Skip to content

chore(deps): bump the github-actions group with 5 updates - #5

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-49f1185270
Open

chore(deps): bump the github-actions group with 5 updates#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-49f1185270

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 5 updates:

Package From To
actions/checkout 4.4.0 7.0.1
codecov/codecov-action 04b047e8bb82a0c002c8312c1c880fbc6a999d45 0fb7174895f61a3b6b78fc075e0cd60383518dac
actions/dependency-review-action 4.9.0 5.0.0
SemTiOne/chess-review-bot/action 472518ea043a2ef29ba2a7a667d4d43c6f39c069 9105f183e0d0aafd5b4e964f6f535b10a08576f5
pypa/gh-action-pypi-publish 1.14.1 1.14.2

Updates actions/checkout from 4.4.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates codecov/codecov-action from 04b047e8bb82a0c002c8312c1c880fbc6a999d45 to 0fb7174895f61a3b6b78fc075e0cd60383518dac

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Updates actions/dependency-review-action from 4.9.0 to 5.0.0

Release notes

Sourced from actions/dependency-review-action's releases.

5.0.0

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

Commits
  • a1d282b Merge pull request #1098 from actions/ahpook/v5-release
  • eb6c199 update examples to show @​v5
  • 3943c2c v5.0.0 release branch
  • 454943c Merge pull request #1094 from actions/ashelytc/security-findings
  • 6d92a12 revert @​typescript-eslint/parser update
  • a8e5a7e Merge pull request #1076 from tspascoal/fix-version-matching-for-non-string-s...
  • b6b7079 update @​typescript-eslint/parser to 8.40.0
  • 821a21d update more dependencies
  • 05aaaae run npm audit fix
  • 55d3e75 Merge pull request #1077 from Marukome0743/docs/checkout
  • Additional commits viewable in compare view

Updates SemTiOne/chess-review-bot/action from 472518ea043a2ef29ba2a7a667d4d43c6f39c069 to 9105f183e0d0aafd5b4e964f6f535b10a08576f5

Changelog

Sourced from SemTiOne/chess-review-bot/action's changelog.

Changelog

Follows Keep a Changelog loosely.

[Unreleased]

[0.1.4]

Fixed

  • GitHub CodeQL alerts: added explicit top-level and job-level permissions blocks to ci.yml and release.yml, closing four alerts about missing workflow permissions (least-privilege best practice).
  • requirements.txt (and requirements-*.txt variants) weren't recognized as a dependency manifest at all; a version-only bump was scored like any other change instead of routine Book. Found via two real repos with 9+ such files between them. package.json/ pyproject.toml's version-line pattern doesn't match pip's ==/>=/ ~= operators either, so this needed its own pattern, not just a name added to an existing list.

Added

  • CONTRIBUTING.md guide for new contributors.
  • dependabot.yml for automated dependency updates.
  • GitHub Actions dependency bumps (github-actions group, 4 updates).

[0.1.3]

Chore: version bump to 0.1.3.

[0.1.2]

Fixed

  • Credential detection flagged safe env/config lookups (os.environ["X"], config["X"], os.getenv(...), settings.X) as leaked secrets, purely because they matched keyword = <anything>. Found by running the detector against real tutorial repos that load API keys this way (a very common, safe pattern). A hardcoded literal value is still flagged exactly as before.

[0.1.1]

Fixed

  • action.yml referenced ${{ github.action_path }}/action/entrypoint.py -- github.action_path already points at the directory containing action.yml, so this doubled the path segment and every Action run

... (truncated)

Commits
  • 9105f18 100% test coverage across all modules
  • b14bea8 Add Tier 2 signal detection: debug artifacts, low-entropy content, non-functi...
  • dec0c72 fix: remove test artifact #peak from config.py
  • b5d94e6 feat: detect placeholder content and comment-only changes
  • 3cc2ba0 fix: add issues:write scope to chess-review job permissions
  • 07b0e22 fix: use git rev-parse --show-toplevel for repo root
  • 8ab4be7 fix: use git rev-parse --show-toplevel for repo root
  • 3401167 fix: rename .zizmor.yml to zizmor.yml for proper discovery, use base filename
  • f3b1584 fix .zizmor.yml format: use rules: key with ignore: list
  • d9cadbb chore: suppress dependabot-cooldown zizmor audit
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the github-actions group with 5 updates
d03ebc1 
Bumps the github-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `04b047e8bb82a0c002c8312c1c880fbc6a999d45` | `0fb7174895f61a3b6b78fc075e0cd60383518dac` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |
| [SemTiOne/chess-review-bot/action](https://github.com/semtione/chess-review-bot) | `472518ea043a2ef29ba2a7a667d4d43c6f39c069` | `9105f183e0d0aafd5b4e964f6f535b10a08576f5` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.1` | `1.14.2` |


Updates `actions/checkout` from 4.4.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.4.0...3d3c42e)

Updates `codecov/codecov-action` from 04b047e8bb82a0c002c8312c1c880fbc6a999d45 to 0fb7174895f61a3b6b78fc075e0cd60383518dac
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@04b047e...0fb7174)

Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@2031cfc...a1d282b)

Updates `SemTiOne/chess-review-bot/action` from 472518ea043a2ef29ba2a7a667d4d43c6f39c069 to 9105f183e0d0aafd5b4e964f6f535b10a08576f5
- [Changelog](https://github.com/SemTiOne/chess-review-bot/blob/main/CHANGELOG.md)
- [Commits](SemTiOne/chess-review-bot@472518e...9105f18)

Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@ba38be9...dc37677)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 0fb7174895f61a3b6b78fc075e0cd60383518dac
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: actions/dependency-review-action
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: SemTiOne/chess-review-bot/action
  dependency-version: 9105f183e0d0aafd5b4e964f6f535b10a08576f5
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 3, 2026
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

♟️ chess-review-bot — PR Game Review

Accuracy: 85.0/100 · 3 files · +5/-5 · 0 Blunder??

File Category Why
.github/workflows/ci.yml Excellent moderate change, no risk signals
.github/workflows/pr-review.yml Excellent moderate change, no risk signals
.github/workflows/release.yml Excellent moderate change, no risk signals

chess-review-bot scores diffs, not people. Run chessreview --format text locally for the full report.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants