Skip to content

chore(deps): update github-actions (major) - #113

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions
Open

chore(deps): update github-actions (major)#113
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
actions/checkout action major v5 → v7 age confidence
actions/setup-node action major v6 → v7 age confidence
marocchino/sticky-pull-request-comment action major v2 → v3.0.5 age confidence
pnpm (source) uses-with major 10.33.4 → 12.16.1 age confidence
pnpm/action-setup action major v2 → v6 v6.1.1 age confidence
pnpm/action-setup action major v4 → v6 v6.1.1 age confidence

Release Notes

actions/checkout

v7.0.1

Compare Source

v7.0.0

Compare Source

  • Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
  • Various dependency updates

v6.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v5.0.1...v5.1.0

v5.0.1

Compare Source

actions/setup-node

v7.1.0

Compare Source

What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

v7.0.0

Compare Source

What's Changed

Enhancements:
Bug fixes:
Documentation updates:
Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

Compare Source

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

Compare Source

What's Changed
Dependency updates:
New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

Compare Source

What's Changed
Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:
Bug fixes:
New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

What's Changed

Documentation
Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

Compare Source

What's Changed

Enhancement:
Dependency updates:
Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

marocchino/sticky-pull-request-comment

v3.0.5

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.4...v3.0.5

v3.0.4

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.3...v3.0.4

v3.0.3

Compare Source

What's Changed

New Contributors

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.2...v3.0.3

v3.0.2

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.1...v3.0.2

v3.0.1

Compare Source

What's Changed

  • Update deps
  • Change build system from ncc to rollup
  • Use pull_request trigger in github action

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.0...v3.0.1

v3.0.0

Compare Source

What's Changed

  • Update node to 24
  • Update deps

New Contributors

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.4...v3.0.0

v2.9.4

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.3...v2.9.4

v2.9.3

Compare Source

What's Changed

  • Update deps (including security issues)
  • Test with vitest instead of jest
  • Use biome

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.2...v2.9.3

v2.9.2

Compare Source

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.1...v2.9.2

v2.9.1

Compare Source

What's Changed
New Contributors

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.0...v2.9.1

v2.9.0

Compare Source

  • Update deps
  • Use node 20

v2.8.0

Compare Source

  • Add skip_unchanged input
  • Update deps

v2.7.0

Compare Source

Update deps.
Add two output.

  • previous_comment_id: "ID of previous comment, if found"
  • created_comment_id: "ID of newly created comment, if any"

v2.6.2

Compare Source

Reverted changes in version 2.6. As a result, the base_url has been removed.

v2.6.1

Compare Source

Change base_url default to ${{ env.GITHUB_API_URL }}

v2.6.0

Compare Source

v2.5.0

Compare Source

  • Update deps
  • Add only_update option.
  • Add owner option.

v2.4.0

Compare Source

  • Update deps
  • Add only_create option.

v2.3.1

Compare Source

  • Update deps
  • Change ignore empty default from true to false (This change will fix bug delete or hide comment not works)

v2.3.0

Compare Source

  • Support glob path
  • Add follow_symbolic_links for path
  • Add ignore_empty for skip empty body
  • Update README for new output syntax

v2.2.1: Update deps

Compare Source

  • Use node 16
  • Update npm deps

v2.2.0

Compare Source

Add hide, hide_details, hide_and_recreate, hide_classsify options

v2.1.1

Compare Source

v2.1.0: Set GitHub token by default

Compare Source

Features
Bug fix
  • Fix unexpected delete fail #​226
  • Convert buffer to string when file read #​202
  • Fix boolean handling #​215
pnpm/pnpm (pnpm)

v12.16.1: pnpm 12.16.1

Compare Source

This release fixes pnpm install hanging on a cold store in workspaces that install Cargo crates, and pnpm pack shipping a file that files excludes by name.

Patch Changes

  • pnpm install no longer hangs on a cold store in a workspace that also installs Cargo crates or a Rust toolchain.

  • pnpm pack and pnpm publish now apply a files entry that names a file after the glob and directory entries, as npm does. A file excluded by name, such as !dist/index.js, stays out even when a later dist/** matches it. A file named by its path, such as lib/secret.js, ships even when a later !lib/*.js matches it.

  • pnpm install no longer leaves a broken symlink in an injected workspace dependency when the package links to a file outside its published files and pnpm imports by hardlink. Installing a git dependency now skips internal directory symlinks when importing its files into the store.

  • pnpm install now relinks a command that a workspace project renames into the projects that depend on it when sharedWorkspaceLockfile is false pnpm/tasks#224.

  • pnpm install and pnpm rebuild now refresh privately hoisted .bin shims in node_modules/.pnpm/node_modules/.bin after a dependency build replaces a script target with a native executable #​17402.

  • pnpm install now reads a package's manifest to decide its peer dependencies when it updates an existing lockfile, as it does when it resolves from scratch.

  • Commands, pnpm --version, pnpm self-update, and invocations with unknown flags now apply the same packageManager and devEngines.packageManager settings when switching to the pinned pnpm version or recording it in pnpm-lock.yaml. --config.<key> flags and lockfileDir now reach the version switch and lockfile sync on every entry point. Unreadable settings in pnpm-workspace.yaml or the global config.yaml that do not affect the pin decision no longer block the version switch pnpm/tasks#222.

  • pnpm now accepts the --cache-dir <dir> flag, as in pnpm install --cache-dir /tmp/pnpm-cache #​17422.

  • When the version or range given to pnpm unpublish matches every published version, the error now says so and shows the same command with --force. Before, the error suggested running pnpm unpublish <pkg>@<version>, the command that had just failed.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.16.0: pnpm 12.16

Compare Source

This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.

Minor Changes

  • Added a repeatable global --env-file <path> flag to load environment variables from dotenv-style files before running a command. Later files override earlier files, variables already in the environment are preserved, and loaded variables are visible to user-level .npmrc interpolation and lifecycle scripts #​7111.

  • pnpm can now update a pnpm-lock.yaml that is a symlink. List the directories the lockfile may link into in the symlinkedLockfileTargetDirs setting, in the global config or with PNPM_CONFIG_SYMLINKED_LOCKFILE_TARGET_DIRS. pnpm writes the update to the file the symlink points to if that file is inside one of these directories. The symlink stays in place. pnpm ignores this setting in pnpm-workspace.yaml #​17222.

  • Added a --no-modify-path option to pnpm setup. It installs pnpm without adding it to PATH, leaving the shell config file, the Windows registry, and the GitHub Actions environment files unchanged. pnpm setup then prints the lines to add yourself get.pnpm.io#37.

Patch Changes
Security

  • Fixed memory exposure and allocation handling vulnerabilities when processing zstd-compressed data #​17388.

  • Signing in pnpm and pnpr no longer uses arithmetic that may leak the private key through timing. This covers shared artifacts, OCI registry tokens, and OIDC login state advisory.

Installing packages

  • A dependency symlink that pnpm cannot point at the wanted target now fails the install with an error that names the link. This happens when the filesystem still serves the old link after pnpm removed it, as a node_modules served by a virtual filesystem does. pnpm used to remove the link again without end and crashed with a segmentation fault once the thread ran out of stack.

  • Concurrent workspace installs no longer lose store-index rows when initializing the shared SQLite index #​17388.

  • Agent skill links now keep the same target across installs when a package version is installed with several sets of peer dependencies. An install no longer fails wi

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 2am and before 3am"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 4 times, most recently from 41c60df to 49aa220 Compare August 6, 2026 18:06
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from c27f8af to 9bd694c Compare August 18, 2026 17:41
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 3 times, most recently from b9b0e87 to 6944f59 Compare September 1, 2026 18:36
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 7 times, most recently from 62017e2 to 739751c Compare September 11, 2026 17:03
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from 0fc8bc2 to 7181b95 Compare September 18, 2026 21:04
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 3 times, most recently from ec00f47 to 20c334d Compare September 25, 2026 18:51
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 5 times, most recently from 3278423 to cae92d1 Compare October 6, 2026 02:59
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 4 times, most recently from 0ce31e2 to 7f6b94e Compare October 12, 2026 10:32
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 4 times, most recently from 48a1104 to c85e441 Compare October 18, 2026 17:02
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from 4fcac50 to 7f74e28 Compare October 30, 2026 02:25
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 7f74e28 to ea6cde4 Compare October 30, 2026 18:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants