ci: bump the actions group across 2 directories with 7 updates by dependabot[bot] · Pull Request #9839 · simstudioai/sim

dependabot · 2026-11-10T17:11:14Z

Bumps the actions group with 6 updates in the / directory:

Package	From	To
docker/login-action	`4.7.0`	`4.8.0`
sigstore/cosign-installer	`4.1.2`	`4.1.3`
actions/setup-java	`6.1.0`	`6.2.0`
actions/setup-dotnet	`6.0.0`	`6.1.0`
helm/kind-action	`1.15.1`	`1.15.2`
softprops/action-gh-release	`3.0.3`	`3.0.4`

Bumps the actions group with 1 update in the /.github/actions/image directory: useblacksmith/setup-docker-builder.

Updates docker/login-action from 4.7.0 to 4.8.0

Release notes

Sourced from docker/login-action's releases.

v4.8.0

Set Docker Hub OIDC token lifetime default to 1 hour by @crazy-max in docker/login-action#1070

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1161.0 in docker/login-action#1103

Bump @docker/actions-toolkit from 0.107.0 to 0.109.0 in docker/login-action#1105

Bump vite from 7.3.6 to 7.3.7 in docker/login-action#1101

Full Changelog: docker/login-action@v4.7.0...v4.8.0

Commits

8aa5831 Merge pull request #1105 from docker/dependabot/npm_and_yarn/docker/actions-t...
043f81d [dependabot skip] chore: update generated content
3ff6998 build(deps): bump @docker/actions-toolkit from 0.107.0 to 0.109.0
694ef6a Merge pull request #1103 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
7c6e412 [dependabot skip] chore: update generated content
aa2441f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
d6c10b0 Merge pull request #1106 from docker/dependabot/github_actions/codeql-actions...
319f1ee Merge pull request #1104 from docker/dependabot/github_actions/actions/setup-...
b483b7f Merge pull request #1101 from docker/dependabot/npm_and_yarn/vite-7.3.7
dc7d67c Merge pull request #1070 from crazy-max/increase-oidc-default-expiry
Additional commits viewable in compare view

Updates sigstore/cosign-installer from 4.1.2 to 4.1.3

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.3

What's Changed

Bump Cosign to v3.1.4 (latest release) in sigstore/cosign-installer#257

Full Changelog: sigstore/cosign-installer@v4.1.2...v4.1.3

Commits

756fe2d Bump Cosign to v3.1.4 (latest release) (#257)
b9c3539 Bump actions/setup-go from 6.4.0 to 7.0.0 (#249)
84205a0 close race on windows due to reusing filename (#253)
af595e6 Bump cosign to 3.1.3 (#252)
828df1e fix: harden curl download retries against transient GitHub CDN 504s (#240)
874852d Bump actions/checkout from 6.0.2 to 7.0.1 (#250)
3094a48 wrap path in quotes for powershell (#246)
e246ae3 test minimum of 1.26 given cosign requirement (#247)
See full diff in compare view

Updates actions/setup-java from 6.1.0 to 6.2.0

Release notes

Sourced from actions/setup-java's releases.

v6.2.0

What's Changed

Fix Liberica SDKMAN patch release resolution by @brunoborges in actions/setup-java#1291

Update Undici to 6.29.1 by @brunoborges in actions/setup-java#1308

chore(deps): bump the monthly-npm-updates group with 12 updates by @dependabot[bot] in actions/setup-java#1309

Fix Liberica Java 25 release resolution by @brunoborges in actions/setup-java#1313

Add repository-specific Copilot instructions by @brunoborges in actions/setup-java#1312

Support exact Corretto release versions by @electrum in actions/setup-java#1310

Support Maven mirrors in generated settings.xml by @brunoborges in actions/setup-java#1289

New Contributors

@electrum made their first contribution in actions/setup-java#1310

Full Changelog: actions/setup-java@v6.1.0...v6.2.0

Commits

77dd5b2 Support Maven mirrors in generated settings.xml (#1289)
644a850 Support exact Corretto release versions (#1310)
dade0c5 Save uncommitted changes (#1312)
ef0b922 Fix Liberica Java 25 release resolution (#1313)
e144521 chore(deps): bump the monthly-npm-updates group with 12 updates (#1309)
8cd57eb Update Undici to 6.29.1 (#1308)
816722a Fix Liberica SDKMAN patch release resolution (#1291)
See full diff in compare view

Updates actions/setup-dotnet from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.1.0

What's Changed

Enhancements

Add check-latest input to reuse a locally installed .NET SDK and skip network calls by @v-mahabaleshwars in actions/setup-dotnet#774

Add skip-lts-prepass input to optimize .NET SDK installation process by @v-chiranjib-swain in actions/setup-dotnet#791

Add fallback install directory when default is not writable by @v-priyagupta108 in actions/setup-dotnet#785

Documentation

Document sdk.version validation for rollForward in global.json by @v-priyagupta108 in actions/setup-dotnet#763

Docs: Add Microsoft docs link for dotnet-quality options by @v-priyagupta108 in actions/setup-dotnet#773

Docs: Updating Documentation in README by @v-lmvysakh in actions/setup-dotnet#776

Clarify dotnet-quality behavior for multiple SDK versions by @v-mahabaleshwars in actions/setup-dotnet#780

Dependency Updates

Fix security vulnerabilities by @v-HarithaVattikuti in actions/setup-dotnet#767

ci: make validation caches read-only by @philip-gai in actions/setup-dotnet#777

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#764

Bump browserslist from 4.28.2 to 4.28.8 by @dependabot in actions/setup-dotnet#781

Bump eslint from 10.5.0 to 10.11.0 by @dependabot in actions/setup-dotnet#772

Bump eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-dotnet#771

Bump undici from 6.28.0 to 6.29.1 by @dependabot in actions/setup-dotnet#784

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#788

Bump handlebars from 4.7.9 to 4.7.10 by @dependabot in actions/setup-dotnet#792

Bump brace-expansion by @dependabot in actions/setup-dotnet#790

Prepare v6.1.0 release with updated cache dependency by @v-HarithaVattikuti in actions/setup-dotnet#798

New Contributors

@v-lmvysakh made their first contribution in actions/setup-dotnet#776

@v-chiranjib-swain made their first contribution in actions/setup-dotnet#791

Full Changelog: actions/setup-dotnet@v6.0.0...v6.1.0

Commits

0f4a354 Prepare v6.1.0 release with updated cache dependency (#798)
6ec5c6b Add fallback install directory when default is not writable (#785)
62573f4 Bump brace-expansion (#790)
67290a9 Bump handlebars from 4.7.9 to 4.7.10 (#792)
0072421 Bump actions/checkout from 7.0.0 to 7.0.1 (#788)
9ead317 Bump undici from 6.28.0 to 6.29.1 (#784)
349aa19 Add skip-lts-prepass input to optimize .NET SDK installation process (#791)
e2cf7c6 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#771)
7576362 Bump eslint from 10.5.0 to 10.11.0 (#772)
074373f Add check-latest input to reuse a locally installed .NET SDK and skip network...
Additional commits viewable in compare view

Updates helm/kind-action from 1.15.1 to 1.15.2

Release notes

Sourced from helm/kind-action's releases.

v1.15.2

What's Changed

feat(#38): add support for windows and mac os runners by @Jeff-Tian in helm/kind-action#159

docs: explain kind networking in job containers by @cpanato in helm/kind-action#172

fix: validate kind checksum downloads by @cpanato in helm/kind-action#171

New Contributors

@Jeff-Tian made their first contribution in helm/kind-action#159

Full Changelog: helm/kind-action@v1.15.1...v1.15.2

Commits

ea822c7 fix: validate kind checksum downloads (#171)
55fa927 docs: explain kind networking in job containers (#172)
4852af4 feat(#38): add support for windows and mac os runners (#159)
See full diff in compare view

Updates softprops/action-gh-release from 3.0.3 to 3.0.4

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.4

maintenance release with updated dependencies

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.4

maintenance release with updated dependencies

3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

fix: safely classify GitHub API errors by @chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

dependency updates

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

feat: improve release error reporting and test coverage by @chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

fix: publish existing draft releases as prereleases by @godfengliang in softprops/action-gh-release#801

fix: upload small checksum assets reliably by @chenrui333 in softprops/action-gh-release#815

fix: replace existing release assets on Gitea by @chenrui333 in softprops/action-gh-release#816

fix: clarify release creation 404 errors by @chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

chore(deps): upgrade TypeScript to 7 by @chenrui333 in softprops/action-gh-release#812

chore(deps): remove unused TypeScript tooling by @chenrui333 in softprops/action-gh-release#814

dependency, Node 24 pin, and CI maintenance merged since 3.0.1

... (truncated)

Commits

8a0cd65 release 3.0.4 (#865)
ac01154 chore(deps): bump the npm group across 1 directory with 4 updates (#864)
ca4c9d5 chore(deps): bump minimatch and glob (#862)
e4a57ae chore(deps): bump undici from 6.29.0 to 6.29.1 (#859)
ee55a0e chore(deps): bump vite from 8.3.2 to 8.3.5 (#855)
8d42b22 chore(deps): bump actions/setup-node (#853)
6680cc0 chore(deps): bump the npm group with 3 updates (#851)
4a050ba chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#850)
b5a645e chore(deps): bump the npm group with 4 updates (#848)
d99a5de chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 (#846)
Additional commits viewable in compare view

Updates useblacksmith/setup-docker-builder from 2.2.0 to 2.3.0

Release notes

Sourced from useblacksmith/setup-docker-builder's releases.

v2.3.0

What's Changed

Other Changes

post: skip sticky disk cleanup when this step reused an existing buildkitd (release/v2) by @bruce-y in useblacksmith/setup-docker-builder#137

post: fstrim the buildkit sticky disk before unmount at commit by @magma-beef in useblacksmith/setup-docker-builder#143

deps: bump axios to 1.20.0 and remove stale package-lock.json (release/v2) by @rcooney-sh in useblacksmith/setup-docker-builder#142

New Contributors

@magma-beef made their first contribution in useblacksmith/setup-docker-builder#143

Full Changelog: useblacksmith/setup-docker-builder@v2.2.0...v2.3.0

Commits

06dd9c8 deps: bump axios to 1.20.0 and remove stale package-lock.json (release/v2) (#...
ec85cd5 post: fstrim the buildkit sticky disk before unmount at commit (#143)
ded4bfd post: skip sticky disk cleanup when this step reused an existing buildkitd (r...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.7.0` | `4.8.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.2` | `4.1.3` | | [actions/setup-java](https://github.com/actions/setup-java) | `6.1.0` | `6.2.0` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `6.0.0` | `6.1.0` | | [helm/kind-action](https://github.com/helm/kind-action) | `1.15.1` | `1.15.2` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.3` | `3.0.4` | Bumps the actions group with 1 update in the /.github/actions/image directory: [useblacksmith/setup-docker-builder](https://github.com/useblacksmith/setup-docker-builder). Updates `docker/login-action` from 4.7.0 to 4.8.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@81c6f93...8aa5831) Updates `sigstore/cosign-installer` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@6f9f177...756fe2d) Updates `actions/setup-java` from 6.1.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b843ebf...77dd5b2) Updates `actions/setup-dotnet` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@a98b568...0f4a354) Updates `helm/kind-action` from 1.15.1 to 1.15.2 - [Release notes](https://github.com/helm/kind-action/releases) - [Commits](helm/kind-action@1544676...ea822c7) Updates `softprops/action-gh-release` from 3.0.3 to 3.0.4 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@efb3536...8a0cd65) Updates `useblacksmith/setup-docker-builder` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/useblacksmith/setup-docker-builder/releases) - [Commits](useblacksmith/setup-docker-builder@1921511...06dd9c8) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-java dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-dotnet dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: helm/kind-action dependency-version: 1.15.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: useblacksmith/setup-docker-builder dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-11-10T17:11:18Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 10, 2026 5:16pm UTC

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 10, 2026

waleedlatif1 merged commit ddc7f04 into staging Nov 10, 2026
32 of 33 checks passed

waleedlatif1 deleted the dependabot/github_actions/staging/actions-5285a8128f branch November 10, 2026 17:11

vercel Bot deployed to Preview November 10, 2026 17:16

View deployment

waleedlatif1 mentioned this pull request Nov 11, 2026

v0.9.53: saved credentials with keyless AWS and Databricks OIDC, read-only API keys, workspace members endpoint, trigger health and pinned versions, proxy support, search source permissions #9871

Merged

Navigation Menu

Repository navigation

ci: bump the actions group across 2 directories with 7 updates - #9839

ci: bump the actions group across 2 directories with 7 updates#9839
waleedlatif1 merged 1 commit into
stagingfrom
dependabot/github_actions/staging/actions-5285a8128f

dependabot Bot commented on behalf of github Nov 10, 2026

Uh oh!

vercel Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 10, 2026

v4.8.0

v4.1.3

What's Changed

v6.2.0

What's Changed

New Contributors

v6.1.0

What's Changed

Enhancements

Documentation

Dependency Updates

New Contributors

v1.15.2

What's Changed

New Contributors

v3.0.4

3.0.4

3.0.3

What's Changed

Bug fixes 🐛

Other Changes 🔄

3.0.2

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

v2.3.0

What's Changed

Other Changes

New Contributors

Uh oh!

vercel Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 10, 2026 •

edited

Loading