Source

What's Changed

• Smaller per_page when requesting diff by @​hmaurer in https://github.com/actions/dependency-review-action/pull/649
• Update dependencies:
  • Bump @​typescript-eslint/parser from 6.10.0 to 6.13.1 by @​dependabot in https://github.com/actions/dependency-review-action/pull/630
  • Bump prettier from 3.0.3 to 3.1.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/629
  • Bump @​types/jest from 29.5.8 to 29.5.11 by @​dependabot in https://github.com/actions/dependency-review-action/pull/637
  • Bump nodemon from 3.0.1 to 3.0.2 by @​dependabot in https://github.com/actions/dependency-review-action/pull/636
  • Replace pip -> pypi in PURL examples by @​febuiles in https://github.com/actions/dependency-review-action/pull/638
  • Bump @​typescript-eslint/eslint-plugin from 6.12.0 to 6.15.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/644
  • Bump eslint from 8.53.0 to 8.56.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/640
  • Bump @​typescript-eslint/parser from 6.13.1 to 6.16.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/645
  • Bump prettier from 3.1.0 to 3.1.1 by @​dependabot in https://github.com/actions/dependency-review-action/pull/646

Full Changelog: actions/dependency-review-action@v3.1.4...v3.1.5

actions/setup-node (actions/setup-node)

v4.0.2

Compare Source

What's Changed

• Add support for volta.extends by @​ThisIsManta in https://github.com/actions/setup-node/pull/921
• Add support for arm64 Windows by @​dmitry-shibanov in https://github.com/actions/setup-node/pull/927

New Contributors

• @​ThisIsManta made their first contribution in https://github.com/actions/setup-node/pull/921

Full Changelog: actions/setup-node@v4.0.1...v4.0.2

actions/setup-python (actions/setup-python)

v5.1.0

Compare Source

What's Changed

• Leveraging the raw API to retrieve the version-manifest, as it does not impose a rate limit and hence facilitates unrestricted consumption without the need for a token for Github Enterprise Servers by @​Shegox in https://github.com/actions/setup-python/pull/766.
• Dependency updates by @​dependabot and @​HarithaVattikuti in https://github.com/actions/setup-python/pull/817
• Documentation changes for version in README by @​basnijholt in https://github.com/actions/setup-python/pull/776
• Documentation changes for link in README by @​ukd1 in https://github.com/actions/setup-python/pull/793
• Documentation changes for link in Advanced Usage by @​Jamim in https://github.com/actions/setup-python/pull/782
• Documentation changes for avoiding rate limit issues on GHES by @​priya-kinthali in https://github.com/actions/setup-python/pull/835

New Contributors

• @​basnijholt made their first contribution in https://github.com/actions/setup-python/pull/776
• @​ukd1 made their first contribution in https://github.com/actions/setup-python/pull/793
• @​Jamim made their first contribution in https://github.com/actions/setup-python/pull/782
• @​Shegox made their first contribution in https://github.com/actions/setup-python/pull/766
• @​priya-kinthali made their first contribution in https://github.com/actions/setup-python/pull/835

Full Changelog: actions/setup-python@v5.0.0...v5.1.0

actions/upload-artifact (actions/upload-artifact)

v4.3.3

Compare Source

What's Changed

• updating @actions/artifact dependency to v2.1.6 by @​eggyhead in https://github.com/actions/upload-artifact/pull/565

Full Changelog: actions/upload-artifact@v4.3.2...v4.3.3

v4.3.2

Compare Source

What's Changed

• Update release-new-action-version.yml by @​konradpabjan in https://github.com/actions/upload-artifact/pull/516
• Minor fix to the migration readme by @​andrewakim in https://github.com/actions/upload-artifact/pull/523
• Update readme with v3/v2/v1 deprecation notice by @​robherley in https://github.com/actions/upload-artifact/pull/561
• updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @​eggyhead in https://github.com/actions/upload-artifact/pull/562

New Contributors

• @​andrewakim made their first contribution in https://github.com/actions/upload-artifact/pull/523

Full Changelog: actions/upload-artifact@v4.3.1...v4.3.2

v4.3.1

Compare Source

• Bump @​actions/artifacts to latest version to include updated GHES host check

v4.3.0

Compare Source

What's Changed

• Reorganize upload code in prep for merge logic & add more tests by @​robherley in https://github.com/actions/upload-artifact/pull/504
• Add sub-action to merge artifacts by @​robherley in https://github.com/actions/upload-artifact/pull/505

Full Changelog: actions/upload-artifact@v4...v4.3.0

v4.2.0

Compare Source

What's Changed

• Ability to overwrite an Artifact by @​robherley in https://github.com/actions/upload-artifact/pull/501

Full Changelog: actions/upload-artifact@v4...v4.2.0

v4.1.0

Compare Source

What's Changed

• Add migrations docs by @​robherley in https://github.com/actions/upload-artifact/pull/482
• Update README.md by @​samuelwine in https://github.com/actions/upload-artifact/pull/492
• Support artifact-url output by @​konradpabjan in https://github.com/actions/upload-artifact/pull/496
• Update readme to reflect new 500 artifact per job limit by @​robherley in https://github.com/actions/upload-artifact/pull/497

New Contributors

• @​samuelwine made their first contribution in https://github.com/actions/upload-artifact/pull/492

Full Changelog: actions/upload-artifact@v4...v4.1.0

docker/build-push-action (docker/build-push-action)

v5.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.18.0 to 0.19.0 in https://github.com/docker/build-push-action/pull/1080

Full Changelog: docker/build-push-action@v5.2.0...v5.3.0

v5.2.0

Compare Source

• Disable quotes detection for outputs input by @​crazy-max in https://github.com/docker/build-push-action/pull/1074
• Warn about ignored inputs by @​favonia in https://github.com/docker/build-push-action/pull/1019
• Bump @​docker/actions-toolkit from 0.14.0 to 0.18.0 in https://github.com/docker/build-push-action/pull/1070
• Bump undici from 5.26.3 to 5.28.3 in https://github.com/docker/build-push-action/pull/1057

Full Changelog: docker/build-push-action@v5.1.0...v5.2.0

docker/login-action (docker/login-action)

v3.1.0

Compare Source

• build(deps): bump @​babel/traverse from 7.17.3 to 7.23.2 in https://github.com/docker/login-action/pull/618
• build(deps): bump @​docker/actions-toolkit from 0.12.0 to 0.18.0 in https://github.com/docker/login-action/pull/616 https://github.com/docker/login-action/pull/636 https://github.com/docker/login-action/pull/682
• build(deps): bump aws-sdk dependencies to 3.529.1 in https://github.com/docker/login-action/pull/624 https://github.com/docker/login-action/pull/685
• build(deps): bump http-proxy-agent to 7.0.2 in https://github.com/docker/login-action/pull/676
• build(deps): bump https-proxy-agent to 7.0.4 in https://github.com/docker/login-action/pull/676
• build(deps): bump undici from 5.26.5 to 5.28.3 in https://github.com/docker/login-action/pull/677

Full Changelog: docker/login-action@v3.0.0...v3.1.0

docker/setup-buildx-action (docker/setup-buildx-action)

v3.3.0

Compare Source

v3.2.0

Compare Source

• Rename and align config inputs by @​crazy-max in https://github.com/docker/setup-buildx-action/pull/303
  • config to buildkitd-config
  • config-inline to buildkitd-config-inline
• Bump @​docker/actions-toolkit from 0.17.0 to 0.19.0 in https://github.com/docker/setup-buildx-action/pull/302 https://github.com/docker/setup-buildx-action/pull/306

[!NOTE]
config and config-inline input names are deprecated and will be removed in next major release.

Full Changelog: docker/setup-buildx-action@v3.1.0...v3.2.0

v3.1.0

Compare Source

eps1lon/actions-label-merge-conflict (eps1lon/actions-label-merge-conflict)

v3.0.0

Compare Source

What's Changed

• Update to node20 (#​115)

Full Changelog: eps1lon/actions-label-merge-conflict@v2.1.0...v3.0.0

webiny/action-conventional-commits (webiny/action-conventional-commits)

v1.3.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/quality-checks.yml

Package	Version	License	Issue Type
webiny/action-conventional-commits	1.3.0	Null	Unknown License

Scanned Manifest Files

.github/workflows/decide.yml

• actions/upload-artifact@4.3.1
• actions/upload-artifact@4.0.0

.github/workflows/quality-checks.yml

• actions/dependency-review-action@4.1.2
• actions/setup-node@4.0.2
• webiny/action-conventional-commits@1.3.0
• actions/dependency-review-action@3.1.4
• actions/setup-node@4.0.1
• webiny/action-conventional-commits@1.2.0