build(deps): bump the github-actions group across 1 directory with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates in the / directory: github/gh-aw, actions/cache and actions/download-artifact.

Updates github/gh-aw from 0.45.0 to 0.49.0

Release notes

Sourced from github/gh-aw's releases.

v0.49.0

🌟 Release Highlights

This release focuses on security hardening, safe outputs flexibility, and code quality improvements — making workflows more robust and configurable.

🔒 Security Hardening

Critical security fixes and hardening across the codebase:

• Shell injection fix in upload_assets.cjs — closes an incomplete fix from a prior commit (#17736)
• Hardened exec.Command invocations for cross-platform compatibility and security across the codebase (#17729)

✨ What's New

• Templatable boolean & integer fields in safe outputs — workflow authors can now use template expressions for boolean flags and integer max fields, enabling dynamic configuration without recompilation (#17653, #17667, #17694)
• expires codemod — a migration helper that automatically converts integer expires values to the new day-string format, making upgrades seamless (#17695)
• Configurable bot trigger neutralization — safe-outputs.max-bot-mentions controls how many bot trigger references are preserved vs. escaped, with smarter handling for already-quoted entries (#17689)
• Source links in GitHub MCP tools report — the MCP tools report now includes direct links to source definitions, improving discoverability (#17709)
• MCP Gateway updated to v0.1.5 (#17697)

🐛 Bug Fixes & Improvements

• Fixed base64 executable not found on Windows during gh aw update (#17720)
• Resolved 22 actionlint expression errors caused by missing needs: declarations in 4 workflows (#17681)
• Fixed ci-doctor to pre-download logs and artifacts, applying generic error heuristics to reduce token usage (#17719)
• Replaced curl | sh uv install with pinned astral-sh/setup-uv action for more reliable CI (#17688)

🔧 Internal

• Enabled 16 additional Go linters + modernize and intrange linters with all issues resolved (#17714, #17705)
• Normalized report formatting across multiple internal workflows (#17727, #17698)

---

For complete details, see CHANGELOG.

Generated by Release

---

What's Changed

• [docs] Update dictation skill instructions by @​github-actions[bot] in github/gh-aw#17665
• Convert boolean safe output fields to templatable bools by @​Copilot in github/gh-aw#17653
• Add templatable integer support for safe output max fields by @​Copilot in github/gh-aw#17667
• Fix SC2129: use grouped redirect for prompt construction in compiler template by @​Copilot in github/gh-aw#17687
• Replace curl | sh uv install with pinned astral-sh/setup-uv action by @​Copilot in github/gh-aw#17688
• Update safe outputs spec with templatable boolean and integer fields by @​Copilot in github/gh-aw#17694
• Normalize report formatting for step-name-alignment and bot-detection workflows by @​Copilot in github/gh-aw#17698
• Add codemod to migrate expires integer values to day-string format by @​Copilot in github/gh-aw#17695

... (truncated)

Changelog

Sourced from github/gh-aw's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

• 0eb518a fix: close shell injection in upload_assets.cjs (incomplete fix from d07e64c3...
• 4b8d0a8 Review and harden all exec.Command invocations for cross-platform compatibili...
• dce6f84 Enable 16 additional Go linters and fix all reported issues (#17714)
• 18ff0b0 fix: use strings.Cut to resolve stringscut lint violation in known_needs_expr...
• a5ee151 Normalize report formatting in org-health-report and daily-safe-outputs-confo...
• 1a4a937 neutralizeBotTriggers: allow first n references unchanged then escape excess,...
• 8461cb6 Fix base64 executable not found on Windows in gh aw update (#17720)
• 6221cdc fix(ci-doctor): pre-download logs and artifacts, apply generic error heuristi...
• c99d014 Add source links to GitHub MCP tools report (#17709)
• 784b253 Update MCP Gateway to v0.1.5 (#17697)
• Additional commits viewable in compare view

Updates actions/cache from 4.3.0 to 5.0.3

Release notes

Sourced from actions/cache's releases.

v5.0.3

What's Changed

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

---

v5.0.1

What's Changed

• fix: update @​actions/cache for Node.js 24 punycode deprecation by @​salmanmkc in actions/cache#1685
• prepare release v5.0.1 by @​salmanmkc in actions/cache#1686

v5.0.0

What's Changed

• Upgrade to use node24 by @​salmanmkc in actions/cache#1630
• Prepare v5.0.0 release by @​salmanmkc in actions/cache#1684

Full Changelog: actions/cache@v5...v5.0.1

v5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

---

What's Changed

• Upgrade to use node24 by @​salmanmkc in actions/cache#1630

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

• Bump @actions/cache to v5.0.3 #1692

5.0.1

• Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

4.3.0

• Bump @actions/cache to v4.1.0

... (truncated)

Commits

• cdf6c1f Merge pull request #1695 from actions/Link-/prepare-5.0.3
• a1bee22 Add review for the @​actions/http-client license
• 4695763 Add licensed output
• dc73bb9 Upgrade dependencies and address security warnings
• 345d5c2 Add 5.0.3 builds
• 8b402f5 Merge pull request #1692 from GhadimiR/main
• 304ab5a license for httpclient
• 609fc19 Update licensed record for cache
• b22231e Build
• 93150cd Add PR link to releases
• Additional commits viewable in compare view

Updates actions/download-artifact from 6.0.0 to 7.0.0

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in actions/download-artifact#440
• Download Artifact Node24 support by @​salmanmkc in actions/download-artifact#415
• fix: update @​actions/artifact to fix Node.js 24 punycode deprecation by @​salmanmkc in actions/download-artifact#451
• prepare release v7.0.0 for Node.js 24 support by @​salmanmkc in actions/download-artifact#452

New Contributors

• @​patrikpolyak made their first contribution in actions/download-artifact#440
• @​salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

Commits

• 37930b1 Merge pull request #452 from actions/download-artifact-v7-release
• 72582b9 doc: update readme
• 0d2ec9d chore: release v7.0.0 for Node.js 24 support
• fd7ae8f Merge pull request #451 from actions/fix-storage-blob
• d484700 chore: restore minimatch.dep.yml license file
• 03a8080 chore: remove obsolete dependency license files
• 56fe6d9 chore: update @​actions/artifact license file to 5.0.1
• 8e3ebc4 chore: update package-lock.json with @​actions/artifact@​5.0.1
• 1e3c4b4 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
• 458627d chore: use local @​actions/artifact package for Node.js 24 testing
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[fr4nc1sc0-r4m0n]

LGTM