chore(deps): bump the all-actions group across 1 directory with 4 updates

[dependabot]

Bumps the all-actions group with 4 updates in the / directory: actions/checkout, actions/setup-node, oasdiff/oasdiff-action/changelog and oasdiff/oasdiff-action/breaking.

Updates actions/checkout from 6.0.3 to 6.1.0

Release notes

Sourced from actions/checkout's releases.

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

Commits

• d23441a backport fixes to releases-v6 (#2527)
• f93ca50 backport allow-unsafe-pr-checkout to v6 (#2500)
• See full diff in compare view

Updates actions/setup-node from 6.4.0 to 6.5.0

Release notes

Sourced from actions/setup-node's releases.

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 2499707 Update @​actions/cache to 5.1.0 and add security overrides for undici and fast...
• See full diff in compare view

Updates oasdiff/oasdiff-action/changelog from 0.0.42 to 0.1.9

Release notes

Sourced from oasdiff/oasdiff-action/changelog's releases.

v0.1.9

What's Changed

Updates the bundled oasdiff to v1.26.0, which adds breaking-change and changelog detection for response header schema changes: type, format, and nullability. A response header going from string/date-time to integer, for example, is now reported where it was previously silent.

See the oasdiff v1.26.0 release notes for the full list.

Note: specs with response-header type, format, or nullability changes may surface new findings on your PRs, including new breaking-change errors. Adjust per-check with .oasdiff.yaml severity settings if needed.

• bump: oasdiff v1.26.0 by @​reuvenharrison in oasdiff/oasdiff-action#191

Full Changelog: oasdiff/oasdiff-action@v0.1.8...v0.1.9

v0.1.8

Upgraded to oasdiff v1.25.1

The action now runs oasdiff v1.25.1. Most notably, a required request property with a default value is now reported as a breaking change (error) rather than informational, because a request that omits a required property is invalid under the new contract whether or not the property has a default. See the oasdiff v1.25.1 release notes.

Full Changelog: oasdiff/oasdiff-action@v0.1.7...v0.1.8

v0.1.7

Highlights

Upgraded to oasdiff v1.24.0

Every action (breaking, changelog, diff, pr-comment, validate) now runs on oasdiff v1.24.0: the side-by-side review groups each change under the source block that produced it and scales to any spec size, validate adds the ambiguous-parameter-serialization and duplicate-enum-value checks, and an API split across several microservice specs can now be reviewed as one.

No workflow changes are required: existing steps pick up the newer engine automatically on your next run.

Full Changelog: oasdiff/oasdiff-action@v0.1.6...v0.1.7

v0.1.6

Highlights

Upgraded to oasdiff v1.23.0

Every action (breaking, changelog, diff, pr-comment, validate) now runs on oasdiff v1.23.0: nullability changes are recognized in all three equivalent forms (the nullable keyword, the 3.1 type array, and the null oneOf wrapping) and reported as a single, correctly-leveled finding, for bodies, properties, and parameters, in both directions. Wrapping a $ref'd schema in oneOf: [{type: "null"}, ...] no longer produces false breaking errors. See the nullability guide.

No workflow changes are required: existing steps pick up the newer engine automatically on your next run.

Full Changelog: oasdiff/oasdiff-action@v0.1.5...v0.1.6

v0.1.5

Runs on oasdiff v1.22.0

Every action now runs on oasdiff v1.22.0: precise source locations for every reported change (security, stability, sunset, x-extensible-enum), the new oasdiff schema command, and a fix for OpenAPI 3.1 multi-type arrays under --flatten-allof.

Changes

• Upgraded to oasdiff v1.22.0 (#186).
• Docs: clarify what changelog, breaking, and diff each cover, and link the diff action to its section (#184, #185).

... (truncated)

Commits

• 45c956e bump: oasdiff v1.26.0 (#191)
• 4bdf890 bump: oasdiff v1.25.1 (#190)
• 35b3224 bump: oasdiff v1.24.0 (#188)
• 024f6c3 bump: oasdiff v1.23.0 (#187)
• 291b659 Merge pull request #186 from oasdiff/bump/oasdiff-v1.22.0
• 07f8dd6 bump: oasdiff v1.22.0
• 3831238 Merge pull request #185 from oasdiff/docs/link-diff-action
• 1671103 docs: link 'diff action' to its section
• e17c458 Merge pull request #184 from oasdiff/docs/changelog-diff-scope-wording
• 2b7766a docs: state what changelog, breaking, and diff each cover
• Additional commits viewable in compare view

Updates oasdiff/oasdiff-action/breaking from 0.0.42 to 0.1.9

Release notes

Sourced from oasdiff/oasdiff-action/breaking's releases.

v0.1.9

What's Changed

Updates the bundled oasdiff to v1.26.0, which adds breaking-change and changelog detection for response header schema changes: type, format, and nullability. A response header going from string/date-time to integer, for example, is now reported where it was previously silent.

See the oasdiff v1.26.0 release notes for the full list.

Note: specs with response-header type, format, or nullability changes may surface new findings on your PRs, including new breaking-change errors. Adjust per-check with .oasdiff.yaml severity settings if needed.

• bump: oasdiff v1.26.0 by @​reuvenharrison in oasdiff/oasdiff-action#191

Full Changelog: oasdiff/oasdiff-action@v0.1.8...v0.1.9

v0.1.8

Upgraded to oasdiff v1.25.1

The action now runs oasdiff v1.25.1. Most notably, a required request property with a default value is now reported as a breaking change (error) rather than informational, because a request that omits a required property is invalid under the new contract whether or not the property has a default. See the oasdiff v1.25.1 release notes.

Full Changelog: oasdiff/oasdiff-action@v0.1.7...v0.1.8

v0.1.7

Highlights

Upgraded to oasdiff v1.24.0

Every action (breaking, changelog, diff, pr-comment, validate) now runs on oasdiff v1.24.0: the side-by-side review groups each change under the source block that produced it and scales to any spec size, validate adds the ambiguous-parameter-serialization and duplicate-enum-value checks, and an API split across several microservice specs can now be reviewed as one.

No workflow changes are required: existing steps pick up the newer engine automatically on your next run.

Full Changelog: oasdiff/oasdiff-action@v0.1.6...v0.1.7

v0.1.6

Highlights

Upgraded to oasdiff v1.23.0

Every action (breaking, changelog, diff, pr-comment, validate) now runs on oasdiff v1.23.0: nullability changes are recognized in all three equivalent forms (the nullable keyword, the 3.1 type array, and the null oneOf wrapping) and reported as a single, correctly-leveled finding, for bodies, properties, and parameters, in both directions. Wrapping a $ref'd schema in oneOf: [{type: "null"}, ...] no longer produces false breaking errors. See the nullability guide.

No workflow changes are required: existing steps pick up the newer engine automatically on your next run.

Full Changelog: oasdiff/oasdiff-action@v0.1.5...v0.1.6

v0.1.5

Runs on oasdiff v1.22.0

Every action now runs on oasdiff v1.22.0: precise source locations for every reported change (security, stability, sunset, x-extensible-enum), the new oasdiff schema command, and a fix for OpenAPI 3.1 multi-type arrays under --flatten-allof.

Changes

• Upgraded to oasdiff v1.22.0 (#186).
• Docs: clarify what changelog, breaking, and diff each cover, and link the diff action to its section (#184, #185).

... (truncated)

Commits

• 45c956e bump: oasdiff v1.26.0 (#191)
• 4bdf890 bump: oasdiff v1.25.1 (#190)
• 35b3224 bump: oasdiff v1.24.0 (#188)
• 024f6c3 bump: oasdiff v1.23.0 (#187)
• 291b659 Merge pull request #186 from oasdiff/bump/oasdiff-v1.22.0
• 07f8dd6 bump: oasdiff v1.22.0
• 3831238 Merge pull request #185 from oasdiff/docs/link-diff-action
• 1671103 docs: link 'diff action' to its section
• e17c458 Merge pull request #184 from oasdiff/docs/changelog-diff-scope-wording
• 2b7766a docs: state what changelog, breaking, and diff each cover
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions