Skip to content

Bump the github-actions group across 1 directory with 7 updates#869

Merged
lrknox merged 1 commit intomasterfrom
dependabot/github_actions/github-actions-d7ef2cb3e6
Apr 1, 2026
Merged

Bump the github-actions group across 1 directory with 7 updates#869
lrknox merged 1 commit intomasterfrom
dependabot/github_actions/github-actions-d7ef2cb3e6

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 1, 2026

Bumps the github-actions group with 7 updates in the / directory:

Package From To
actions/download-artifact 7.0.0 8.0.1
actions/upload-artifact 6 7
EndBug/add-and-commit 9.1.4 10.0.0
ssciwr/doxygen-install 1 2
azure/trusted-signing-action 1.0.0 1.2.0
aws-actions/configure-aws-credentials 5 6
softprops/action-gh-release 2.5.0 2.6.1

Updates actions/download-artifact from 7.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 6 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

Commits

Updates EndBug/add-and-commit from 9.1.4 to 10.0.0

Release notes

Sourced from EndBug/add-and-commit's releases.

v10.0.0

What's Changed

... (truncated)

Commits
  • 290ea2c 10.0.0
  • 5190a0a docs: prepare for v10
  • 9ac3878 chore: npm audit fix
  • 7b015bd docs: add CodeReaper as a contributor for maintenance (#723)
  • 300836d chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#722)
  • f6e20ed feat!: use node version 24 (#720)
  • 6280653 chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (#721)
  • 1539a6a chore(deps): bump @​actions/core from 2.0.2 to 3.0.0 (#716)
  • af611dd chore(deps): bump minimatch (#718)
  • 2df77c1 chore(deps-dev): bump eslint-plugin-prettier from 5.5.4 to 5.5.5 (#712)
  • Additional commits viewable in compare view

Updates ssciwr/doxygen-install from 1 to 2

Release notes

Sourced from ssciwr/doxygen-install's releases.

v2.0.0

Now offers both ARM and Intel builds for MacOS. As a consequence, only those official releases that provide these binaries will work. If you do not pin an older version of Doxygen or do not use it on MacOS, you are unaffected. Also bumps the default version of Doxygen to v1.16.1.

v1.6.4

No release notes provided.

v1.6.3

Full Changelog: ssciwr/doxygen-install@v1.6.2...v1.6.3

v1.6.2

Full Changelog: ssciwr/doxygen-install@v1.6.1...v1.6.2

v1.6.1

Full Changelog: ssciwr/doxygen-install@v1.6.0...v1.6.1

v1.6.0

Full Changelog: ssciwr/doxygen-install@v1.5.0...v1.6.0

v1.5.0

Full Changelog: ssciwr/doxygen-install@v1...v1.5.0

v1.4.0

What's Changed

New Contributors

Full Changelog: ssciwr/doxygen-install@v1.3.0...v1.4.0

v1.3.0

What's Changed

v1.2.0

Full Changelog: ssciwr/doxygen-install@v1.1.0...v1.2.0

v1.1.0

Bumps the default version to Doxygen v1.9.7

Commits

Updates azure/trusted-signing-action from 1.0.0 to 1.2.0

Release notes

Sourced from azure/trusted-signing-action's releases.

v1.2.0

What's Changed

New Contributors

Full Changelog: Azure/artifact-signing-action@v1.1.0...v1.2.0

v1.1.0

What's Changed

Full Changelog: Azure/artifact-signing-action@v1...v1.1.0

Commits
  • b443cf8 Update internal actions/cache to v5.0.4 (#126)
  • 6c581eb refactor: disable az credential types by default except cli and env vars (#122)
  • dd27d98 docs: update examples to remove azps session (#123)
  • 87c2e83 feat: check runner prior to execution (#120)
  • d15bd92 chore: upgrade cache-action to version 4.3.0 (#116)
  • 2eddbb3 docs: update lack of support for win arm (#117)
  • f3a110b chore: update code owners to artifact signing team (#118)
  • 6d98e55 docs: update usage examples (#113)
  • bf773a7 docs: update README example to use artifact-signing-action@v1 (#111)
  • See full diff in compare view

Updates aws-actions/configure-aws-credentials from 5 to 6

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.0.0

6.0.0 (2026-02-04)

⚠ BREAKING CHANGES

  • Update action to use node24 Note this requires GitHub action runner version v2.327.1 or later (#1632) (a7a2c11)

Features

Bug Fixes

  • properly output aws-account-id and authenticated-arn when using role-chaining (#1633) (7ceaf96)

v5.1.1

5.1.1 (2025-11-24)

Miscellaneous Chores

  • release 5.1.1 (56d6a58)
  • various dependency updates

v5.1.0

5.1.0 (2025-10-06)

Features

Bug Fixes

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

5.1.0 (2025-10-06)

Features

Bug Fixes

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

  • Cleanup input handling. Changes invalid boolean input behavior (see #1445)

Features

4.3.1 (2025-08-04)

Bug Fixes

4.3.0 (2025-08-04)

Features

Bug Fixes

  • docs: readme samples versioning (5b3c895)
  • the wrong example region for China partition in README (37fe9a7)
  • properly set proxy environment variable (cbea708)

... (truncated)

Commits

Updates softprops/action-gh-release from 2.5.0 to 2.6.1

Release notes

Sourced from softprops/action-gh-release's releases.

v2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

v2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

v2.5.3

2.5.3 is a patch release focused on the remaining path-handling and release-selection bugs uncovered after 2.5.2. It fixes [#639](https://github.com/softprops/action-gh-release/issues/639), [#571](https://github.com/softprops/action-gh-release/issues/571), [#280](https://github.com/softprops/action-gh-release/issues/280), [#614](https://github.com/softprops/action-gh-release/issues/614), [#311](https://github.com/softprops/action-gh-release/issues/311), [#403](https://github.com/softprops/action-gh-release/issues/403), and [#368](https://github.com/softprops/action-gh-release/issues/368). It also adds documentation clarifications for [#541](https://github.com/softprops/action-gh-release/issues/541), [#645](https://github.com/softprops/action-gh-release/issues/645), [#542](https://github.com/softprops/action-gh-release/issues/542), [#393](https://github.com/softprops/action-gh-release/issues/393), and [#411](https://github.com/softprops/action-gh-release/issues/411), where the current behavior is either usage-sensitive or constrained by GitHub platform limits rather than an action-side runtime bug.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

2.5.3

2.5.3 is a patch release focused on the remaining path-handling and release-selection bugs uncovered after 2.5.2. It fixes [#639](https://github.com/softprops/action-gh-release/issues/639), [#571](https://github.com/softprops/action-gh-release/issues/571), [#280](https://github.com/softprops/action-gh-release/issues/280), [#614](https://github.com/softprops/action-gh-release/issues/614), [#311](https://github.com/softprops/action-gh-release/issues/311), [#403](https://github.com/softprops/action-gh-release/issues/403), and [#368](https://github.com/softprops/action-gh-release/issues/368). It also adds documentation clarifications for [#541](https://github.com/softprops/action-gh-release/issues/541), [#645](https://github.com/softprops/action-gh-release/issues/645), [#542](https://github.com/softprops/action-gh-release/issues/542), [#393](https://github.com/softprops/action-gh-release/issues/393), and [#411](https://github.com/softprops/action-gh-release/issues/411), where the current behavior is either usage-sensitive or constrained by GitHub platform limits rather than an action-side runtime bug.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group across 1 directory with 7 updates
12da6b1 
Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6` | `7` |
| [EndBug/add-and-commit](https://github.com/endbug/add-and-commit) | `9.1.4` | `10.0.0` |
| [ssciwr/doxygen-install](https://github.com/ssciwr/doxygen-install) | `1` | `2` |
| [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) | `1.0.0` | `1.2.0` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `5` | `6` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.5.0` | `2.6.1` |



Updates `actions/download-artifact` from 7.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@37930b1...3e5f45b)

Updates `actions/upload-artifact` from 6 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v6...v7)

Updates `EndBug/add-and-commit` from 9.1.4 to 10.0.0
- [Release notes](https://github.com/endbug/add-and-commit/releases)
- [Commits](EndBug/add-and-commit@a94899b...290ea2c)

Updates `ssciwr/doxygen-install` from 1 to 2
- [Release notes](https://github.com/ssciwr/doxygen-install/releases)
- [Commits](ssciwr/doxygen-install@v1...v2)

Updates `azure/trusted-signing-action` from 1.0.0 to 1.2.0
- [Release notes](https://github.com/azure/trusted-signing-action/releases)
- [Commits](Azure/artifact-signing-action@v1.0.0...v1.2.0)

Updates `aws-actions/configure-aws-credentials` from 5 to 6
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@v5...v6)

Updates `softprops/action-gh-release` from 2.5.0 to 2.6.1
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2.5.0...v2.6.1)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: EndBug/add-and-commit
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: ssciwr/doxygen-install
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: azure/trusted-signing-action
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 1, 2026
@lrknox lrknox merged commit 2e2d26a into master Apr 1, 2026
57 checks passed
@dependabot dependabot Bot deleted the dependabot/github_actions/github-actions-d7ef2cb3e6 branch April 1, 2026 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lrknox lrknox lrknox approved these changes

@derobins derobins Awaiting requested review from derobins derobins is a code owner

@byrnHDF byrnHDF Awaiting requested review from byrnHDF byrnHDF is a code owner

@fortnern fortnern Awaiting requested review from fortnern fortnern is a code owner

@jhendersonHDF jhendersonHDF Awaiting requested review from jhendersonHDF jhendersonHDF is a code owner

@vchoi-hdfgroup vchoi-hdfgroup Awaiting requested review from vchoi-hdfgroup vchoi-hdfgroup is a code owner

@bmribler bmribler Awaiting requested review from bmribler bmribler is a code owner

@glennsong09 glennsong09 Awaiting requested review from glennsong09 glennsong09 is a code owner

@mattjala mattjala Awaiting requested review from mattjala mattjala is a code owner

@brtnfld brtnfld Awaiting requested review from brtnfld brtnfld is a code owner

@schwehr schwehr Awaiting requested review from schwehr schwehr is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lrknox