Skip to content

chore(deps): bump github-actions#23

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/github-actions
Jun 2, 2026
Merged

chore(deps): bump github-actions#23
renovate[bot] merged 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Jun 2, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/attest-build-provenance action minor v2.1.0v2.4.0
actions/checkout action minor v4.2.2v4.3.1
actions/download-artifact action minor v4.1.8v4.3.0
actions/setup-node action minor v4.1.0v4.4.0
actions/upload-artifact action minor v4.4.3v4.6.2
ghcr.io/charmbracelet/vhs container minor v0.10.0v0.11.0
googleapis/release-please-action action minor v4.1.3v4.4.1
pnpm/action-setup action minor v4.1.0v4.4.0
softprops/action-gh-release action minor v2.0.9v2.6.2

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v2.4.0

Compare Source

What's Changed
  • Bump undici from 5.28.5 to 5.29.0 by @​dependabot in #​633
  • Bump actions/attest from 2.3.0 to 2.4.0 by @​bdehamer in #​654
    • Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run

Full Changelog: actions/attest-build-provenance@v2.3.0...v2.4.0

v2.3.0

Compare Source

What's Changed
  • Bump actions/attest from 2.2.1 to 2.3.0 by @​bdehamer in #​615
    • Updates @sigstore/oci from 0.4.0 to 0.5.0

Full Changelog: actions/attest-build-provenance@v2.2.3...v2.3.0

v2.2.3

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.2...v2.2.3

v2.2.2

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.1...v2.2.2

v2.2.1

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Changed

  • Bump actions/attest from v2.1.0 to v2.2.0 by @​bdehamer in #​449
    • Includes support for now subject-checksums input parameter

Full Changelog: actions/attest-build-provenance@v2.1.0...v2.2.0

actions/checkout (actions/checkout)

v4.3.1

Compare Source

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

actions/download-artifact (actions/download-artifact)

v4.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v4.2.1...v4.3.0

v4.2.1

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v4.2.0...v4.2.1

v4.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v4.1.9...v4.2.0

v4.1.9

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v4.1.8...v4.1.9

actions/setup-node (actions/setup-node)

v4.4.0

Compare Source

What's Changed
Bug fixes:
Enhancement:
Dependency update:
New Contributors

Full Changelogactions/setup-node@v4...v4.4.0

v4.3.0

Compare Source

What's Changed
Dependency updates
New Contributors

Full Changelog: actions/setup-node@v4...v4.3.0

v4.2.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/setup-node@v4...v4.2.0

actions/upload-artifact (actions/upload-artifact)

v4.6.2

Compare Source

What's Changed

  • Update to use artifact 2.3.2 package & prepare for new upload-artifact release by @​salmanmkc in #​685

New Contributors

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.1

v4.6.0

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.0

v4.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0

charmbracelet/vhs (ghcr.io/charmbracelet/vhs)

v0.11.0

Compare Source

Scroll? More keys?

This release includes two nice features that include scrolling the viewport and supporting Ctrl+<arrow> keys. You can now use the ScrollUp and ScrollDown commands to scroll the viewport. VHS will also now recognize Ctrl+Left/Up/Right/Down keys.

Thanks to @​joshka-oai and @​sectore for their gracious contributions and support 🙂

Changelog

New!
Fixed
Other stuff

Verifying the artifacts

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/vhs/releases/download/v0.11.0/checksums.txt'
wget 'https://github.com/charmbracelet/vhs/releases/download/v0.11.0/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

googleapis/release-please-action (googleapis/release-please-action)

v4.4.1

Compare Source

v4.4.0

Compare Source

Features
  • add ability to select versioning-strategy and release-as (#​1121) (ee0f5ba)
Bug Fixes
  • changelog-host parameter ignored when using manifest configuration (#​1151) (535c413)
  • bump mocha from 11.7.1 to 11.7.2 in the npm_and_yarn group across 1 directory (#​1149) (3612a99)
  • bump release-please from 17.1.2 to 17.1.3 (#​1158) (66fbfe9)

v4.4

Compare Source

v4.3.0

Compare Source

Features
  • deps: update release-please to 17.1.2 (f07192c)

v4.3

Compare Source

v4.2.0

Compare Source

Features
  • support for skip-labeling parameter for GitHub action (#​1066) (fb7f385)

v4.2

Compare Source

v4.1.5

Compare Source

Bug Fixes

v4.1.4

Compare Source

Bug Fixes
pnpm/action-setup (pnpm/action-setup)

v4.4.0

Compare Source

Updated the action to use Node.js 24.

v4.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v4.2.0...v4.3.0

v4.2.0

Compare Source

When there's a .npmrc file at the root of the repository, pnpm will be fetched from the registry that is specified in that .npmrc file #​179

softprops/action-gh-release (softprops/action-gh-release)

v2.6.2

Compare Source

What's Changed

Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.6.2

v2.6.1

Compare Source

2.6.1 is a patch release focused on restoring linked discussion thread creation when
discussion_category_name is set. It fixes #764, where the draft-first publish flow
stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

v2.6.0

Compare Source

2.6.0 is a minor release centered on previous_tag support for generate_release_notes,
which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range.
It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync,
a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where
GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Exciting New Features 🎉
Bug fixes 🐛
Other Changes 🔄

v2.5.3

Compare Source

2.5.3 is a patch release focused on the remaining path-handling and release-selection bugs uncovered after 2.5.2.
It fixes #639, #571, #280, #614, #311, #403, and #368.
It also adds documentation clarifications for #541, #645, #542, #393, and #411,
where the current behavior is either usage-sensitive or constrained by GitHub platform limits rather than an action-side runtime bug.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed
Bug fixes 🐛
Other Changes 🔄
  • docs: clarify token precedence by @​chenrui333 in #​752
  • docs: clarify GitHub release limits by @​chenrui333 in #​758
  • documentation clarifications for empty-token handling, preserve_order, and special-character asset filename behavior

Full Changelog: softprops/action-gh-release@v2...v2.5.3

v2.5.2

Compare Source

2.5.2 is a patch release focused on the remaining release-creation and prerelease regressions in the 2.5.x bug-fix cycle.
It fixes #705, fixes #708, fixes #740, fixes #741, and fixes #722.
Regression testing covers the shared-tag race, prerelease event behavior, dotfile asset labels,
same-filename concurrent uploads, and blocked-tag cleanup behavior.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

New Contributors

Full Changelog: softprops/action-gh-release@v2...v2.5.2

v2.5.1

Compare Source

2.5.1 is a patch release focused on regressions introduced in 2.5.0 and on release lookup reliability.
It fixes #713, addresses #703, and fixes #724. Regression testing shows that
current master no longer reproduces the finalize-race behavior reported in #704 and #709.

What's Changed
Bug fixes 🐛
Other Changes 🔄
  • dependency updates, including the ESM/runtime compatibility refresh in #​731
New Contributors

Full Changelog: softprops/action-gh-release@v2...v2.5.1

v2.5.0

Compare Source

What's Changed

Exciting New Features 🎉
Other Changes 🔄
  • chore(deps): bump the npm group across 1 directory with 5 updates by @​dependabot[bot] in #​697
  • chore(deps): bump actions/checkout from 5.0.0 to 5.0.1 in the github-actions group by @​dependabot[bot] in #​689

New Contributors

Full Changelog: softprops/action-gh-release@v2.4.2...v2.5.0

v2.4.2

Compare Source

What's Changed

Exciting New Features 🎉
  • feat: Ensure generated release notes cannot be over 125000 characters by @​BeryJu in #​684
Other Changes 🔄
  • dependency updates

New Contributors

Full Changelog: softprops/action-gh-release@v2.4.1...v2.4.2

v2.4.1

Compare Source

What's Changed

Other Changes 🔄
  • fix(util): support brace expansion globs containing commas in parseInputFiles by @​Copilot in #​672
  • fix: gracefully fallback to body when body_path cannot be read by @​Copilot in #​671

Full Changelog: softprops/action-gh-release@v2...v2.4.1

v2.4.0

Compare Source

What's Changed

Exciting New Features 🎉
Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2.3.4...v2.4.0

v2.3.4

Compare Source

What's Changed

Bug fixes 🐛
Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.3.4

v2.3.3

Compare Source

What's Changed

Exciting New Features 🎉
Other Changes 🔄
  • dependency updates

New Contributors

Full Changelog: softprops/action-gh-release@v2...v2.3.3

v2.3.2

Compare Source

  • fix: revert fs readableWebStream change

v2.3.1

Compare Source

What's Changed

Bug fixes 🐛

New Contributors

Full Changelog: softprops/action-gh-release@v2.3.0...v2.3.1

v2.3.0

Compare Source

  • Migrate from jest to vitest
  • Replace mime with mime-types
  • Bump to use node 24
  • Dependency updates

Full Changelog: softprops/action-gh-release@v2.2.2...v2.3.0

v2.2.2

Compare Source

What's Changed

Bug fixes 🐛
Other Changes 🔄

New Contributors

Full Changelog: softprops/action-gh-release@v2.2.1...v2.2.2

v2.2.1

Compare Source

What's Changed

Bug fixes 🐛
Other Changes 🔄

New Contributors

Full Changelog: softprops/action-gh-release@v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Change

Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "before 6am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot enabled auto-merge (squash) June 2, 2026 07:07
@renovate renovate Bot force-pushed the renovate/github-actions branch 2 times, most recently from 6d543d1 to 84b2a47 Compare June 2, 2026 07:20
@renovate renovate Bot force-pushed the renovate/github-actions branch from 84b2a47 to b73219a Compare June 2, 2026 09:01
@renovate renovate Bot merged commit d7f9f42 into main Jun 2, 2026
7 checks passed
@renovate renovate Bot deleted the renovate/github-actions branch June 2, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants