Skip to content

chore(deps): update all dependencies (major)#141

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-all
Open

chore(deps): update all dependencies (major)#141
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-all

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 1, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/attest-build-provenance action major v1v4
actions/checkout action major v4v6
actions/download-artifact action major v4v8
actions/upload-artifact action major v4v7
codecov/codecov-action action major v4v6
vergen build-dependencies major 8.2.69.0.0

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.1.0

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.0.0...v4.1.0

v4.0.0

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v3.2.0...v4.0.0

v4

Compare Source

v3.2.0

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v3.1.0...v3.2.0

v3.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/attest-build-provenance@v3...v3.1.0

v3

Compare Source

v3.0.0

Compare Source

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/attest-build-provenance@v2.4.0...v3.0.0

v2.4.0

Compare Source

What's Changed
  • Bump undici from 5.28.5 to 5.29.0 by @​dependabot in #​633
  • Bump actions/attest from 2.3.0 to 2.4.0 by @​bdehamer in #​654
    • Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run

Full Changelog: actions/attest-build-provenance@v2.3.0...v2.4.0

v2.3.0

Compare Source

What's Changed
  • Bump actions/attest from 2.2.1 to 2.3.0 by @​bdehamer in #​615
    • Updates @sigstore/oci from 0.4.0 to 0.5.0

Full Changelog: actions/attest-build-provenance@v2.2.3...v2.3.0

v2.2.3

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.2...v2.2.3

v2.2.2

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.1...v2.2.2

v2.2.1

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Changed

  • Bump actions/attest from v2.1.0 to v2.2.0 by @​bdehamer in #​449
    • Includes support for now subject-checksums input parameter

Full Changelog: actions/attest-build-provenance@v2.1.0...v2.2.0

v2.1.0

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.0.1...v2.1.0

v2.0.1

Compare Source

What's Changed

  • Bump actions/attest from 2.0.0 to 2.0.1 by @​bdehamer in #​406
    • Deduplicate subjects before adding to in-toto statement

Full Changelog: actions/attest-build-provenance@v2.0.0...v2.0.1

v2.0.0

Compare Source

The attest-build-provenance action now supports attesting multiple subjects simultaneously. When identifying multiple subjects with the subject-path input a single attestation is created with references to each of the supplied subjects, rather than generating separate attestations for each artifact. This reduces the number of attestations that you need to create and manage.

What's Changed

Full Changelog: actions/attest-build-provenance@v1.4.4...v2.0.0

v2

Compare Source

v1.4.4

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v1.4.3...v1.4.4

v1.4.3

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v1.4.2...v1.4.3

v1.4.2

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v1.4.1...v1.4.2

v1.4.1

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v1.4.0...v1.4.1

v1.4.0

Compare Source

What's Changed
  • Bump predicate action from 1.1.0 to 1.1.1 by @​bdehamer in #​182
    • Fix for JWKS proxy bug
  • Bump actions/attest from 1.3.3 to 1.4.0 by @​bdehamer in #​183
    • Add show-summary input
    • Format summary output as list

Full Changelog: actions/attest-build-provenance@v1.3.3...v1.4.0

v1.3.3

Compare Source

What's Changed
  • Bump actions/attest from 1.3.2 to 1.3.3 by @​bdehamer in #​152
    • Bugfix for properly handling glob exclusion patterns in subject-path input

Full Changelog: actions/attest-build-provenance@v1.3.2...v1.3.3

v1.3.2

Compare Source

What's Changed
  • Bump actions/attest from 1.3.1 to 1.3.2 by @​bdehamer in #​123
    • Increase timeout for OCI operations

Full Changelog: actions/attest-build-provenance@v1.3.1...v1.3.2

v1.3.1

Compare Source

What's Changed
  • Bump actions/attest from 1.3.0 to 1.3.1 by @​bdehamer in #​117
    • Bugfix when detecting support for the referrers API with OCI registries

Full Changelog: actions/attest-build-provenance@v1.3.0...v1.3.1

v1.3.0

Compare Source

What's Changed
  • Bump actions/attest-build-provenance/predicate from 1.0.0 to 1.1.0 by @​bdehamer in #​116
  • Bump actions/attest from 1.2.0 to 1.3.0 by @​bdehamer in #​116
    • Dynamic construction of GitHub API URLs based on GITHUB_SERVER_URL
    • Improved handling of Rekor 409 responses
    • Bugfix - detection of registries with support for the OCI referrers API

Full Changelog: actions/attest-build-provenance@v1.2.0...v1.3.0

v1.2.0

Compare Source

What's Changed
  • Bump actions/attest from 1.1.2 to 1.2.0 by @​bdehamer in #​101
    • Batch processing w/ exponential backoff
    • Bugfix when pushing attestation to OCI registry

Full Changelog: actions/attest-build-provenance@v1.1.2...v1.2.0

v1.1.2

Compare Source

What's Changed
  • Bump actions/attest from 1.1.1 to 1.1.2 by @​bdehamer in #​79
    • Downcase subject name for OCI images
    • Fix accept header when retrieving image manifest
    • Support variants of the Docker Hub registry name

Full Changelog: actions/attest-build-provenance@v1.1.1...v1.1.2

v1.1.1

Compare Source

What's Changed
  • Bump actions/attest from v1.1.0 to v1.1.1 by @​bdehamer in #​67
    • Bump @​sigstore/sign from 2.3.0 to 2.3.1
    • Bump @​sigstore/oci from 0.3.0 to 0.3.2
    • Include more detail in error logging
    • Send API errors to GHA debug log
    • Fix bug preventing failed API requests from being retried

Full Changelog: actions/attest-build-provenance@v1.1.0...v1.1.1

v1.1.0

Compare Source

What's Changed
  • Bump actions/attest to v1.1.0 by @​bdehamer in #​65
    • adds list support for subjectPath input
    • limit attestation subject count
    • ensure subject globs match only files

Full Changelog: actions/attest-build-provenance@v1.0.0...v1.1.0

actions/checkout (actions/checkout)

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v6

Compare Source

v5.0.1

Compare Source

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

Compare Source

What's Changed
⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v5

Compare Source

v4.3.1

Compare Source

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

Compare Source

v4.2.1

Compare Source

v4.2.0

Compare Source

v4.1.7

Compare Source

v4.1.6

Compare Source

v4.1.5

Compare Source

v4.1.4

Compare Source

v4.1.3

Compare Source

v4.1.2

Compare Source

  • Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in #​1598

v4.1.1

Compare Source

v4.1.0

Compare Source

actions/download-artifact (actions/download-artifact)

v8.0.1

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

Compare Source

v8 - What's new
Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to false.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @​actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v8

Compare Source

v7

Compare Source

v7.0.0

Compare Source

v7 - What's new

[!IMPORTANT]
actions/download-artifact@​v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed
New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6

Compare Source

v6.0.0

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/download-artifact@v5...v6.0.0

v5

Compare Source

v5.0.0

Compare Source

What's Changed

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

  • By name: name: my-artifact → extracted to path/ (direct)
  • By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

  • By name: name: my-artifact → extracted to path/ (unchanged)
  • By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)
Migration Guide
✅ No Action Needed If:
  • You download artifacts by name
  • You download multiple artifacts by ID
  • You already use merge-multiple: true as a workaround
⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist

### Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

- uses: actions/download-artifact@v5
  with:
    artifact-ids: 12345
    path: dist/my-artifact  # Explicitly specify the nested path

New Contributors

Full Changelog: actions/download-artifact@v4...v5.0.0

v4.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v4.2.1...v4.3.0

v4.2.1

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v4.2.0...v4.2.1

v4.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v4.1.9...v4.2.0

v4.1.9

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v4.1.8...v4.1.9

v4.1.8

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v4.1.7...v4.1.8

v4.1.7

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v4.1.6...v4.1.7

v4.1.6

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v4.1.5...v4.1.6

v4.1.5

Compare Source

What's Changed

  • Update readme with v3/v2/v1 deprecation notice by @​robherley in #​322
  • Update dependencies @actions/core to v1.10.1 and @actions/artifact to v2.1.5

Full Changelog: actions/download-artifact@v4.1.4...v4.1.5

v4.1.4

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v4...v4.1.4

v4.1.3

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v4...v4.1.3

v4.1.2

Compare Source

v4.1.1

Compare Source

  • Fix transient request timeouts #​249
  • Bump @actions/artifacts to latest version

v4.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v4...v4.1.0

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed
  • Update the readme with direct upload details by [@​danwkennedy](https://redirec

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented May 1, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock
Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --workspace
    Updating crates.io index
error: failed to select a version for `vergen`.
    ... required by package `famedly-sync v0.11.1 (/tmp/renovate/repos/github/famedly/famedly-sync)`
versions that meet the requirements `^9.0.0` are: 9.1.0, 9.0.6, 9.0.4, 9.0.3, 9.0.2, 9.0.1, 9.0.0

package `famedly-sync` depends on `vergen` with feature `git` but `vergen` does not have that feature.
 package `vergen` does have feature `si`


failed to select a version for `vergen` which could resolve this conflict

@renovate renovate Bot requested a review from a team as a code owner May 1, 2025 02:41
@renovate renovate Bot force-pushed the renovate/major-all branch from 5c7c430 to 06b68fb Compare May 12, 2025 09:22
@renovate renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from aa685af to dd89f31 Compare July 21, 2025 13:26
@renovate renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from d347a19 to 5281ea1 Compare August 6, 2025 19:05
@renovate renovate Bot force-pushed the renovate/major-all branch from 5281ea1 to 2c73305 Compare August 11, 2025 14:05
@renovate renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from 55bed31 to c36fe9b Compare August 20, 2025 17:46
@renovate renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from b76d3cf to 2974886 Compare September 4, 2025 17:14
@renovate renovate Bot force-pushed the renovate/major-all branch from 2974886 to 4981b4c Compare October 24, 2025 23:02
@renovate renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from d7e6fd5 to 65ce035 Compare November 20, 2025 18:33
@renovate renovate Bot force-pushed the renovate/major-all branch from 65ce035 to 3d627e3 Compare December 2, 2025 17:46
@renovate renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from dfff626 to 3067152 Compare December 16, 2025 08:31
@renovate renovate Bot force-pushed the renovate/major-all branch from 3067152 to a168a22 Compare December 17, 2025 09:22
@renovate renovate Bot force-pushed the renovate/major-all branch from a168a22 to 264fbe0 Compare February 3, 2026 17:01
@renovate renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from f08049f to 09ea8f8 Compare February 27, 2026 02:17
@renovate renovate Bot force-pushed the renovate/major-all branch from 09ea8f8 to 8080d07 Compare March 11, 2026 19:06
Copy link
Copy Markdown

@linearb linearb Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✨ PR Review

LGTM

Generated by LinearB AI and added by gitStream.
AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how

@linearb linearb Bot added the 1 min review label Mar 15, 2026
@renovate renovate Bot force-pushed the renovate/major-all branch from 8080d07 to 64cfdd2 Compare March 18, 2026 20:42
@renovate renovate Bot force-pushed the renovate/major-all branch from 64cfdd2 to da5b617 Compare March 26, 2026 16:47
@renovate renovate Bot force-pushed the renovate/major-all branch from da5b617 to e194c58 Compare April 10, 2026 21:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants