⬆ Bump the github-actions group across 1 directory with 8 updates by dependabot[bot] · Pull Request #27 · render-examples/full-stack-fastapi-template

dependabot · 2026-06-13T10:54:19Z

Bumps the github-actions group with 8 updates in the / directory:

Package	From	To
actions/checkout	`6.0.2`	`6.0.3`
eps1lon/actions-label-merge-conflict	`3.0.3`	`3.1.0`
actions/labeler	`6.0.1`	`6.1.0`
tiangolo/latest-changes	`0.4.1`	`0.5.0`
mxschmitt/action-tmate	`3.23`	`3.24`
astral-sh/setup-uv	`8.1.0`	`8.2.0`
actions/upload-artifact	`7.0.0`	`7.0.1`
zizmorcore/zizmor-action	`0.5.3`	`0.5.6`

Updates actions/checkout from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

... (truncated)

Commits

df4cb1c Update changelog for v6.0.3 (#2446)
1cce339 Fix checkout init for SHA-256 repositories (#2439)
900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
0c366fd Update changelog (#2357)
See full diff in compare view

Updates eps1lon/actions-label-merge-conflict from 3.0.3 to 3.1.0

Release notes

Sourced from eps1lon/actions-label-merge-conflict's releases.

v3.1.0

What's Changed

Add better permissions defaults for the example by @oliviertassinari in eps1lon/actions-label-merge-conflict#151

Update Node.js to 24 by @oliviertassinari in eps1lon/actions-label-merge-conflict#152

release: 3.1.0 by @eps1lon in eps1lon/actions-label-merge-conflict#153

New Contributors

@oliviertassinari made their first contribution in eps1lon/actions-label-merge-conflict#151

Full Changelog: eps1lon/actions-label-merge-conflict@v3.0.3...v3.1.0

Changelog

Sourced from eps1lon/actions-label-merge-conflict's changelog.

Changelog

3.1.0

Update Node.js to 24 (#152)

3.0.3

Ensure outputs is populated (#136)

3.0.2

Handle error when label is not available (part 2) (#126)

3.0.1

Handle error when label is not available (#123)

3.0.0

Update to node20 (#115)

2.1.0

Address set-output deprecation (#92 by @NotMyFault)

Fix CVE-2022-35954 (#92 by @NotMyFault)

2.0.1

Improve retry logic (#31 by @eps1lon)

2.0.0

Only update PRs based off of the branch in the push event Previously we checked every open PR. Since a push to a branch can only create merge conflicts with that branch we can limit the set of checked PRs. This should help repositories with lots of PRs targetting different branches with rate limiting.

Only leave comments if the dirtyLabel was added or removed

1.4.0

Allow warning only if secrets aren't available (#22 by @baywet)

Remove requirement for removeOnDirtyLabel (#21 by @baywet)

1.3.0

set PRs and their dirty state as output (#17 by @baywet)

Commits

0273be7 release: 3.1.0 (#153)
9d4606b Update Node.js to 24 (#152)
62d0db0 docs: Add better permissions defaults for the example (#151)
See full diff in compare view

Updates actions/labeler from 6.0.1 to 6.1.0

Release notes

Sourced from actions/labeler's releases.

v6.1.0

Enhancements

Add changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by @bluca in actions/labeler#923

Bug Fixes

Improve Labeler Action documentation and permission error handling by @chiranjib-swain in actions/labeler#897

Preserve manually added labels during workflow runs and refine label synchronization logic by @chiranjib-swain in actions/labeler#917

Dependency Updates

Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by @dependabot in actions/labeler#877

Upgrade minimatch from 10.0.1 to 10.2.3 by @dependabot in actions/labeler#926

Upgrade dependencies (@actions/core, @actions/github, js-yaml, minimatch, @typescript-eslint) by @Copilot in actions/labeler#934

New Contributors

@chiranjib-swain made their first contribution in actions/labeler#897

@bluca made their first contribution in actions/labeler#923

@Copilot made their first contribution in actions/labeler#934

Full Changelog: actions/labeler@v6...v6.1.0

Commits

f27b608 chore: upgrade dependencies (@actions/core, @actions/github, js-yaml, minimat...
c5dadc2 Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...
e52e4fb Bump minimatch from 10.0.1 to 10.2.3 (#926)
77a4082 Fix: Preserve manually added labels during workflow run and refine label sync...
25abb3c Improve Labeler Action Documentation and Error Handling for Permissions (#897)
395c8cf Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...
See full diff in compare view

Updates tiangolo/latest-changes from 0.4.1 to 0.5.0

Release notes

Sourced from tiangolo/latest-changes's releases.

0.5.0

Features

✨ Add support for skipping release PRs with skip_labels, with release skipped by default.

Refactors

🔥 Remove unused models.py file. PR #90 by @tiangolo.

Docs

📝 Add permissions needed for private repos. PR #89 by @tiangolo.

Commits

eb3f6e7 ✨ Add support for skip labels, useful for making a PR with the actual release...
151c5c1 🔥 Remove config files now in central GitHub repo (#95)
82a0fda 👷 Update Dependabot (#92)
2318167 📝 Update release notes
0db4c74 🔥 Remove unused models.py file (#90)
844e4d3 📝 Update release notes
de1d818 📝 Add permissions needed for private repos (#89)
See full diff in compare view

Updates mxschmitt/action-tmate from 3.23 to 3.24

Release notes

Sourced from mxschmitt/action-tmate's releases.

v3.24

What's Changed

chore(deps): bump js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in mxschmitt/action-tmate#236

chore(deps): bump minimatch from 3.1.2 to 3.1.5 by @dependabot[bot] in mxschmitt/action-tmate#237

chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 by @dependabot[bot] in mxschmitt/action-tmate#238

chore(deps-dev): bump @babel/plugin-transform-modules-systemjs from 7.22.11 to 7.29.4 by @dependabot[bot] in mxschmitt/action-tmate#240

Update Node.js runtime from 20 to 24 by @Copilot in mxschmitt/action-tmate#242

New Contributors

@Copilot made their first contribution in mxschmitt/action-tmate#242

Full Changelog: mxschmitt/action-tmate@v3.23...v3.24

Commits

35b54af Update Node.js runtime from 20 to 24 (#242)
ebce6f7 chore(deps-dev): bump @babel/plugin-transform-modules-systemjs (#240)
bc851d8 chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 (#238)
6c825b1 chore(deps): bump minimatch from 3.1.2 to 3.1.5 (#237)
10570f9 Merge pull request #236 from mxschmitt/dependabot/npm_and_yarn/js-yaml-3.14.2
7b3d87e chore(deps): bump js-yaml from 3.14.1 to 3.14.2
See full diff in compare view

Updates astral-sh/setup-uv from 8.1.0 to 8.2.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details. In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token. All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

fix: report unexpected cache save failures @eifinger (#896)

fix: report unexpected setup failures @eifinger (#895)

fix: add timeout to fetch to prevent silent hangs @eifinger-bot (#883)

Limit GitHub tokens to github.com download URLs @zsol (#878)

increase libuv-workaround timeout to 100ms @eifinger (#880)

🚀 Enhancements

Add quiet input to suppress info-level log output @eifinger (#898)

feat: add download-from-astral-mirror input @eifinger (#897)

🧰 Maintenance

docs: update dependabot rollup biome guidance @eifinger (#902)

chore: update known checksums for 0.11.18 @github-actions[bot] (#899)

chore: update known checksums for 0.11.17 @github-actions[bot] (#892)

chore: update known checksums for 0.11.16 @github-actions[bot] (#889)

chore: update known checksums for 0.11.15 @github-actions[bot] (#885)

chore: update known checksums for 0.11.14 @github-actions[bot] (#879)

chore: update known checksums for 0.11.13 @github-actions[bot] (#877)

... (truncated)

Commits

fac544c chore(deps): roll up dependabot updates (#903)
7390f77 docs: update dependabot rollup biome guidance (#902)
363c64a chore(deps): roll up dependabot updates (#901)
c4fcbaf chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#900)
8e642c5 chore: update known checksums for 0.11.18 (#899)
a92cb43 Add quiet input to suppress info-level log output (#898)
e07f2ac chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 (#842)
bc4034e chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 (#893)
df42d4f chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 (#891)
b9c8c4c feat: add download-from-astral-mirror input (#897)
Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.3 to 0.5.6

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.6

1.25.2 is now available via the action

1.25.2 is now the default version of zizmor used by the action

v0.5.5

This is a no-op release.

v0.5.4

1.25.0 is now available via the action

1.25.0 is now the default version of zizmor used by the action

Commits

5f14fd0 Sync zizmor versions (#114)
a16621b Bump pins in README (#112)
1c03e04 chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the github-ac...
b572f7b Sync zizmor versions (#111)
06928c5 chore(deps): bump github/codeql-action in the github-actions group (#109)
5ea8b96 docs: Update link to GitHub docs (#108)
849ac26 chore(deps): bump the github-actions group with 2 updates (#106)
814f977 Bump pins in README (#103)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` | | [eps1lon/actions-label-merge-conflict](https://github.com/eps1lon/actions-label-merge-conflict) | `3.0.3` | `3.1.0` | | [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` | | [tiangolo/latest-changes](https://github.com/tiangolo/latest-changes) | `0.4.1` | `0.5.0` | | [mxschmitt/action-tmate](https://github.com/mxschmitt/action-tmate) | `3.23` | `3.24` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.1.0` | `8.2.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.3` | `0.5.6` | Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) Updates `eps1lon/actions-label-merge-conflict` from 3.0.3 to 3.1.0 - [Release notes](https://github.com/eps1lon/actions-label-merge-conflict/releases) - [Changelog](https://github.com/eps1lon/actions-label-merge-conflict/blob/main/CHANGELOG.md) - [Commits](eps1lon/actions-label-merge-conflict@1df065e...0273be7) Updates `actions/labeler` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@634933e...f27b608) Updates `tiangolo/latest-changes` from 0.4.1 to 0.5.0 - [Release notes](https://github.com/tiangolo/latest-changes/releases) - [Commits](tiangolo/latest-changes@c9d329c...eb3f6e7) Updates `mxschmitt/action-tmate` from 3.23 to 3.24 - [Release notes](https://github.com/mxschmitt/action-tmate/releases) - [Changelog](https://github.com/mxschmitt/action-tmate/blob/master/RELEASE.md) - [Commits](mxschmitt/action-tmate@c0afd6f...35b54af) Updates `astral-sh/setup-uv` from 8.1.0 to 8.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@b1d7e1f...5f14fd0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: eps1lon/actions-label-merge-conflict dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/labeler dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: tiangolo/latest-changes dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: mxschmitt/action-tmate dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-13T10:54:20Z

Labels

The following labels could not be found: github_actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot Bot added dependencies Pull requests that update a dependency file internal labels Jun 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

⬆ Bump the github-actions group across 1 directory with 8 updates#27

⬆ Bump the github-actions group across 1 directory with 8 updates#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-984547842c

dependabot Bot commented on behalf of github Jun 13, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 13, 2026

v6.0.3

What's Changed

New Contributors

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v3.1.0

What's Changed

New Contributors

Changelog

3.1.0

3.0.3

3.0.2

3.0.1

3.0.0

2.1.0

2.0.1

2.0.0

1.4.0

1.3.0

v6.1.0

Enhancements

Bug Fixes

Dependency Updates

New Contributors

0.5.0

Features

Refactors

Docs

v3.24

What's Changed

New Contributors

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

New inputs

quiet

download-from-astral-mirror

Bugfixes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

v7.0.1

What's Changed

v0.5.6

v0.5.5

v0.5.4

Uh oh!

dependabot Bot commented on behalf of github Jun 13, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

v8.2.0 🌈 New inputs `quiet` and `download-from-astral-mirror`