chore(deps): update all non-major github action dependencies by renovate[bot] · Pull Request #2633 · cds-snc/notification-admin

renovate · 2026-03-28T06:06:14Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	minor	`v4.2.0` → `v4.3.0`
actions/checkout	action	minor	`v4.1.1` → `v4.3.1`
actions/checkout	action	minor	`v3` → `v3.6.0`
actions/checkout	action	minor	`v2` → `v2.7.0`
actions/download-artifact	action	minor	`v4` → `v4.3.0`
actions/setup-node	action	minor	`v4.2.0` → `v4.4.0`
actions/setup-node	action	minor	`v3.8.2` → `v3.9.1`
actions/setup-python	action	minor	`v4.8.0` → `v4.9.1`
actions/upload-artifact	action	minor	`v4` → `v4.6.2`
aws-actions/configure-aws-credentials	action	minor	`v4.1.0` → `v4.3.1`
aws-actions/configure-aws-credentials	action	pinDigest	→ `ffc08ea`
cds-snc/notification-pr-bot	action	pinDigest	→ `cd20029`
cds-snc/notification-utils	action	pinDigest	→ `89d1591`
cds-snc/security-tools	action	patch	`v4.0.1` → `v4.0.3`
cds-snc/security-tools	action	patch	`v3.2.0` → `v3.2.1`
docker/setup-buildx-action	action	minor	`v3` → `v3.12.0`
github/codeql-action	action	minor	`v2.24.10` → `v2.28.1`
postgres	service	minor	`11.17-bullseye` → `11.22-bullseye`
python	uses-with	minor	`3.12` → `3.14`
redis	service	digest	`9e75c88` → `83a75a9`

Review

Updates have been tested and work
If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

Release Notes

actions/cache (actions/cache)

`v4.3.0`

Compare Source

What's Changed

Add note on runner versions by @GhadimiR in #1642
Prepare v4.3.0 release by @Link- in #1655

New Contributors

@GhadimiR made their first contribution in #1642

Full Changelog: actions/cache@v4...v4.3.0

`v4.2.4`

Compare Source

What's Changed

Update README.md by @nebuk89 in #1620
Upgrade @actions/cache to 4.0.5 and move @protobuf-ts/plugin to dev depdencies by @Link- in #1634
Prepare release 4.2.4 by @Link- in #1636

New Contributors

@nebuk89 made their first contribution in #1620

Full Changelog: actions/cache@v4...v4.2.4

`v4.2.3`

Compare Source

What's Changed

Update to use @actions/cache 4.0.3 package & prepare for new release by @salmanmkc in #1577 (SAS tokens for cache entries are now masked in debug logs)

New Contributors

@salmanmkc made their first contribution in #1577

Full Changelog: actions/cache@v4.2.2...v4.2.3

`v4.2.2`

Compare Source

What's Changed

[!IMPORTANT]
As a reminder, there were important backend changes to release v4.2.0, see those release notes and the announcement for more details.

Bump @actions/cache to v4.0.2 by @robherley in #1560

Full Changelog: actions/cache@v4.2.1...v4.2.2

`v4.2.1`

Compare Source

What's Changed

[!IMPORTANT]
As a reminder, there were important backend changes to release v4.2.0, see those release notes and the announcement for more details.

docs: GitHub is spelled incorrectly in caching-strategies.md by @janco-absa in #1526
docs: Make the "always save prime numbers" example more clear by @Tobbe in #1525
Update force deletion docs due a recent deprecation by @sebbalex in #1500
Bump @actions/cache to v4.0.1 by @robherley in #1554

New Contributors

@janco-absa made their first contribution in #1526
@Tobbe made their first contribution in #1525
@sebbalex made their first contribution in #1500

Full Changelog: actions/cache@v4.2.0...v4.2.1

actions/checkout (actions/checkout)

`v4.3.1`

Compare Source

What's Changed

Port v6 cleanup to v4 by @ericsciple in #2305

Full Changelog: actions/checkout@v4...v4.3.1

`v4.3.0`

Compare Source

What's Changed

docs: update README.md by @motss in #1971
Add internal repos for checking out multiple repositories by @mouismail in #1977
Documentation update - add recommended permissions to Readme by @benwells in #2043
Adjust positioning of user email note and permissions heading by @joshmgross in #2044
Update README.md by @nebuk89 in #2194
Update CODEOWNERS for actions by @TingluoHuang in #2224
Update package dependencies by @salmanmkc in #2236
Prepare release v4.3.0 by @salmanmkc in #2237

New Contributors

@motss made their first contribution in #1971
@mouismail made their first contribution in #1977
@benwells made their first contribution in #2043
@nebuk89 made their first contribution in #2194
@salmanmkc made their first contribution in #2236

Full Changelog: actions/checkout@v4...v4.3.0

`v4.2.2`

Compare Source

url-helper.ts now leverages well-known environment variables by @jww3 in #1941
Expand unit test coverage for isGhes by @jww3 in #1946

`v4.2.1`

Compare Source

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in #1924

`v4.2.0`

Compare Source

Add Ref and Commit outputs by @lucacome in #1180
Dependency updates by @dependabot- #1777, #1872

`v4.1.7`

Compare Source

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in #1739
Bump actions/checkout from 3 to 4 by @dependabot in #1697
Check out other refs/* by commit by @orhantoy in #1774
Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in #1776

`v4.1.6`

Compare Source

Check platform to set archive extension appropriately by @cory-miller in #1732

`v4.1.5`

Compare Source

Update NPM dependencies by @cory-miller in #1703
Bump github/codeql-action from 2 to 3 by @dependabot in #1694
Bump actions/setup-node from 1 to 4 by @dependabot in #1696
Bump actions/upload-artifact from 2 to 4 by @dependabot in #1695
README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @cory-miller in #1707

`v4.1.4`

Compare Source

Disable extensions.worktreeConfig when disabling sparse-checkout by @jww3 in #1692
Add dependabot config by @cory-miller in #1688
Bump the minor-actions-dependencies group with 2 updates by @dependabot in #1693
Bump word-wrap from 1.2.3 to 1.2.5 by @dependabot in #1643

`v4.1.3`

Compare Source

Check git version before attempting to disable sparse-checkout by @jww3 in #1656
Add SSH user parameter by @cory-miller in #1685
Update actions/checkout version in update-main-version.yml by @jww3 in #1650

`v4.1.2`

Compare Source

Fix: Disable sparse checkout whenever sparse-checkout option is not present @dscho in #1598

actions/download-artifact (actions/download-artifact)

`v4.3.0`

Compare Source

What's Changed

feat: implement new artifact-ids input by @GrantBirki in #401
Fix workflow example for downloading by artifact ID by @joshmgross in #402
Prep for v4.3.0 release by @robherley in #404

New Contributors

@GrantBirki made their first contribution in #401

Full Changelog: actions/download-artifact@v4.2.1...v4.3.0

`v4.2.1`

Compare Source

What's Changed

Add unit tests by @GhadimiR in #392
Fix bug introduced in 4.2.0 by @GhadimiR in #391

Full Changelog: actions/download-artifact@v4.2.0...v4.2.1

`v4.2.0`

Compare Source

What's Changed

Update README.md by @lkfortuna in #384
Bump artifact version, do digest check by @GhadimiR in #383

New Contributors

@lkfortuna made their first contribution in #384
@GhadimiR made their first contribution in #383

Full Changelog: actions/download-artifact@v4.1.9...v4.2.0

`v4.1.9`

Compare Source

What's Changed

Add workflow file for publishing releases to immutable action package by @Jcambass in #354
docs: small migration fix by @froblesmartin in #370
Update MIGRATION.md by @andyfeller in #372
Update artifact package to 2.2.2 by @yacaovsnc in #380

New Contributors

@Jcambass made their first contribution in #354
@froblesmartin made their first contribution in #370
@andyfeller made their first contribution in #372
@yacaovsnc made their first contribution in #380

Full Changelog: actions/download-artifact@v4.1.8...v4.1.9

`v4.1.8`

Compare Source

What's Changed

Update @actions/artifact version, bump dependencies by @robherley in #341

Full Changelog: actions/download-artifact@v4.1.7...v4.1.8

What's Changed

updating @actions/artifact dependency to v2.1.6 by @eggyhead in #324

Full Changelog: actions/download-artifact@v4.1.5...v4.1.6

`v4.1.5`

Compare Source

What's Changed

Update readme with v3/v2/v1 deprecation notice by @robherley in #322
Update dependencies @actions/core to v1.10.1 and @actions/artifact to v2.1.5

Full Changelog: actions/download-artifact@v4.1.4...v4.1.5

`v4.1.4`

Compare Source

What's Changed

Update @actions/artifact by @bethanyj28 in #307

Full Changelog: actions/download-artifact@v4...v4.1.4

`v4.1.3`

Compare Source

What's Changed

Update release-new-action-version.yml by @konradpabjan in #292
Update toolkit dependency with updated unzip logic by @bethanyj28 in #299
Update @actions/artifact by @bethanyj28 in #303

New Contributors

@bethanyj28 made their first contribution in #299

Full Changelog: actions/download-artifact@v4...v4.1.3

`v4.1.2`

Compare Source

Bump @actions/artifacts to latest version to include updated GHES host check

`v4.1.1`

Compare Source

Fix transient request timeouts #249
Bump @actions/artifacts to latest version

`v4.1.0`

Compare Source

What's Changed

Some cleanup by @robherley in #247
Fix default for run-id by @stchr in #252
Support pattern matching to filter artifacts & merge to same directory by @robherley in #259

New Contributors

@stchr made their first contribution in #252

Full Changelog: actions/download-artifact@v4...v4.1.0

actions/setup-node (actions/setup-node)

`v4.4.0`

Compare Source

What's Changed

Bug fixes:

Make eslint-compact matcher compatible with Stylelint by @FloEdelmann in #98
Add support for indented eslint output by @fregante in #1245

Enhancement:

Support private mirrors by @marco-ippolito in #1240

Dependency update:

Upgrade @action/cache from 4.0.2 to 4.0.3 by @aparnajyothi-y in #1262

New Contributors

@FloEdelmann made their first contribution in #98
@fregante made their first contribution in #1245
@marco-ippolito made their first contribution in #1240

Full Changelog: actions/setup-node@v4...v4.4.0

`v4.3.0`

Compare Source

What's Changed

Dependency updates

Upgrade @actions/glob from 0.4.0 to 0.5.0 by @dependabot in #1200
Upgrade @action/cache from 4.0.0 to 4.0.2 by @gowridurgad in #1251
Upgrade @vercel/ncc from 0.38.1 to 0.38.3 by @dependabot in #1203
Upgrade @actions/tool-cache from 2.0.1 to 2.0.2 by @dependabot in #1220

New Contributors

@gowridurgad made their first contribution in #1251

Full Changelog: actions/setup-node@v4...v4.3.0

actions/setup-python (actions/setup-python)

`v4.9.1`

Compare Source

What's Changed

Add workflow file for publishing releases to immutable action package by @aparnajyothi-y in #1084

Full Changelog: actions/setup-python@v4...v4.9.1

`v4.9.0`

Compare Source

What's Changed

Upgrade actions/cache to 4.0.3 by @priya-kinthali in #1073
In scope of this release we updated actions/cache package to ensure continued support and compatibility, as older versions of the package are now deprecated. For more information please refer to the toolkit/cache.

Full Changelog: actions/setup-python@v4.8.0...v4.9.0

actions/upload-artifact (actions/upload-artifact)

`v4.6.2`

Compare Source

What's Changed

Update to use artifact 2.3.2 package & prepare for new upload-artifact release by @salmanmkc in #685

New Contributors

@salmanmkc made their first contribution in #685

Full Changelog: actions/upload-artifact@v4...v4.6.2

`v4.6.1`

Compare Source

What's Changed

Update to use artifact 2.2.2 package by @yacaovsnc in #673

Full Changelog: actions/upload-artifact@v4...v4.6.1

`v4.6.0`

Compare Source

What's Changed

Expose env vars to control concurrency and timeout by @yacaovsnc in #662

Full Changelog: actions/upload-artifact@v4...v4.6.0

`v4.5.0`

Compare Source

What's Changed

fix: deprecated Node.js version in action by @hamirmahal in #578
Add new artifact-digest output by @bdehamer in #656

New Contributors

@hamirmahal made their first contribution in #578
@bdehamer made their first contribution in #656

Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0

`v4.4.3`

Compare Source

What's Changed

Undo indirect dependency updates from #627 by @joshmgross in #632

Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3

`v4.4.2`

Compare Source

What's Changed

Bump @actions/artifact to 2.1.11 by @robherley in #627
- Includes fix for relative symlinks not resolving properly

Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2

`v4.4.1`

Compare Source

What's Changed

Add a section about hidden files by @joshmgross in #607
Add workflow file for publishing releases to immutable action package by @Jcambass in #621
Update @actions/artifact to latest version, includes symlink and timeout fixes by @robherley in #625

New Contributors

@Jcambass made their first contribution in #621

Full Changelog: actions/upload-artifact@v4.4.0...v4.4.1

`v4.4.0`

Compare Source

Notice: Breaking Changes ⚠️

We will no longer include hidden files and folders by default in the upload-artifact action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, include-hidden-files, to continue to do so.

See "Notice of upcoming deprecations and breaking changes in GitHub Actions runners" changelog and this issue for more details.

What's Changed

Exclude hidden files by default by @joshmgross in #598

Full Changelog: actions/upload-artifact@v4.3.6...v4.4.0

`v4.3.6`

Compare Source

What's Changed

Revert to @actions/artifact 2.1.8 by @robherley in #594

Full Changelog: actions/upload-artifact@v4...v4.3.6

`v4.3.5`

Compare Source

What's Changed

Bump @actions/artifact to v2.1.9 by @robherley in #588
- Fixed artifact upload chunk timeout logic #1774
- Use lazy stream to prevent issues with open file limits #1771

Full Changelog: actions/upload-artifact@v4.3.4...v4.3.5

`v4.3.4`

Compare Source

What's Changed

Update @actions/artifact version, bump dependencies by @robherley in #584

Full Changelog: actions/upload-artifact@v4.3.3...v4.3.4

`v4.3.3`

Compare Source

What's Changed

updating @actions/artifact dependency to v2.1.6 by @eggyhead in #565

Full Changelog: actions/upload-artifact@v4.3.2...v4.3.3

`v4.3.2`

Compare Source

What's Changed

Update release-new-action-version.yml by @konradpabjan in #516
Minor fix to the migration readme by @andrewakim in #523
Update readme with v3/v2/v1 deprecation notice by @robherley in #561
updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @eggyhead in #562

New Contributors

@andrewakim made their first contribution in #523

Full Changelog: actions/upload-artifact@v4.3.1...v4.3.2

`v4.3.1`

Compare Source

Bump @actions/artifacts to latest version to include updated GHES host check

`v4.3.0`

Compare Source

What's Changed

Reorganize upload code in prep for merge logic & add more tests by @robherley in #504
Add sub-action to merge artifacts by @robherley in #505

Full Changelog: actions/upload-artifact@v4...v4.3.0

`v4.2.0`

Compare Source

What's Changed

Ability to overwrite an Artifact by @robherley in #501

Full Changelog: actions/upload-artifact@v4...v4.2.0

`v4.1.0`

Compare Source

What's Changed

Add migrations docs by @robherley in #482
Update README.md by @samuelwine in #492
Support artifact-url output by @konradpabjan in #496
Update readme to reflect new 500 artifact per job limit by @robherley in #497

New Contributors

@samuelwine made their first contribution in #492

Full Changelog: actions/upload-artifact@v4...v4.1.0

aws-actions/configure-aws-credentials (aws-actions/configure-aws-credentials)

`v4.3.1`

Compare Source

Bug Fixes

update readme to 4.3.1 (#1424) (be2e7ad)

`v4.3.0`

Compare Source

NOTE: This release tag originally pointed to 59b4418, but a critical bug was discovered shortly after publishing. We updated this tag to d0834ad to prevent anyone using the 4.3.0 tag from encountering the bug, and we published 4.3.1 to allow workflows to auto update correctly.

Features

dependency update and feature cleanup (#1414) (59489ba), closes #1062 #1191
Optional environment variable output (c3b3ce6)

Bug Fixes

docs: readme samples versioning (5b3c895)
the wrong example region for China partition in README (37fe9a7)
properly set proxy environment variable (cbea708)

Miscellaneous Chores

release 4.3.0 (3f7c218)

`v4.2.1`

Compare Source

Bug Fixes

ensure explicit inputs take precedence over environment variables (e56e6c4)
prioritize explicit inputs over environment variables (df9c8fe)

`v4.2.0`

Compare Source

Features

add Expiration field to Outputs (a4f3267)
Document role-duration-seconds range (5a0cf01)
support action inputs as environment variables (#1338) (2c168ad)

Bug Fixes

make sure action builds, also fix dependabot autoapprove (c401b8a)
role chaning on mulitple runs (#1340) (9e38641)

cds-snc/security-tools (cds-snc/security-tools)

`v4.0.3`

Compare Source

What's Changed

chore(deps): update cds-snc/security-tools action to v4 by @renovate[bot] in #587
chore: synced file(s) with cds-snc/site-reliability-engineering by @sre-read-write[bot] in #588
chore(deps): update dependency black to v26 [security] by @renovate[bot] in #589
feat: allow locally build Docker images to be scanned by @patheard in #590

Full Changelog: cds-snc/security-tools@v4.0.2...v4.0.3

`v4.0.2`

Compare Source

What's Changed

feat: add IAM and local Trivy install script by @patheard in #585
chore: remove unused IAM role by @patheard in #586

Full Changelog: cds-snc/security-tools@v4.0.1...v4.0.2

docker/setup-buildx-action (docker/setup-buildx-action)

`v3.12.0`

Compare Source

Deprecate install input by @crazy-max in #455
Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 in #434
Bump brace-expansion from 1.1.11 to 1.1.12 in #436
Bump form-data from 2.5.1 to 2.5.5 in #432
Bump undici from 5.28.4 to 5.29.0 in #435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

`v3.11.1`

Compare Source

Fix keep-state not being respected by @crazy-max in #429

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

`v3.11.0`

Compare Source

Keep BuildKit state support by @crazy-max in #427
Remove aliases created when installing by default by @hashhar in #139
Bump @docker/actions-toolkit from 0.56.0 to 0.62.1 in #422 #425

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

`v3.10.0`

Compare Source

Bump @docker/actions-toolkit from 0.54.0 to 0.56.0 in #408

Full Changelog: docker/setup-buildx-action@v3.9.0...v3.10.0

`v3.9.0`

Compare Source

Bump @docker/actions-toolkit from 0.48.0 to 0.54.0 in #402 #404

Full Changelog: docker/setup-buildx-action@v3.8.0...v3.9.0

`v3.8.0`

Compare Source

Make cloud prefix optional to download buildx if driver is cloud by @crazy-max in #390
Bump @actions/core from 1.10.1 to 1.11.1 in #370
Bump @docker/actions-toolkit from 0.39.0 to 0.48.0 in #389
Bump cross-spawn from 7.0.3 to 7.0.6 in #382

Full Changelog: docker/setup-buildx-action@v3.7.1...v3.8.0

`v3.7.1`

Compare Source

Switch back to uuid package by @crazy-max in #369

Full Changelog: docker/setup-buildx-action@v3.7.0...v3.7.1

`v3.7.0`

Compare Source

Always set buildkitd-flags if opt-in by @crazy-max in #363
Remove uuid package and switch to crypto by @crazy-max in #366
Bump @docker/actions-toolkit from 0.35.0 to 0.39.0 in #362
Bump path-to-regexp from 6.2.2 to 6.3.0 in #354

Full Changelog: docker/setup-buildx-action@v3.6.1...v3.7.0

`v3.6.1`

Compare Source

Check for malformed docker context by @crazy-max in #347

Full Changelog: docker/setup-buildx-action@v3.6.0...v3.6.1

`v3.6.0`

Compare Source

Create temp docker context if default one has TLS data loaded before creating a container builder by @crazy-max in #341

Full Changelog: <https://github.com/docker/setup-buildx-action/compare/v3.5

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone America/Montreal, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot added Dependencies Renovate labels Mar 28, 2026

renovate bot force-pushed the renovate/all-non-major-github-action branch 5 times, most recently from dc52b35 to e6f4f66 Compare April 2, 2026 13:15

chore(deps): update all non-major github action dependencies

a888013

renovate bot force-pushed the renovate/all-non-major-github-action branch from e6f4f66 to a888013 Compare April 2, 2026 15:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update all non-major github action dependencies#2633

chore(deps): update all non-major github action dependencies#2633
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-non-major-github-action

renovate bot commented Mar 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Bug fixes:

Enhancement:

Dependency update:

New Contributors

What's Changed

Dependency updates

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

Notice: Breaking Changes ⚠️

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

Bug Fixes

Features

Bug Fixes

Miscellaneous Chores

Bug Fixes

Features

Bug Fixes

What's Changed

What's Changed

Configuration

Uh oh!

Reviewers

renovate bot commented Mar 28, 2026 •

edited

Loading