Update github-actions by renovate[bot] · Pull Request #14857 · phpstan/phpstan

renovate · 2026-06-22T02:11:03Z

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	minor	`v5.0.5` → `v5.1.0`
actions/checkout	action	minor	`v6.0.3` → `v6.1.0`
actions/setup-node	action	minor	`v6.4.0` → `v6.5.0`
astral-sh/setup-uv	action	minor	`v8.2.0` → `v8.3.2`
aws-actions/configure-aws-credentials	action	patch	`v6.2.0` → `v6.2.3`
cbrgm/mastodon-github-action	action	patch	`v2.2.1` → `v2.2.2`
crate-ci/typos	action	minor	`v1.47.2` → `v1.48.0`
docker/build-push-action	action	minor	`v7.2.0` → `v7.3.0`
docker/login-action	action	minor	`v4.2.0` → `v4.6.0`
docker/setup-buildx-action	action	minor	`v4.1.0` → `v4.2.0`
docker/setup-qemu-action	action	minor	`v4.1.0` → `v4.2.0`
github/codeql-action	action	minor	`v4.36.2` → `v4.37.4`
softprops/action-gh-release	action	patch	`v3.0.0` → `v3.0.2`
stefanzweifel/git-auto-commit-action	action	minor	`v7.1.0` → `v7.2.0`
step-security/harden-runner	action	minor	`v2.19.4` → `v2.20.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/cache (actions/cache)

`v5.1.0`

Compare Source

What's Changed

Bump @actions/cache to v5.1.0 - handle read-only cache access by @jasongin in #1775

Full Changelog: actions/cache@v5...v5.1.0

actions/checkout (actions/checkout)

`v6.1.0`

Compare Source

actions/setup-node (actions/setup-node)

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

astral-sh/setup-uv (astral-sh/setup-uv)

aws-actions/configure-aws-credentials (aws-actions/configure-aws-credentials)

`v6.2.3`

Compare Source

`v6.2.2`

Compare Source

`v6.2.2`

Compare Source

Miscellaneous Chores

release 6.2.2 (d01d678)

`v6.2.1`

Compare Source

Bug Fixes

enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

cbrgm/mastodon-github-action (cbrgm/mastodon-github-action)

`v2.2.2`

Compare Source

What's Changed

patch(deps): update patch versions to v1.26.4 by @renovate[bot] in #228
chore(deps): update docker digests to v3.24 by @renovate[bot] in #229
ci(tools): update build tools to v1.9.0 by @renovate[bot] in #230
ci(tools): update build tools to v7 by @renovate[bot] in #231
ci(tools): update build tools by @renovate[bot] in #232

Full Changelog: cbrgm/mastodon-github-action@v2...v2.2.2

crate-ci/typos (crate-ci/typos)

`v1.48.0`

Compare Source

[1.48.0] - 2026-06-30

Features

Updated the dictionary with the June 2026 changes

docker/build-push-action (docker/build-push-action)

`v7.3.0`

Compare Source

docker/login-action (docker/login-action)

`v4.6.0`

Compare Source

`v4.5.2`

Compare Source

`v4.5.1`

Compare Source

`v4.5.0`

Compare Source

`v4.4.0`

Compare Source

`v4.3.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #1022
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 #999 #1030
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #1004 #1027
Bump @sigstore/core from 3.1.0 to 3.2.1 in #1023
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #1029
Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #1017
Bump js-yaml from 4.1.1 to 5.2.0 in #1028
Bump sigstore from 4.1.0 to 4.1.1 in #1031
Bump tmp from 0.2.5 to 0.2.7 in #1002
Bump undici from 6.24.1 to 6.27.0 in #1020
Bump vite from 7.3.3 to 7.3.6 in #1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

docker/setup-buildx-action (docker/setup-buildx-action)

`v4.2.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #572
Bump @actions/core from 3.0.0 to 3.0.1 in #551
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #557 #580
Bump @sigstore/core from 3.1.0 to 3.2.1 in #573
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #576
Bump js-yaml from 4.1.1 to 5.2.0 in #562
Bump sigstore from 4.1.0 to 4.1.1 in #577
Bump tmp from 0.2.5 to 0.2.7 in #556
Bump undici from 6.25.0 to 6.27.0 in #570
Bump vite from 7.3.2 to 7.3.6 in #569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

docker/setup-qemu-action (docker/setup-qemu-action)

`v4.2.0`

Compare Source

github/codeql-action (github/codeql-action)

`v4.37.4`

Compare Source

`v4.37.3`

Compare Source

No user facing changes.

`v4.37.2`

Compare Source

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

`v4.37.1`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019

`v4.37.0`

Compare Source

Update default CodeQL bundle version to 2.26.0. #3995
In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

`v4.36.3`

Compare Source

No user facing changes.

softprops/action-gh-release (softprops/action-gh-release)

`v3.0.2`

Compare Source

3.0.2 is a patch release focused on release reliability and compatibility. It
reuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the
historical failure reported in #790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #786 and does not
claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

feat: improve release error reporting and test coverage by @chenrui333 in #813

Bug fixes 🐛

fix: publish existing draft releases as prereleases by @godfengliang in #801
fix: upload small checksum assets reliably by @chenrui333 in #815
fix: replace existing release assets on Gitea by @chenrui333 in #816
fix: clarify release creation 404 errors by @chenrui333 in #817

Other Changes 🔄

chore(deps): upgrade TypeScript to 7 by @chenrui333 in #812
chore(deps): remove unused TypeScript tooling by @chenrui333 in #814
dependency, Node 24 pin, and CI maintenance merged since 3.0.1

`v3.0.1`

Compare Source

3.0.1

maintenance release with updated dependencies

stefanzweifel/git-auto-commit-action (stefanzweifel/git-auto-commit-action)

`v7.2.0`

Compare Source

Added

Add hooks to run shell snippets around git operations (#411) @stefanzweifel
Emit warning for pull_request_target trigger usage (#410) @stefanzweifel

Fixed

docs(action): fix input and output descriptions in action.yml (#406) @kranthipoturaju
docs: fix typos, grammar, and formatting across markdown files (#408) @kranthipoturaju
docs: fix broken and redirecting URLs in README.md (#407) @kranthipoturaju
README: clearify meaning of the repository field (#404) @gucio321

Dependency Updates

Bump actions/checkout from 6 to 7 (#409) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))
Bump release-drafter/release-drafter from 6 to 7 (#403) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

step-security/harden-runner (step-security/harden-runner)

`v2.20.0`

Compare Source

What's Changed

Support for block policy for MacOS and Windows GitHub-hosted runners
Support for Bitrise MacOS GitHub Actions runners
HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


      - name: "Create release"
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1



      - name: "Commit changes"
-        uses: "stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9" # v7.1.0
+        uses: "stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d" # v7.2.0



      - name: "Commit changes"
-        uses: "stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9" # v7.1.0
+        uses: "stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d" # v7.2.0



      - name: "Check for typos"
-        uses: "crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89" # v1.47.2
+        uses: "crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14" # v1.48.0


          egress-policy: audit

-      - uses: cbrgm/mastodon-github-action@244bbe72e61b4490e2dc1c34f9537ae9299ae601 # v2.2.1
+      - uses: cbrgm/mastodon-github-action@ac2d8e8c9986a17b824dd12dd9df4ce5fcd813c1 # v2.2.2



      - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0



      - name: "Install Node"
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0


          egress-policy: audit

-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0


          egress-policy: audit

-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0


staabm · 2026-07-22T07:21:59Z

I will not touch this PR, as it might have an impact on playground or other "production"-used PHPStan resources, I cannot foresee

github-advanced-security AI found potential problems Jun 22, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

- name: "Create release"

uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0

uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1

renovate Bot changed the title ~~Update github-actions to v3.0.1~~ Update github-actions Jun 22, 2026

renovate Bot changed the title ~~Update github-actions~~ Update softprops/action-gh-release action to v3.0.1 Jun 25, 2026

renovate Bot force-pushed the renovate/github-actions branch from 85166c1 to e8e2391 Compare June 26, 2026 23:49

renovate Bot changed the title ~~Update softprops/action-gh-release action to v3.0.1~~ Update github-actions Jun 26, 2026

renovate Bot force-pushed the renovate/github-actions branch from e8e2391 to 3cabc05 Compare June 28, 2026 10:07

github-advanced-security AI found potential problems Jun 28, 2026

View reviewed changes

renovate Bot force-pushed the renovate/github-actions branch from 3cabc05 to 692fbce Compare June 30, 2026 19:16

github-advanced-security AI found potential problems Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/spelling.yml

- name: "Check for typos"

uses: "crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89" # v1.47.2

uses: "crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14" # v1.48.0

renovate Bot force-pushed the renovate/github-actions branch from 692fbce to 1e8b06a Compare July 1, 2026 23:43

github-advanced-security AI found potential problems Jul 1, 2026

View reviewed changes

Comment thread .github/workflows/release-toot.yml

egress-policy: audit

- uses: cbrgm/mastodon-github-action@244bbe72e61b4490e2dc1c34f9537ae9299ae601 # v2.2.1

- uses: cbrgm/mastodon-github-action@ac2d8e8c9986a17b824dd12dd9df4ce5fcd813c1 # v2.2.2

renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from 0a748d8 to c625065 Compare July 5, 2026 10:54

github-advanced-security AI found potential problems Jul 5, 2026

View reviewed changes

Comment thread .github/workflows/lint-workflows.yml Outdated

- name: Install the latest version of uv

uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0

uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0

renovate Bot force-pushed the renovate/github-actions branch 5 times, most recently from 5880ef5 to 1b25ed9 Compare July 14, 2026 04:31

github-advanced-security AI found potential problems Jul 14, 2026

View reviewed changes

Comment thread .github/workflows/integration-tests.yml

- name: "Install Node"

uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0

renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from 982e9e4 to e237806 Compare July 20, 2026 19:15

github-advanced-security AI found potential problems Jul 20, 2026

View reviewed changes

renovate Bot force-pushed the renovate/github-actions branch 2 times, most recently from a2fefc0 to 81bfcf9 Compare July 22, 2026 06:54

staabm assigned ondrejmirtes Jul 22, 2026

renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from 01dc593 to dac7a8a Compare July 28, 2026 08:59

renovate Bot force-pushed the renovate/github-actions branch from dac7a8a to 4233d98 Compare July 30, 2026 08:07

Update github-actions

d1b0b80

renovate Bot force-pushed the renovate/github-actions branch from 4233d98 to d1b0b80 Compare July 30, 2026 17:51

ondrejmirtes merged commit ce14fbf into 2.2.x Jul 30, 2026
323 of 325 checks passed

ondrejmirtes deleted the renovate/github-actions branch July 30, 2026 18:57

Navigation Menu

Uh oh!

Uh oh!

Update github-actions - #14857

Update github-actions#14857
ondrejmirtes merged 1 commit into
2.2.xfrom
renovate/github-actions

renovate Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

staabm commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

Miscellaneous Chores

Bug Fixes

What's Changed

[1.48.0] - 2026-06-30

Features

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

3.0.1

Added

Fixed

Dependency Updates

What's Changed

Configuration

Uh oh!

staabm commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

renovate Bot commented Jun 22, 2026 •

edited

Loading