Skip to content

ci: bump the github-actions group across 1 directory with 4 updates - #47

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-78668bcac5
Closed

ci: bump the github-actions group across 1 directory with 4 updates#47
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-78668bcac5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 4 updates in the / directory: faustbrian/go-library-tools/.github/workflows/library-assurance.yml, faustbrian/go-library-tools/.github/workflows/library-ci.yml, actions/setup-node and actions/upload-artifact.

Updates faustbrian/go-library-tools/.github/workflows/library-assurance.yml from 70a5d7da3531b5c3ab2c2fdfa8aa3cba8211afc5 to ef9ae418c61b6b92d8d93c03d71694031ec47ed8

Changelog

Sourced from faustbrian/go-library-tools/.github/workflows/library-assurance.yml's changelog.

Changelog

All notable changes to this project are documented in this file.

Unreleased

Changed

  • Clarify the ecosystem HTTP recommendation around the supported net/http transport, link Service-owned comparison evidence and keep Fiber/fasthttp in a separate architecture track requiring its own compatibility and maintenance commitment before adapter support.

2.5.2 - 2026-10-22

Fixed

  • Bind binary runtime attribution to the verified Go 1.27.3 license and patent files while retaining exact runtime and source-digest admission.
  • Admit only exact public synthetic Authentication JWT verification-vector lines in the central secret policy; changed tokens, other paths and unrelated credential detectors remain findings.

Changed

  • Publish the current source and documentation with a fresh immutable tag.
  • Build with Go 1.27.3 to address GO-2026-6809 in crypto/x509. Consumers should use Go 1.27.3 or newer.

2.5.1 - 2026-10-14

Fixed

  • Separate release dry-run security and candidate packaging from runtime qualification. Dry-runs no longer start services or rerun full tests, race, coverage, mutation, lint and documentation campaigns. Required ordinary CI, security scans, SBOMs, tag collision checks and module-proxy resolution remain; affected-contract qualification and clean public consumption stay separate.
  • Keep ordinary module contracts in reusable release CI and bound hosted rehearsal jobs to 30 minutes instead of six hours.
  • Route cold mutation-verifier construction to selected hosted integration checks for verifier, dependency or toolchain changes, not every ordinary test run. Preserve the finite-execution assertions and fatal failures.

2.5.0 - 2026-10-13

Recorded as a prepared release candidate on this date; public availability requires the v2.5.0 tag and release.

Added

... (truncated)

Commits
  • ef9ae41 fix(release): align runtime attribution with Go 1.27.3
  • 99b8e9e test(security): iterate policy blocks without allocation
  • 2db250a test(security): distinguish synthetic fixture policy checks
  • 7cf7db6 fix(security): recognize exact public authentication vectors
  • 58e0e92 fix(tooling): build isolated analyzers with Go 1.27.3
  • 02c21d5 fix(ci): align the public consumer compiler guard
  • fd63509 fix(build): use the patched Go 1.27.3 toolchain
  • fdc6702 chore(release): prepare current source tags
  • baaaaea docs(ecosystem): clarify HTTP transport guidance
  • 09b43f4 fix(ci): select hosted verifier qualification
  • Additional commits viewable in compare view

Updates faustbrian/go-library-tools/.github/workflows/library-ci.yml from 2.5.1 to 2.5.2

Release notes

Sourced from faustbrian/go-library-tools/.github/workflows/library-ci.yml's releases.

v2.5.2

What's Changed

Full Changelog: faustbrian/go-library-tools@v2.5.1...v2.5.2

Changelog

Sourced from faustbrian/go-library-tools/.github/workflows/library-ci.yml's changelog.

Changelog

All notable changes to this project are documented in this file.

Unreleased

Changed

  • Clarify the ecosystem HTTP recommendation around the supported net/http transport, link Service-owned comparison evidence and keep Fiber/fasthttp in a separate architecture track requiring its own compatibility and maintenance commitment before adapter support.

2.5.2 - 2026-10-22

Fixed

  • Bind binary runtime attribution to the verified Go 1.27.3 license and patent files while retaining exact runtime and source-digest admission.
  • Admit only exact public synthetic Authentication JWT verification-vector lines in the central secret policy; changed tokens, other paths and unrelated credential detectors remain findings.

Changed

  • Publish the current source and documentation with a fresh immutable tag.
  • Build with Go 1.27.3 to address GO-2026-6809 in crypto/x509. Consumers should use Go 1.27.3 or newer.

2.5.1 - 2026-10-14

Fixed

  • Separate release dry-run security and candidate packaging from runtime qualification. Dry-runs no longer start services or rerun full tests, race, coverage, mutation, lint and documentation campaigns. Required ordinary CI, security scans, SBOMs, tag collision checks and module-proxy resolution remain; affected-contract qualification and clean public consumption stay separate.
  • Keep ordinary module contracts in reusable release CI and bound hosted rehearsal jobs to 30 minutes instead of six hours.
  • Route cold mutation-verifier construction to selected hosted integration checks for verifier, dependency or toolchain changes, not every ordinary test run. Preserve the finite-execution assertions and fatal failures.

2.5.0 - 2026-10-13

Recorded as a prepared release candidate on this date; public availability requires the v2.5.0 tag and release.

Added

... (truncated)

Commits
  • ef9ae41 fix(release): align runtime attribution with Go 1.27.3
  • 99b8e9e test(security): iterate policy blocks without allocation
  • 2db250a test(security): distinguish synthetic fixture policy checks
  • 7cf7db6 fix(security): recognize exact public authentication vectors
  • 58e0e92 fix(tooling): build isolated analyzers with Go 1.27.3
  • 02c21d5 fix(ci): align the public consumer compiler guard
  • fd63509 fix(build): use the patched Go 1.27.3 toolchain
  • fdc6702 chore(release): prepare current source tags
  • baaaaea docs(ecosystem): clarify HTTP transport guidance
  • See full diff in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci: bump the github-actions group across 1 directory with 4 updates
d0904ca 
Bumps the github-actions group with 4 updates in the / directory: [faustbrian/go-library-tools/.github/workflows/library-assurance.yml](https://github.com/faustbrian/go-library-tools), [faustbrian/go-library-tools/.github/workflows/library-ci.yml](https://github.com/faustbrian/go-library-tools), [actions/setup-node](https://github.com/actions/setup-node) and [actions/upload-artifact](https://github.com/actions/upload-artifact).


Updates `faustbrian/go-library-tools/.github/workflows/library-assurance.yml` from 70a5d7da3531b5c3ab2c2fdfa8aa3cba8211afc5 to ef9ae418c61b6b92d8d93c03d71694031ec47ed8
- [Release notes](https://github.com/faustbrian/go-library-tools/releases)
- [Changelog](https://github.com/faustbrian/go-library-tools/blob/main/CHANGELOG.md)
- [Commits](faustbrian/go-library-tools@70a5d7d...ef9ae41)

Updates `faustbrian/go-library-tools/.github/workflows/library-ci.yml` from 2.5.1 to 2.5.2
- [Release notes](https://github.com/faustbrian/go-library-tools/releases)
- [Changelog](https://github.com/faustbrian/go-library-tools/blob/main/CHANGELOG.md)
- [Commits](faustbrian/go-library-tools@09b43f4...ef9ae41)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

---
updated-dependencies:
- dependency-name: faustbrian/go-library-tools/.github/workflows/library-assurance.yml
  dependency-version: ef9ae418c61b6b92d8d93c03d71694031ec47ed8
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: faustbrian/go-library-tools/.github/workflows/library-ci.yml
  dependency-version: 2.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 3, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-78668bcac5 branch November 3, 2026 11:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants