Bump the github-actions group across 1 directory with 6 updates by dependabot[bot] · Pull Request #917 · conda/conda-libmamba-solver

dependabot · 2026-04-20T17:31:41Z

Bumps the github-actions group with 6 updates in the / directory:

Package	From	To
actions/github-script	`8.0.0`	`9.0.0`
actions/upload-pages-artifact	`4.0.0`	`5.0.0`
actions/cache	`5.0.4`	`5.0.5`
actions/upload-artifact	`7.0.0`	`7.0.1`
CodSpeedHQ/action	`4.13.0`	`4.14.0`
peter-evans/create-pull-request	`8.1.0`	`8.1.1`

Updates actions/github-script from 8.0.0 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.

Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.

getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.

If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in actions/github-script#695

ci: use deployment: false for integration test environments by @salmanmkc in actions/github-script#712

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in actions/github-script#700

New Contributors

@Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits

3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
ca10bbd fix: use @octokit/core/types import for v7 compatibility
86e48e2 merge: incorporate main branch changes
c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
ff8117e ci: fix user-agent test to handle orchestration ID
81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
3953caf docs: update README examples from @v8 to @v9, add getOctokit docs and v9 brea...
c17d55b ci: add getOctokit integration test job
a047196 test: add getOctokit integration tests via callAsyncFunction
Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 4.0.0 to 5.0.0

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

Update upload-artifact action to version 7 @Tom-van-Woudenberg (#139)

feat: add include-hidden-files input @jonchurch (#137)

See details of all code changes since previous release.

Commits

fc324d3 Merge pull request #139 from Tom-van-Woudenberg/patch-1
fe9d4b7 Merge branch 'main' into patch-1
0ca1617 Merge pull request #137 from jonchurch/include-hidden-files
57f0e84 Update action.yml
4a90348 v7 --> hash
56f665a Update upload-artifact action to version 7
f7615f5 Add include-hidden-files input
See full diff in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
See full diff in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
See full diff in compare view

Updates CodSpeedHQ/action from 4.13.0 to 4.14.0

Release notes

Sourced from CodSpeedHQ/action's releases.

v4.14.0

Release Notes

We now collect buildtime and runtime environment data to warn users about differences in their runtime environment when comparing two runs against one another.

This data includes toolchain metadata like version and build options, as well as a list of dynamically loaded linked libraries.

Minimum integration versions

To support the runtime metadata collection, make sure to use at least the following versions:

pytest-codspeed v4.4.0

codspeed-rust v4.5.0

codspeed-cpp v2.2.0

codspeed-go v1.1.0

codspeed-node v5.3.0

🚀 Features

Stop panicking when parsing invalid perf file by @GuillaumeLagrange in #298

Make the basic run only 5 rounds to make logs not crash the github page by @GuillaumeLagrange

Represent the host OS as a SupportedOs enum with per-executor support gates by @GuillaumeLagrange

Bypass systemd-run usage on macos by @GuillaumeLagrange

Add aarch64-apple-darwin to the release targets by @GuillaumeLagrange

Collect cpu flags in system info by @GuillaumeLagrange in #281

🐛 Bug Fixes

Fix instropected_go's behavior on macos by @GuillaumeLagrange

Update rust crate git2 to 0.20.4 (#284) by @xtqqczze in #284

⚙️ Internals

chore: bump runner version to 4.14.0 by @github-actions[bot] in CodSpeedHQ/action#203

Move the config schema check from pre-commit to ci-only check by @GuillaumeLagrange in #287

Skip tests that rely on linux behavior by @GuillaumeLagrange

Bump instrument-hooks submodule to include stubs improvement by @GuillaumeLagrange

Rerun exec harness build if instrument hooks sources change by @GuillaumeLagrange

Make update-bindings.sh PWD agnostic by @GuillaumeLagrange

Install codspeed-runner 4.14.0

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.14.0/codspeed-runner-installer.sh | sh
Download codspeed-runner 4.14.0

File Platform Checksum

codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum

codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum

... (truncated)

Commits

658a901 Release v4.14.0 🚀
1d42668 chore: bump runner version to 4.14.0
db35df7 Release v4.13.1 🚀
bc11107 feat: support action-only releases with explicit version argument
12a303d feat: fail release script if version already exists
6e1e277 feat: add dry-run mode to release script
d214727 build(deps)!: update actions to Node.js 24 runtime (#201)
See full diff in compare view

Updates peter-evans/create-pull-request from 8.1.0 to 8.1.1

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.1.1

What's Changed

build(deps-dev): bump the npm group with 2 updates by @dependabot[bot] in peter-evans/create-pull-request#4305

build(deps): bump minimatch by @dependabot[bot] in peter-evans/create-pull-request#4311

build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in peter-evans/create-pull-request#4316

build(deps): bump @tootallnate/once and jest-environment-jsdom by @dependabot[bot] in peter-evans/create-pull-request#4323

build(deps-dev): bump undici from 6.23.0 to 6.24.0 by @dependabot[bot] in peter-evans/create-pull-request#4328

build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in peter-evans/create-pull-request#4334

build(deps): bump picomatch by @dependabot[bot] in peter-evans/create-pull-request#4339

build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in peter-evans/create-pull-request#4344

build(deps-dev): bump the npm group with 3 updates by @dependabot[bot] in peter-evans/create-pull-request#4349

fix: retry post-creation API calls on 422 eventual consistency errors by @peter-evans in peter-evans/create-pull-request#4356

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

Commits

5f6978f fix: retry post-creation API calls on 422 eventual consistency errors (#4356)
d32e88d build(deps-dev): bump the npm group with 3 updates (#4349)
8170bcc build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)
0041819 build(deps): bump picomatch (#4339)
b993918 build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)
36d7c84 build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)
a45d1fb build(deps): bump @tootallnate/once and jest-environment-jsdom (#4323)
3499eb6 build(deps): bump the github-actions group with 2 updates (#4316)
3f3b473 build(deps): bump minimatch (#4311)
6699836 build(deps-dev): bump the npm group with 2 updates (#4305)
See full diff in compare view

Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` | | [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `4.0.0` | `5.0.0` | | [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `4.13.0` | `4.14.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` | Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@ed59741...3a2844b) Updates `actions/upload-pages-artifact` from 4.0.0 to 5.0.0 - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](actions/upload-pages-artifact@7b1f4a7...fc324d3) Updates `actions/cache` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@6682284...27d5ce7) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) Updates `CodSpeedHQ/action` from 4.13.0 to 4.14.0 - [Release notes](https://github.com/codspeedhq/action/releases) - [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md) - [Commits](CodSpeedHQ/action@d872884...658a901) Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@c0f553f...5f6978f) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-pages-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: CodSpeedHQ/action dependency-version: 4.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-27T23:05:45Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies [bot] PRs that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 20, 2026

dependabot Bot requested a review from a team as a code owner April 20, 2026 17:31

dependabot Bot added dependencies [bot] PRs that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 20, 2026

conda-bot added this to 🔎 Review Apr 20, 2026

github-project-automation Bot moved this to 🆕 New in 🔎 Review Apr 20, 2026

conda-bot added the cla-signed [bot] added once the contributor has signed the CLA label Apr 20, 2026

dependabot Bot force-pushed the dependabot/github_actions/github-actions-4b95680b4a branch from edeff4e to 6047885 Compare April 20, 2026 21:31

dependabot Bot closed this Apr 27, 2026

dependabot Bot deleted the dependabot/github_actions/github-actions-4b95680b4a branch April 27, 2026 23:05

github-project-automation Bot moved this from 🆕 New to 🏁 Done in 🔎 Review Apr 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the github-actions group across 1 directory with 6 updates#917

Bump the github-actions group across 1 directory with 6 updates#917
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-actions-4b95680b4a

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v9.0.0

What's Changed

New Contributors

v5.0.0

Changelog

v5.0.5

What's Changed

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

v7.0.1

What's Changed

v4.14.0

Release Notes

Minimum integration versions

🚀 Features

🐛 Bug Fixes

⚙️ Internals

Install codspeed-runner 4.14.0

Install prebuilt binaries via shell script

Download codspeed-runner 4.14.0

Create Pull Request v8.1.1

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading