chore(deps): bump the github-actions group across 1 directory with 10 updates#2533
chore(deps): bump the github-actions group across 1 directory with 10 updates#2533dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
… updates Bumps the github-actions group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.53` | `1.0.111` | | [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.2.1` | `8.1.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.4.0` | | [actions/cache](https://github.com/actions/cache) | `5.0.3` | `5.0.5` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` | Updates `actions/checkout` from 4.3.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.3.1...de0fac2) Updates `anthropics/claude-code-action` from 1.0.53 to 1.0.111 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@2f8ba26...fefa07e) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@ed59741...3a2844b) Updates `astral-sh/setup-uv` from 7.2.1 to 8.1.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@803947b...0880764) Updates `actions/setup-node` from 6.2.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@6044e13...48b55a0) Updates `actions/cache` from 5.0.3 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@cdf6c1f...27d5ce7) Updates `actions/upload-artifact` from 6.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b7c566a...043fb46) Updates `actions/download-artifact` from 7.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@37930b1...3e5f45b) Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210) Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@c0f553f...5f6978f) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.111 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
|
||
| - name: Create pull request | ||
| uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v7 | ||
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7 |
There was a problem hiding this comment.
🟡 The trailing comment # v7 is stale — per the PR description this SHA corresponds to peter-evans/create-pull-request v8.1.1, so it's now off by a full major version. Dependabot likely skipped updating it because the bare # v7 doesn't match its expected # vX.Y.Z format (note it correctly updated # v7.2.1 → # v8.1.0 for setup-uv in this same file). Since this line is being touched anyway, consider correcting it to # v8.1.1 so dependabot keeps it in sync going forward.
Extended reasoning...
What's wrong
Line 32 of .github/workflows/weekly-lockfile-update.yml is updated to:
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7The PR description explicitly states this bumps peter-evans/create-pull-request from 8.1.0 to 8.1.1, so SHA 5f6978fa… is v8.1.1. The trailing # v7 annotation is therefore wrong by a full major version.
Why dependabot didn't fix it
Dependabot updates trailing version comments when they match its expected exact-version format. Evidence from this very file: on line 19 it correctly rewrote # v7.2.1 → # v8.1.0 for astral-sh/setup-uv. But # v7 is a bare major-version tag that doesn't match that pattern, so dependabot left it untouched while updating the SHA. The mismatch was already present before this PR (the old SHA c0f553fe… was v8.1.0 with the same # v7 comment), and dependabot has now carried it forward again.
Why it's worth flagging here
The whole point of the # vX.Y.Z annotation next to a SHA pin is to give humans a readable indicator of which version is in use without having to resolve the hash. A comment that says v7 while the SHA is v8.1.1 actively misleads reviewers — for example, someone auditing whether the repo is affected by a v7-only CVE, or checking whether a v8 feature is available, would draw the wrong conclusion. Every other action pin touched by this PR has an accurate exact-version comment (# v6.0.2, # v8.1.0, # v9.0.0, # v5.0.5, etc.), so this one is inconsistent with the rest of the diff.
Step-by-step
- Before PR:
peter-evans/create-pull-request@c0f553fe… # v7(actually v8.1.0 — already stale). - Dependabot bumps to v8.1.1 → rewrites SHA to
5f6978fa…. - Dependabot's comment-rewriter looks for an exact version like
# v8.1.0to replace;# v7doesn't match, so it's preserved verbatim. - Result:
peter-evans/create-pull-request@5f6978fa… # v7— SHA says v8.1.1, comment says v7.
Addressing the counter-argument
One could argue this is intentional shorthand, similar to # release/v1 used for pypa/gh-action-pypi-publish in publish-pypi.yml. However, # release/v1 annotates a SHA that genuinely tracks the release/v1 branch tip — the comment matches what's pinned. Here, # v7 does not match what's pinned (the SHA is on the v8 line), so it isn't a tracking-ref shorthand; it's simply stale. And because the bare-major format prevents dependabot from ever auto-correcting it, it will drift further on every future bump unless fixed manually.
Impact & fix
Zero functional impact — the workflow runs the correct v8.1.1 code regardless of the comment — hence nit severity. But since this PR already modifies the line, it's the natural place to correct it:
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1Using the exact-version format also lets dependabot maintain it automatically on subsequent bumps.
Bumps the github-actions group with 10 updates in the / directory:
4.3.16.0.21.0.531.0.1118.0.09.0.07.2.18.1.06.2.06.4.05.0.35.0.56.0.07.0.17.0.08.0.11.13.01.14.08.1.08.1.1Updates
actions/checkoutfrom 4.3.1 to 6.0.2Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)Updates
anthropics/claude-code-actionfrom 1.0.53 to 1.0.111Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
fefa07echore: bump Claude Code to 2.1.126 and Agent SDK to 0.2.126ef50f12chore: bump Claude Code to 2.1.123 and Agent SDK to 0.2.123b3c0320chore: bump Claude Code to 2.1.122 and Agent SDK to 0.2.122c93e8fedocs: pull_request_target guidance and base-action trust model (#1250)11a9dadchore: bump Claude Code to 2.1.121 and Agent SDK to 0.2.121567fe95chore: bump Claude Code to 2.1.119 and Agent SDK to 0.2.1192da6cfachore: bump Claude Code to 2.1.120 and Agent SDK to 0.2.120e58dfa5chore: bump Claude Code to 2.1.119 and Agent SDK to 0.2.1196ee201ffix: allow + in branch names (generated by Claude Code EnterWorktree) (#1248)b4d6741chore: bump Claude Code to 2.1.118 and Agent SDK to 0.2.118Updates
actions/github-scriptfrom 8.0.0 to 9.0.0Release notes
Sourced from actions/github-script's releases.
Commits
3a2844bMerge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...ca10bbdfix: use@octokit/core/types import for v7 compatibility86e48e2merge: incorporate main branch changesc108472chore: rebuild dist for v9 upgrade and getOctokit factoryafff112Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...ff8117eci: fix user-agent test to handle orchestration ID81c6b78ci: use deployment: false to suppress deployment noise from integration tests3953cafdocs: update README examples from@v8to@v9, add getOctokit docs and v9 brea...c17d55bci: add getOctokit integration test joba047196test: add getOctokit integration tests via callAsyncFunctionUpdates
astral-sh/setup-uvfrom 7.2.1 to 8.1.0Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
0880764fix: grant contents:write to validate-release job (#860)717d6abAdd a release-gate step to the release workflow (#859)5a911ebDraft commitish releases (#858)080c31eAdd action-types.yml to instructions (#857)b3e97d2Add input no-project in combination with activate-environment (#856)7dd591dchore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 (#855)1541b77chore: update known checksums for 0.11.7 (#853)cdfb2eeRefactor version resolving (#852)cb84d12chore: update known checksums for 0.11.6 (#850)1912cc6chore: update known checksums for 0.11.5 (#845)Updates
actions/setup-nodefrom 6.2.0 to 6.4.0Release notes
Sourced from actions/setup-node's releases.
Commits
48b55a0Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)ab72c7eUpgrade@actionsdependencies (#1525)53b8394Bump minimatch from 3.1.2 to 3.1.5 (#1498)54045abScope test lockfiles by package manager and update cache tests (#1495)c882bffReplace uuid with crypto.randomUUID() (#1378)774c1d6feat(node-version-file): support parsingdevEnginesfield (#1283)efcb663fix: remove hardcoded bearer (#1467)d02c89dFix npm audit issues (#1491)Updates
actions/cachefrom 5.0.3 to 5.0.5Release notes
Sourced from actions/cache's releases.
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
27d5ce7Merge pull request #1747 from actions/yacaovsnc/update-dependencyf280785licensed changes619aeb1npm run build generated dist filesbcf16c2Update ts-http-runtime to 0.3.56682284Merge pull request #1738 from actions/prepare-v5.0.4e340396Update RELEASES8a67110Add licenses1865903Update dependencies & patch security vulnerabilities5656298Merge pull request #1722 from RyPeck/patch-14e380d1Fix cache key in examples.md for bun.lockUpdates
actions/upload-artifactfrom 6.0.0 to 7.0.1Release notes
Sourced from actions/upload-artifact's releases.
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testUpdates
actions/download-artifactfrom 7.0.0 to 8.0.1Release notes
Sourced from actions/download-artifact's releases.
Commits
3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issuesbd7976bAdd a setting to specify what to do on hash mismatch and default it toerrorac21fcfMerge pull request #460 from actions/danwkennedy/download-no-unzip15999bfAdd note about package bumps974686eBump the version tov8and add release notesfbe48b1Update test names to make it clearer what they doUpdates
pypa/gh-action-pypi-publishfrom 1.13.0 to 1.14.0Release notes
Sourced from pypa/gh-action-pypi-publish's releases.
Commits
cef2210Merge pull request #397 from whitequark/patch-1b4595e2Enableverboseandprint-hashby default.e2bab26Merge pull request #395 from him2him2/docs/fix-typos-and-grammar7495c38docs: fix typos and grammar in README and SECURITY03f86feMerge pull request #388 from woodruffw-forks/ww/rm-experimental4c78f1cMerge branch 'unstable/v1' into ww/rm-experimentalb5a6e8bdeps: bump sigstore and pypi-attestationsa48a03eremove another experimental mention8087a88action: remove a lingering mention of PEP 740 being experimental3317ede🧪 Integrate actionlint via pre-commit frameworkUpdates
peter-evans/create-pull-requestfrom 8.1.0 to 8.1.1Release notes
Sourced from