Build(deps): bump the github-actions group across 1 directory with 12 updates

[dependabot]

Updates the requirements on actions/checkout, messense/maturin-action, docker/setup-qemu-action, actions/upload-artifact, actions/setup-python, astral-sh/setup-uv, leynos/shared-actions/.github/actions/setup-rust, leynos/shared-actions/.github/actions/generate-coverage, leynos/shared-actions/.github/actions/upload-codescene-coverage, leynos/shared-actions/.github/workflows/dependabot-automerge.yml, actions/github-script and leynos/shared-actions/.github/workflows/mutation-mutmut.yml to permit the latest version.
Updates actions/checkout from 4.3.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates messense/maturin-action from 47fbb7acd3db01f7830330b50689bd15135c12b9 to f0a989e78b427215a87ce3021f5a90507cae75fb

Commits

• f0a989e Update versions-manifest.json (#467)
• 9973fcc Bump js-yaml from 4.2.0 to 4.3.1 (#466)
• 865dfb9 Bump brace-expansion (#465)
• 6369ccd Bump actions/setup-python from 6.2.0 to 6.3.0 (#459)
• 8d2adb8 Bump actions/checkout from 6.0.3 to 7.0.0 (#458)
• acb7a3c Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#457)
• b60def4 Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#456)
• f05c656 Bump js-yaml from 4.1.1 to 4.2.0 (#455)
• 25b9305 Fix stable ABI guidance to match pyo3/maturin3 (#453)
• d60b6a6 Update versions-manifest.json (#454)
• Additional commits viewable in compare view

Updates docker/setup-qemu-action from 45136fd328ae20ed788d00d3bada68ab496c214c to 288220e341e5c445ddb6d73e19a57a9012ceca88

Commits

• 288220e Merge pull request #322 from crazy-max/group-codeql-dependabot-updates
• 48615d7 chore: group codeql dependabot updates
• 9701c2d Merge pull request #319 from docker/dependabot/github_actions/docker/bake-act...
• efc0de3 Merge pull request #318 from docker/dependabot/github_actions/docker/bake-act...
• 5ebf4ce Merge pull request #316 from docker/dependabot/npm_and_yarn/sigstore/verify-3...
• fd038d3 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
• c89f892 build(deps): bump docker/bake-action/subaction/matrix
• 9130712 build(deps): bump @​sigstore/verify from 3.1.0 to 3.1.1
• 96fe6ef Merge pull request #315 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 31f08d3 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

• Update the readme with direct upload details by @​danwkennedy in actions/upload-artifact#795
• Readme: bump all the example versions to v7 by @​danwkennedy in actions/upload-artifact#796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in actions/upload-artifact#754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in actions/upload-artifact#762
• Support direct file uploads by @​danwkennedy in actions/upload-artifact#764

New Contributors

• @​Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Upload Artifact Node 24 support by @​salmanmkc in actions/upload-artifact#719
• fix: update @​actions/artifact for Node.js 24 punycode deprecation by @​salmanmkc in actions/upload-artifact#744
• prepare release v6.0.0 for Node.js 24 support by @​salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• bbbca2d Support direct file uploads (#764)
• 589182c Upgrade the module to ESM and bump dependencies (#762)
• 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
• 02a8460 Add proxy integration test
• b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
• e516bc8 docs: correct description of Node.js 24 support in README
• Additional commits viewable in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-python#1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in actions/setup-python#1338
• Remove the pip-install input by @​gowridurgad in actions/setup-python#1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in actions/setup-python#1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in actions/setup-python#1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in actions/setup-python#1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in actions/setup-python#1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-python#1337

New Contributors

• @​lmvysakh made their first contribution in actions/setup-python#1335
• @​philip-gai made their first contribution in actions/setup-python#1337

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

• 5fda3b9 Pin SHA commits and update docs with latest versions (#1338)
• 4ab7e95 Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-0
• 0f3a009 Remove the pip-install input (#1336)
• f8cf429 Migrate to ESM and upgrade dependencies (#1330)
• 54baeea Validate and retry manifest fetch to prevent silent failures (#1332)
• c709277 Annotation code fix (#1335)
• 6849080 remove EOL Python versions and Bumps numpy text fixture (#1333)
• 0903b46 Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)
• See full diff in compare view

Updates astral-sh/setup-uv from 8.3.1 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

• 20cfd1b chore: update known checksums for 0.12.4 (#1017)
• d73a0ca Tolerate transient manifest timeouts (#1016)
• ae3b92d docs: update version references to v10.0.0 (#1014)
• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/actions/setup-rust to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• See full diff in compare view

Updates leynos/shared-actions/.github/actions/generate-coverage from 4977418856133491c6aa7407d40668744df21818 to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/actions/upload-codescene-coverage from 18bed1ca49a6de3d8882bd72635a32ae3f023d57 to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/workflows/dependabot-automerge.yml from 6b9dc1be1b8bfb585ddd0083d50b9d6597cd902e to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

Updates actions/github-script from 8.0.0 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

• getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
• Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

• require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
• getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
• If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

• Add ACTIONS_ORCHESTRATION_ID to user-agent string by @​Copilot in actions/github-script#695
• ci: use deployment: false for integration test environments by @​salmanmkc in actions/github-script#712
• feat!: add getOctokit to script context, upgrade @​actions/github v9, @​octokit/core v7, and related packages by @​salmanmkc in actions/github-script#700

New Contributors

• @​Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits

• 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
• ca10bbd fix: use @​octokit/core/types import for v7 compatibility
• 86e48e2 merge: incorporate main branch changes
• c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
• afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
• ff8117e ci: fix user-agent test to handle orchestration ID
• 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
• 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
• c17d55b ci: add getOctokit integration test job
• a047196 test: add getOctokit integration tests via callAsyncFunction
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/workflows/mutation-mutmut.yml from 6b9dc1be1b8bfb585ddd0083d50b9d6597cd902e to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

[sourcery-ai]

Sorry @dependabot[bot], you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[codescene-access]

No quality gates enabled for this code.