Bump the github-actions group with 5 updates #861

dependabot · 2026-01-01T11:23:44Z

Bumps the github-actions group with 5 updates:

Package	From	To
actions/checkout	`6.0.0`	`6.0.1`
rhysd/actionlint	`1.7.9`	`1.7.10`
cargo-bins/cargo-binstall	`1.16.2`	`1.16.6`
actions/attest-build-provenance	`3.0.0`	`3.1.0`
peter-evans/create-pull-request	`7.0.9`	`8.0.0`

Updates actions/checkout from 6.0.0 to 6.0.1

Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

Commits

8e8c483 Clarify v6 README (#2328)
033fa0d Add worktree support for persist-credentials includeIf (#2327)
c2d88d3 Update all references from v5 and v4 to v6 (#2314)
See full diff in compare view

Updates rhysd/actionlint from 1.7.9 to 1.7.10

Release notes

Sourced from rhysd/actionlint's releases.

v1.7.10
Support YAML anchors and aliases (&anchor and *anchor) in workflow files. In addition to parsing YAML anchors correctly, actionlint checks unused and undefined anchors. See the document for more details. (#133, thanks @srz-zumix for the initial implementation at #568 and @alexaandru for trying another approach at #557)
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      nginx:
        image: nginx:latest
        credentials: &credentials
          username: ${{ secrets.user }}
          password: ${{ secrets.password }}
    steps:
      - run: ./download.sh
        # OK: Valid alias to &credentials
        env: *credentials
      - run: ./check.sh
        # ERROR: Undefined anchor 'credential'
        env: *credential
      - run: ./upload.sh
        # ERROR: Unused anchor 'credentials'
        env: &credentials
Remove support for *-xl macOS runner labels because they were dropped. (#592, thanks @muzimuzhi)

Remove support for the macOS 13 runner labels because they were dropped on Dec 4, 2025. (#593, thanks @muzimuzhi)

macos-13

macos-13-large

macos-13-xlarge

Increase the maximum number of inputs in the workflow_dispatch event from 10 to 25 because the limitation was recently relaxed. (#598, thanks @Haegi)

Support artifact-metadata permission for workflow permissions. (#602, thanks @martincostello)

Detect more complicated constants at if: conditions as error. See the rule document for more details.

Refactor the workflow parser with Go iterators. This slightly improves the performance and memory usage.

Fix parsing extra { and } characters in format string of format() function call. For example v1.7.9 didn't parse "{{0} {1} {2}}" correctly.

Detect an invalid value at type in workflow call inputs as error.

Report YAML merge key << as error because GitHub Actions doesn't support the syntax.
Check available contexts in expressions at jobs.<job_id>.snapshot.if.
snapshot:
  image-name: my-custom-image
  # ERROR: `env` context is not allowed here
  if: ${{ env.USE_SNAPSHOT == 'true' }}
Fix the instruction to install actionlint with mise in the installation document. (#591, thanks @risu729)

Update the popular actions data set to the latest to include new major versions of the actions.

Changelog

Sourced from rhysd/actionlint's changelog.

v1.7.10 - 2025-12-30
Support YAML anchors and aliases (&anchor and *anchor) in workflow files. In addition to parsing YAML anchors correctly, actionlint checks unused and undefined anchors. See the document for more details. (#133, thanks @srz-zumix for the initial implementation at #568 and @alexaandru for trying another approach at #557)
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      nginx:
        image: nginx:latest
        credentials: &credentials
          username: ${{ secrets.user }}
          password: ${{ secrets.password }}
    steps:
      - run: ./download.sh
        # OK: Valid alias to &credentials
        env: *credentials
      - run: ./check.sh
        # ERROR: Undefined anchor 'credential'
        env: *credential
      - run: ./upload.sh
        # ERROR: Unused anchor 'credentials'
        env: &credentials
Remove support for *-xl macOS runner labels because they were dropped. (#592, thanks @muzimuzhi)

Remove support for the macOS 13 runner labels because they were dropped on Dec 4, 2025. (#593, thanks @muzimuzhi)

macos-13

macos-13-large

macos-13-xlarge

Increase the maximum number of inputs in the workflow_dispatch event from 10 to 25 because the limitation was recently relaxed. (#598, thanks @Haegi)

Support artifact-metadata permission for workflow permissions. (#602, thanks @martincostello)

Detect more complicated constants at if: conditions as error. See the rule document for more details.

Refactor the workflow parser with Go iterators. This slightly improves the performance and memory usage.

Fix parsing extra { and } characters in format string of format() function call. For example v1.7.9 didn't parse "{{0} {1} {2}}" correctly.

Detect an invalid value at type in workflow call inputs as error.

Report YAML merge key << as error because GitHub Actions doesn't support the syntax.
Check available contexts in expressions at jobs.<job_id>.snapshot.if.
snapshot:
  image-name: my-custom-image
  # ERROR: `env` context is not allowed here
  if: ${{ env.USE_SNAPSHOT == 'true' }}
Fix the instruction to install actionlint with mise in the installation document. (#591, thanks @risu729)

Update the popular actions data set to the latest to include new major versions of the actions.
[Changes][v1.7.10]

... (truncated)

Commits

0933c14 bump up version to v1.7.10
9ce07bf update popular actions to the latest
6828398 Merge branch 'anchor' (close #568, fix #133)
abc8624 add more example for anchors
ff3994b Merge pull request #602 from martincostello/add-artifact-metadata
c2e42cf fix: add artifact-metadata
64a6ba6 Merge pull request #601 from rhysd/ci/20387448135
16b6af9 update generated files by go generate on CI
567ea3a add aliases of make tasks for playground
95c719a update playground dev dependencies
Additional commits viewable in compare view

Updates cargo-bins/cargo-binstall from 1.16.2 to 1.16.6

Release notes

Sourced from cargo-bins/cargo-binstall's releases.

v1.16.6

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

Upgrade dependencies

v1.16.5

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

Fix crates-io registry not recognised (#2395 #2401)

Fix docs-rs compilation (#2402)

Other changes:

Upgrade dependencies

v1.16.4

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

Upgrade dependencies (#2392)

v1.16.3

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

fix verify GNU libc on armv7 target architecture (#2386 #2387)

Other changes:

Upgrade dependencies (#2382 #2385 #2389)

Commits

80aaafe release: cargo-binstall v1.16.6 (#2411)
c57bd63 chore: release (#2409)
b859d78 build(deps): bump netdev from 0.39.0 to 0.40.0 in the deps group (#2410)
5c3a380 dep: Upgrade transitive dependencies (#2408)
4a90285 release: cargo-binstall v1.16.5 (#2407)
2fa1156 chore: release (#2406)
f4380d1 dep: Upgrade transitive dependencies (#2405)
8a31585 chore: release (#2403)
2bbe012 build(deps): bump toml_edit from 0.23.10+spec-1.0.0 to 0.24.0+spec-1.1.0 in t...
c85f0ee Replace doc_auto_cfg with doc_cfg (#2402)
Additional commits viewable in compare view

Updates actions/attest-build-provenance from 3.0.0 to 3.1.0

Release notes

Sourced from actions/attest-build-provenance's releases.

v3.1.0

What's Changed

Prepare v3 release by @bdehamer in actions/attest-build-provenance#697

Bump js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in actions/attest-build-provenance#749

Bump tar from 7.5.1 to 7.5.2 by @dependabot[bot] in actions/attest-build-provenance#753

Bump glob from 10.4.5 to 10.5.0 by @dependabot[bot] in actions/attest-build-provenance#754

Bump @types/node from 24.10.1 to 25.0.2 by @dependabot[bot] in actions/attest-build-provenance#774

Bump @actions/attest from 1.6.0 to 2.0.0 by @dependabot[bot] in actions/attest-build-provenance#736

Bump @actions/attest from 2.0.0 to 2.1.0 by @dependabot[bot] in actions/attest-build-provenance#775

Add support for creating artifact metadata storage records by @malancas in actions/attest-build-provenance#779

New Contributors

@malancas made their first contribution in actions/attest-build-provenance#779

Full Changelog: actions/attest-build-provenance@v3...v3.1.0

Commits

00014ed Add support for creating artifact metadata storage records (#779)
8835c60 Bump @actions/attest from 2.0.0 to 2.1.0 (#775)
331a7ac Bump @types/node from 24.10.1 to 25.0.2 (#774)
bd4fc03 Bump the npm-development group with 5 updates (#773)
5dea0e5 Bump actions/upload-artifact from 5.0.0 to 6.0.0 (#772)
4f2d058 Bump github/codeql-action in the actions-minor group (#771)
c6f9859 Bump the actions-minor group with 3 updates (#765)
61d781f Bump the npm-development group with 3 updates (#766)
ca0aaa1 Bump the npm-development group with 2 updates (#759)
2dc334f Bump github/codeql-action in the actions-minor group (#760)
Additional commits viewable in compare view

Updates peter-evans/create-pull-request from 7.0.9 to 8.0.0

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.0.0

What's new in v8

Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner for Node 24 support.

What's Changed

chore: Update checkout action version to v6 by @yonas in peter-evans/create-pull-request#4258

Update actions/checkout references to @v6 in docs by @Copilot in peter-evans/create-pull-request#4259

feat: v8 by @peter-evans in peter-evans/create-pull-request#4260

New Contributors

@yonas made their first contribution in peter-evans/create-pull-request#4258

@Copilot made their first contribution in peter-evans/create-pull-request#4259

Full Changelog: peter-evans/create-pull-request@v7.0.11...v8.0.0

Create Pull Request v7.0.11

What's Changed

fix: restrict remote prune to self-hosted runners by @peter-evans in peter-evans/create-pull-request#4250

Full Changelog: peter-evans/create-pull-request@v7.0.10...v7.0.11

Create Pull Request v7.0.10

⚙️ Fixes an issue where updating a pull request failed when targeting a forked repository with the same owner as its parent.

What's Changed

build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in peter-evans/create-pull-request#4235

build(deps-dev): bump prettier from 3.6.2 to 3.7.3 in the npm group by @dependabot[bot] in peter-evans/create-pull-request#4240

fix: provider list pulls fallback for multi fork same owner by @peter-evans in peter-evans/create-pull-request#4245

New Contributors

@obnyis made their first contribution in peter-evans/create-pull-request#4064

Full Changelog: peter-evans/create-pull-request@v7.0.9...v7.0.10

Commits

98357b1 feat: v8 (#4260)
41c0e4b Update actions/checkout references to @v6 in docs (#4259)
994332d chore: Update checkout action version to v6 (#4258)
22a9089 fix: restrict remote prune to self-hosted runners (#4250)
d4f3be6 fix: provider list pulls fallback for multi fork same owner (#4245)
bc8a47f build(deps-dev): bump prettier from 3.6.2 to 3.7.3 in the npm group (#4240)
a67ef28 build(deps): bump the github-actions group with 2 updates (#4235)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.0` | `6.0.1` | | [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.9` | `1.7.10` | | [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) | `1.16.2` | `1.16.6` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `3.0.0` | `3.1.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `7.0.9` | `8.0.0` | Updates `actions/checkout` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@1af3b93...8e8c483) Updates `rhysd/actionlint` from 1.7.9 to 1.7.10 - [Release notes](https://github.com/rhysd/actionlint/releases) - [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md) - [Commits](rhysd/actionlint@a443f34...0933c14) Updates `cargo-bins/cargo-binstall` from 1.16.2 to 1.16.6 - [Release notes](https://github.com/cargo-bins/cargo-binstall/releases) - [Changelog](https://github.com/cargo-bins/cargo-binstall/blob/main/release-plz.toml) - [Commits](cargo-bins/cargo-binstall@3fc8167...80aaafe) Updates `actions/attest-build-provenance` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@977bb37...00014ed) Updates `peter-evans/create-pull-request` from 7.0.9 to 8.0.0 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@84ae59a...98357b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: rhysd/actionlint dependency-version: 1.7.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: cargo-bins/cargo-binstall dependency-version: 1.16.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/attest-build-provenance dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: peter-evans/create-pull-request dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 1, 2026

dependabot bot requested a review from a team as a code owner January 1, 2026 11:23

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 1, 2026

yoshuawuyts approved these changes Jan 1, 2026

View reviewed changes

yoshuawuyts added this pull request to the merge queue Jan 1, 2026

Merged via the queue into main with commit 66e3bd8 Jan 1, 2026
3 checks passed

yoshuawuyts deleted the dependabot/github_actions/github-actions-9af30ef684 branch January 1, 2026 21:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the github-actions group with 5 updates #861

Bump the github-actions group with 5 updates #861

Uh oh!

dependabot bot commented on behalf of github Jan 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump the github-actions group with 5 updates #861

Bump the github-actions group with 5 updates #861

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 1, 2026

v6.0.1

What's Changed

v1.7.10

v1.7.10 - 2025-12-30

v1.16.6

In this release:

v1.16.5

In this release:

Other changes:

v1.16.4

In this release:

v1.16.3

In this release:

Other changes:

v3.1.0

What's Changed

New Contributors

Create Pull Request v8.0.0

What's new in v8

What's Changed

New Contributors

Create Pull Request v7.0.11

What's Changed

Create Pull Request v7.0.10

What's Changed

New Contributors

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants