Bump the gha group across 1 directory with 3 updates #387

dependabot · 2026-01-22T12:46:17Z

Bumps the gha group with 3 updates in the / directory: actions/upload-artifact, actions/download-artifact and astral-sh/setup-uv.

Updates actions/upload-artifact from 5 to 6

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in actions/upload-artifact#719

fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in actions/upload-artifact#744

prepare release v6.0.0 for Node.js 24 support by @salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

Commits

b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
e516bc8 docs: correct description of Node.js 24 support in README
ddc45ed docs: update README to correct action name for Node.js 24 support
615b319 chore: release v6.0.0 for Node.js 24 support
017748b Merge pull request #744 from actions/fix-storage-blob
38d4c79 chore: rebuild dist
7d27270 chore: add missing license cache files for @actions/core, @actions/io, and mi...
5f643d3 chore: update license files for @actions/artifact@5.0.1 dependencies
1df1684 chore: update package-lock.json with @actions/artifact@5.0.1
b5b1a91 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
Additional commits viewable in compare view

Updates actions/download-artifact from 6 to 7

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

New Contributors

@patrikpolyak made their first contribution in actions/download-artifact#440

@salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

Commits

37930b1 Merge pull request #452 from actions/download-artifact-v7-release
72582b9 doc: update readme
0d2ec9d chore: release v7.0.0 for Node.js 24 support
fd7ae8f Merge pull request #451 from actions/fix-storage-blob
d484700 chore: restore minimatch.dep.yml license file
03a8080 chore: remove obsolete dependency license files
56fe6d9 chore: update @actions/artifact license file to 5.0.1
8e3ebc4 chore: update package-lock.json with @actions/artifact@5.0.1
1e3c4b4 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
458627d chore: use local @actions/artifact package for Node.js 24 testing
Additional commits viewable in compare view

Updates astral-sh/setup-uv from 7.1.5 to 7.2.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.2.0 🌈 add outputs python-version and python-cache-hit

Changes

Among some minor typo fixes and quality of life features for developers of actions the main feature of this release are new outputs:

python-version: The Python version that was set (same content as existing UV_PYTHON)

python-cache-hit: A boolean value to indicate the Python cache entry was found

While implementing this it became clear, that it is easier to handle the Python binaries in a separate cache entry. The added benefit for users is that the "normal" cache containing the dependencies can be used in all runs no matter if these cache the Python binaries or not.

[!NOTE]
This release will invalidate caches that contain the Python binaries. This happens a single time.

🐛 Bug fixes

chore: remove stray space from UV_PYTHON_INSTALL_DIR message @akx (#720)

🚀 Enhancements

add outputs python-version and python-cache-hit @eifinger (#728)

Add action typings with validation @krzema12 (#721)

🧰 Maintenance

fix: use uv_build backend for old-python-constraint-project @eifinger (#729)

chore: update known checksums for 0.9.22 @github-actions[bot] (#727)

chore: update known checksums for 0.9.21 @github-actions[bot] (#726)

chore: update known checksums for 0.9.20 @github-actions[bot] (#725)

chore: update known checksums for 0.9.18 @github-actions[bot] (#718)

⬆️ Dependency updates

Bump peter-evans/create-pull-request from 7.0.9 to 8.0.0 @dependabot[bot] (#719)

Bump github/codeql-action from 4.31.6 to 4.31.9 @dependabot[bot] (#723)

v7.1.6 🌈 add OS version to cache key to prevent binary incompatibility

Changes

This release will invalidate your cache existing keys!

The os version e.g. ubuntu-22.04 is now part of the cache key. This prevents failing builds when a cache got populated with wheels built with different tools (e.g. glibc) than are present on the runner where the cache got restored.

🐛 Bug fixes

feat: add OS version to cache key to prevent binary incompatibility @eifinger (#716)

🧰 Maintenance

chore: update known checksums for 0.9.17 @github-actions[bot] (#714)

... (truncated)

Commits

61cb8a9 add outputs python-version and python-cache-hit (#728)
11050ed fix: use uv_build backend for old-python-constraint-project (#729)
1d22faf Bump peter-evans/create-pull-request from 7.0.9 to 8.0.0 (#719)
f4ed82a Bump github/codeql-action from 4.31.6 to 4.31.9 (#723)
e0409b4 chore: update known checksums for 0.9.22 (#727)
702b425 chore: update known checksums for 0.9.21 (#726)
2630c86 chore: update known checksums for 0.9.20 (#725)
45cfcb3 Add action typings with validation (#721)
ce0a899 chore: update known checksums for 0.9.18 (#718)
9c8d030 chore: remove stray space from UV_PYTHON_INSTALL_DIR message (#720)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the gha group with 3 updates in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/download-artifact](https://github.com/actions/download-artifact) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `actions/upload-artifact` from 5 to 6 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v5...v6) Updates `actions/download-artifact` from 6 to 7 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v6...v7) Updates `astral-sh/setup-uv` from 7.1.5 to 7.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@ed21f2f...61cb8a9) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: actions/download-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: astral-sh/setup-uv dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-01-22T12:46:29Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

.github/workflows/build.yml


      - name: Upload binary
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6


.github/workflows/build.yml


      - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6


.github/workflows/build.yml


      - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6


.github/workflows/build.yml


      - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6


.github/workflows/build.yml


      - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6


.github/workflows/build.yml


      - name: Upload sdist
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6


.github/workflows/build.yml

      attestations: write
    steps:
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v7


.github/workflows/release.yml

          persist-credentials: false

-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v7


dependabot bot added the 🤖 dependabot Automated updates and changes managed by Dependabot label Jan 22, 2026

github-advanced-security bot found potential problems Jan 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the gha group across 1 directory with 3 updates #387

Bump the gha group across 1 directory with 3 updates #387

Uh oh!

dependabot bot commented on behalf of github Jan 22, 2026

Uh oh!

coderabbitai bot commented Jan 22, 2026

Review skipped

Uh oh!

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Bump the gha group across 1 directory with 3 updates #387

Are you sure you want to change the base?

Bump the gha group across 1 directory with 3 updates #387

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 22, 2026

v6.0.0

v6 - What's new

Node.js 24

What's Changed

v7.0.0

v7 - What's new

Node.js 24

What's Changed

New Contributors

v7.2.0 🌈 add outputs python-version and python-cache-hit

Changes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v7.1.6 🌈 add OS version to cache key to prevent binary incompatibility

Changes

🐛 Bug fixes

🧰 Maintenance

Uh oh!

coderabbitai bot commented Jan 22, 2026

Review skipped

Uh oh!

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant