ci(actions): update github actions (major) by renovate[bot] · Pull Request #2947 · seerr-team/seerr

renovate · 2026-04-24T16:35:29Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/cache	action	major	`v4.3.0` → `v5.0.5`
actions/checkout	action	major	`v5.0.1` → `v6.0.2`
actions/create-github-app-token	action	major	`v2.2.2` → `v3.1.1`
actions/deploy-pages	action	major	`v4.0.5` → `v5`
actions/download-artifact	action	major	`v5.0.0` → `v8.0.1`
actions/github-script	action	major	`v8.0.0` → `v9`
actions/setup-node	action	major	`v5.0.0` → `v6.3.0`	`v6.4.0`
actions/upload-artifact	action	major	`v4.6.2` → `v7.0.1`
actions/upload-artifact	action	major	`v6.0.0` → `v7.0.1`
azure/setup-helm	action	major	`v4.3.1` → `v5`
cypress-io/github-action	action	major	`v6.10.9` → `v7.1.9`
dawidd6/action-download-artifact	action	major	`v14` → `v20`
docker/build-push-action	action	major	`v6.19.2` → `v7.1.0`
docker/login-action	action	major	`v3.7.0` → `v4.1.0`
docker/metadata-action	action	major	`v5.10.0` → `v6`
docker/setup-buildx-action	action	major	`v3.12.0` → `v4`
node	container	major	`22.22.2-alpine3.23` → `24.15.0-alpine3.23`
oras-project/setup-oras	action	major	`v1.2.4` → `v2`
pnpm/action-setup	action	major	`v4.4.0` → `v6.0.1`	`v6.0.3`

Release Notes

actions/cache (actions/cache)

`v5.0.5`

Compare Source

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in #1747

Full Changelog: actions/cache@v5...v5.0.5

`v5.0.4`

Compare Source

`v5.0.3`

Compare Source

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

actions/checkout (actions/checkout)

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Compare Source

`v6.0.0`

Compare Source

`v6`

Compare Source

actions/create-github-app-token (actions/create-github-app-token)

`v3.1.1`

Compare Source

Bug Fixes

improve error message when app identifier is empty (#362) (07e2b76), closes #249

`v3.1.0`

Compare Source

Bug Fixes

deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

add client-id input and deprecate app-id (#353) (e6bd4e6)
update permission inputs (#358) (076e948)

`v3.0.0`

Compare Source

feat!: node 24 support (#275) (2e564a0)
fix!: require NODE_USE_ENV_PROXY for proxy support (#342) (4451bcb)

Bug Fixes

remove custom proxy handling (#143) (dce0ab0)

BREAKING CHANGES

Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.

`v3`

Compare Source

actions/deploy-pages (actions/deploy-pages)

`v5`

Compare Source

`v5.0.0`

Compare Source

Changelog

Update Node.js version to 24.x @salmanmkc (#404)
Add workflow file for publishing releases to immutable action package @Jcambass (#374)
Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory @dependabot (#360)
Make the rebuild dist workflow work nicer with Dependabot @yoannchaudet (#361)
Bump the non-breaking-changes group across 1 directory with 3 updates @dependabot (#358)
Delete repeated sentence @garethsb (#359)
Update README.md @tsusdere (#348)
Bump the non-breaking-changes group with 4 updates @dependabot (#341)
Remove error message for file permissions @TooManyBees (#340)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

actions/download-artifact (actions/download-artifact)

`v8.0.1`

Compare Source

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in #471
Add a regression test for artifact name + content-type mismatches by @danwkennedy in #472

Full Changelog: actions/download-artifact@v8...v8.0.1

`v8.0.0`

Compare Source

v8 - What's new

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to false.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in #460
Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in #461

Full Changelog: actions/download-artifact@v7...v8.0.0

`v8`

Compare Source

`v7`

Compare Source

`v7.0.0`

Compare Source

v7 - What's new

[!IMPORTANT]
actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in #440
Download Artifact Node24 support by @salmanmkc in #415
fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in #451
prepare release v7.0.0 for Node.js 24 support by @salmanmkc in #452

New Contributors

@patrikpolyak made their first contribution in #440
@salmanmkc made their first contribution in #415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

`v6`

Compare Source

`v6.0.0`

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README for download-artifact v5 changes by @yacaovsnc in #417
Update README with artifact extraction details by @yacaovsnc in #424
Readme: spell out the first use of GHES by @danwkennedy in #431
Bump @actions/artifact to v4.0.0
Prepare v6.0.0 by @danwkennedy in #438

New Contributors

@danwkennedy made their first contribution in #431

Full Changelog: actions/download-artifact@v5...v6.0.0

actions/github-script (actions/github-script)

`v9`

Compare Source

`v9.0.0`

Compare Source

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in #695
ci: use deployment: false for integration test environments by @salmanmkc in #712
feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in #700

New Contributors

@Copilot made their first contribution in #695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

actions/setup-node (actions/setup-node)

`v6.3.0`

Compare Source

What's Changed

Enhancements:

Support parsing devEngines field by @susnux in #1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Fix npm audit issues by @gowridurgad in #1491
Replace uuid with crypto.randomUUID() by @trivikr in #1378
Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #1498

Bug fixes:

Remove hardcoded bearer for mirror-url @marco-ippolito in #1467
Scope test lockfiles by package manager and update cache tests by @gowridurgad in #1495

New Contributors

@susnux made their first contribution in #1283

Full Changelog: actions/setup-node@v6...v6.3.0

`v6.2.0`

Compare Source

`v6.1.0`

Compare Source

What's Changed

Enhancement:

Remove always-auth configuration handling by @priyagupta108 in #1436

Dependency updates:

Upgrade @actions/cache from 4.0.3 to 4.1.0 by @dependabot[bot] in #1384
Upgrade actions/checkout from 5 to 6 by @dependabot[bot] in #1439
Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in #1435

Documentation update:

Add example for restore-only cache in documentation by @aparnajyothi-y in #1419

Full Changelog: actions/setup-node@v6...v6.1.0

`v6.0.0`

Compare Source

What's Changed

Breaking Changes

Limit automatic caching to npm, update workflows and documentation by @priyagupta108 in #1374

Dependency Upgrades

Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336
Upgrade prettier from 2.8.8 to 3.6.2 by @dependabot[bot] in #1334
Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot[bot] in #1362

Full Changelog: actions/setup-node@v5...v6.0.0

`v6`

Compare Source

actions/upload-artifact (actions/upload-artifact)

`v7.0.1`

Compare Source

What's Changed

Update the readme with direct upload details by @danwkennedy in #795
Readme: bump all the example versions to v7 by @danwkennedy in #796
Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in #797

Full Changelog: actions/upload-artifact@v7...v7.0.1

`v7.0.0`

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in #754
Upgrade the module to ESM and bump dependencies by @danwkennedy in #762
Support direct file uploads by @danwkennedy in #764

New Contributors

@Link- made their first contribution in #754

Full Changelog: actions/upload-artifact@v6...v7.0.0

`v7`

Compare Source

`v6`

Compare Source

`v6.0.0`

Compare Source

`v5`

Compare Source

`v5.0.0`

Compare Source

azure/setup-helm (azure/setup-helm)

`v5`

Compare Source

`v5.0.0`

Compare Source

Changed

cypress-io/github-action (cypress-io/github-action)

`v7.1.9`

Compare Source

Bug Fixes

deps: update vulnerable transient dependencies (#1714) (783cb3f)

`v7.1.8`

Compare Source

Bug Fixes

deps: update fast-xml-parser to 5.5.7 (#1703) (4c06c48)

`v7.1.7`

Compare Source

Bug Fixes

update fast-xml-parser to 5.5.6 (#1688) (ed2d88c)

`v7.1.6`

Compare Source

Bug Fixes

deps: update transient dependencies flatted & undici (#1683) (8248214)

`v7.1.5`

Compare Source

Bug Fixes

update fast-xml-parser to 5.4.1 (#1667) (bc22e01)

`v7.1.4`

Compare Source

Bug Fixes

update minimatch to 3.1.5 (#1665) (f9ffb60)

`v7.1.3`

Compare Source

Bug Fixes

deps: update fast-xml-parser to 5.3.6 (#1656) (e44ee0f)

`v7.1.2`

Compare Source

Bug Fixes

deps: update fast-xml-parser to 5.3.4 (#1648) (9992daa)

`v7.1.1`

Compare Source

Bug Fixes

deps: update @actions/* (#1645) (0f330eb)

`v7.1.0`

Compare Source

`v7.0.0`

Compare Source

Features

deps: update action from node20 to node24 (#1639) (dca9861)

BREAKING CHANGES

deps: Update action from node20 to node24
cypress-io/github-action@v6, using node20, is deprecated

dawidd6/action-download-artifact (dawidd6/action-download-artifact)

`v20`

Compare Source

What's Changed

build(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by @dependabot[bot] in #387
node_modules: update by @dawidd6 in #388
build(deps): bump filesize from 11.0.13 to 11.0.14 by @dependabot[bot] in #389
build(deps): bump brace-expansion by @dependabot[bot] in #390
node_modules: update by @dawidd6 in #391
build(deps): bump filesize from 11.0.14 to 11.0.15 by @dependabot[bot] in #392
build(deps): bump adm-zip from 0.5.16 to 0.5.17 by @dependabot[bot] in #393
build(deps): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in #394
node_modules: update by @dawidd6 in #395

Full Changelog: dawidd6/action-download-artifact@v19...v20

`v19`

Compare Source

What's Changed

build(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 by @dependabot[bot] in #385
node_modules: update by @dawidd6 in #386

Full Changelog: dawidd6/action-download-artifact@v18...v19

`v18`

Compare Source

What's Changed

build(deps): bump @actions/artifact from 6.2.0 to 6.2.1 by @dependabot[bot] in #381
build(deps): bump undici from 6.23.0 to 6.24.0 by @dependabot[bot] in #382
node_modules: update by @dawidd6 in #383

Full Changelog: dawidd6/action-download-artifact@v17...v18

`v17`

Compare Source

What's Changed

build(deps): bump @actions/artifact from 6.1.0 to 6.2.0 by @dependabot[bot] in #376
build(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #377
build(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 by @dependabot[bot] in #378
node_modules: update by @dawidd6 in #379
Update Node version from 20 to 24

Full Changelog: dawidd6/action-download-artifact@v16...v17

`v16`

Compare Source

What's Changed

build(deps): bump minimatch by @dependabot[bot] in #374
node_modules: update by @dawidd6 in #375

Full Changelog: dawidd6/action-download-artifact@v15...v16

`v15`

Compare Source

What's Changed

build(deps): bump @actions/artifact from 6.0.0 to 6.1.0 by @dependabot[bot] in #369
node_modules: update by @dawidd6 in #370
build(deps): bump fast-xml-parser from 5.3.4 to 5.3.6 by @dependabot[bot] in #371
node_modules: update by @dawidd6 in #372

Full Changelog: dawidd6/action-download-artifact@v14...v15

docker/build-push-action (docker/build-push-action)

`v7.1.0`

Compare Source

Git context query format support by @crazy-max in #1505
Bump @docker/actions-toolkit from 0.79.0 to 0.87.0 by @crazy-max in #1505
Bump brace-expansion from 1.1.12 to 1.1.13 in #1500
Bump fast-xml-parser from 5.4.2 to 5.5.7 in #1489
Bump flatted from 3.3.3 to 3.4.2 in #1491
Bump glob from 10.3.12 to 10.5.0 in #1490
Bump handlebars from 4.7.8 to 4.7.9 in #1497
Bump lodash from 4.17.23 to 4.18.1 in #1510
Bump picomatch from 4.0.3 to 4.0.4 in #1496
Bump undici from 6.23.0 to 6.24.1 in #1486
Bump vite from 7.3.1 to 7.3.2 in #1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

`v7.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #1470
Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @crazy-max in #1473
Remove legacy export-build tool support for build summary by @crazy-max in #1474
Switch to ESM and update config/test wiring by @crazy-max in #1466
Bump @actions/core from 1.11.1 to 3.0.0 in #1454
Bump @docker/actions-toolkit from 0.62.1 to 0.79.0 in #1453 #1472 #1479
Bump minimatch from 3.1.2 to 3.1.5 in #1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

`v7`

Compare Source

docker/login-action (docker/login-action)

`v4.1.0`

Compare Source

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in #945
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in #930
Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in #932 #936
Bump brace-expansion from 1.1.12 to 1.1.13 in #952
Bump fast-xml-parser from 5.3.4 to 5.3.6 in #942
Bump flatted from 3.3.3 to 3.4.2 in #944
Bump glob from 10.3.12 to 10.5.0 in #940
Bump handlebars from 4.7.8 to 4.7.9 in #949
Bump http-proxy-agent and https-proxy-agent to 8.0.0 in #937
Bump lodash from 4.17.23 to 4.18.1 in #958
Bump minimatch from 3.1.2 to 3.1.5 in #941
Bump picomatch from 4.0.3 to 4.0.4 in #948
Bump undici from 6.23.0 to 6.24.1 in #938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

`v4.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #929
Switch to ESM and update config/test wiring by @crazy-max in #927
Bump @actions/core from 1.11.1 to 3.0.0 in #919
Bump @aws-sdk/client-ecr from 3.890.0 to 3.1000.0 in #909 #920
Bump @aws-sdk/client-ecr-public from 3.890.0 to 3.1000.0 in #909 #920
Bump @docker/actions-toolkit from 0.63.0 to 0.77.0 in #910 #928
Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in #921
Bump js-yaml from 4.1.0 to 4.1.1 in #901

Full Changelog: docker/login-action@v3.7.0...v4.0.0

`v4`

Compare Source

docker/metadata-action (docker/metadata-action)

`v6`

Compare Source

`v6.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #605
List inputs now preserve # inside values while still supporting full-line # comments by @crazy-max in #607
Switch to ESM and update config/test wiring by @crazy-max in #602
Bump lodash from 4.17.21 to 4.17.23 in #588
Bump @actions/core from 1.11.1 to 3.0.0 in #599
Bump @actions/github from 6.0.1 to 9.0.0 in #597
Bump @docker/actions-toolkit from 0.68.0 to 0.79.0 in #604
Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in #600
Bump semver from 7.7.3 to 7.7.4 in #603

Full Changelog: docker/metadata-action@v5.10.0...v6.0.0

docker/setup-buildx-action (docker/setup-buildx-action)

`v4`

Compare Source

`v4.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #483
Remove deprecated inputs/outputs by @crazy-max in #464
Switch to ESM and update config/test wiring by @crazy-max in #481
Bump @actions/core from 1.11.1 to 3.0.0 in #475
Bump @docker/actions-toolkit from 0.63.0 to 0.79.0 in #482 #485
Bump js-yaml from 4.1.0 to 4.1.1 in #452
Bump lodash from 4.17.21 to 4.17.23 in #472
Bump minimatch from 3.1.2 to 3.1.5 in #480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

nodejs/node (node)

`v24.15.0`: 2026-04-15, Version 24.15.0 'Krypton' (LTS), @aduh95

Compare Source

Notable Changes

[3d87ecacbc] - (SEMVER-MINOR) cli: add --max-heap-size option (tannal) #58708
[83c38672f7] - cli: add --require-module/--no-require-module (Joyee Cheung) [#60959](

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added the dependencies Pull requests that update a dependency file label Apr 24, 2026

renovate Bot requested a review from a team as a code owner April 24, 2026 16:35

renovate Bot added github_actions Pull requests that update GitHub Actions code dependencies Pull requests that update a dependency file labels Apr 24, 2026

renovate Bot force-pushed the renovate/major-github-actions branch from 3d1b216 to 7f42e32 Compare April 25, 2026 01:50

ci(actions): update github actions

f169ff8

renovate Bot force-pushed the renovate/major-github-actions branch from 7f42e32 to f169ff8 Compare April 25, 2026 23:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(actions): update github actions (major)#2947

ci(actions): update github actions (major)#2947
renovate[bot] wants to merge 1 commit intodevelopfrom
renovate/major-github-actions

renovate Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

Bug Fixes

Bug Fixes

Features

Bug Fixes

BREAKING CHANGES

Changelog

What's Changed

v8 - What's new

Direct downloads

Enforced checks (breaking)

ESM

What's Changed

v7 - What's new

Node.js 24

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Enhancements:

Dependency updates:

Bug fixes:

New Contributors

What's Changed

Enhancement:

Dependency updates:

Documentation update:

What's Changed

What's Changed

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

Changed

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

BREAKING CHANGES

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

v24.15.0: 2026-04-15, Version 24.15.0 'Krypton' (LTS), @​aduh95

Notable Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 24, 2026 •

edited

Loading

`v24.15.0`: 2026-04-15, Version 24.15.0 'Krypton' (LTS), @aduh95