Skip to content

ci: bump the github-actions group across 1 directory with 3 updates - #48

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1a459e5248
Open

ci: bump the github-actions group across 1 directory with 3 updates#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1a459e5248

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 3 updates in the / directory: faustbrian/go-library-tools/.github/workflows/library-ci.yml, actions/setup-node and actions/upload-artifact.

Updates faustbrian/go-library-tools/.github/workflows/library-ci.yml from 2.5.1 to 2.5.2

Release notes

Sourced from faustbrian/go-library-tools/.github/workflows/library-ci.yml's releases.

v2.5.2

What's Changed

Full Changelog: faustbrian/go-library-tools@v2.5.1...v2.5.2

Changelog

Sourced from faustbrian/go-library-tools/.github/workflows/library-ci.yml's changelog.

Changelog

All notable changes to this project are documented in this file.

Unreleased

2.5.3 - 2026-11-01

Fixed

  • Admit exact nonsecret Identity source fixtures, prose, operation identifiers and historical API catalog digest matches in the central secret policy. Changed values, other paths and credentials beside catalog digests remain findings in history and current-tree scans.

Changed

  • Clarify the ecosystem HTTP recommendation around the supported net/http transport, link Service-owned comparison evidence and keep Fiber/fasthttp in a separate architecture track requiring its own compatibility and maintenance commitment before adapter support.

2.5.2 - 2026-10-22

Fixed

  • Bind binary runtime attribution to the verified Go 1.27.3 license and patent files while retaining exact runtime and source-digest admission.
  • Admit only exact public synthetic Authentication JWT verification-vector lines in the central secret policy; changed tokens, other paths and unrelated credential detectors remain findings.

Changed

  • Publish the current source and documentation with a fresh immutable tag.
  • Build with Go 1.27.3 to address GO-2026-6809 in crypto/x509. Consumers should use Go 1.27.3 or newer.

2.5.1 - 2026-10-14

Fixed

  • Separate release dry-run security and candidate packaging from runtime qualification. Dry-runs no longer start services or rerun full tests, race, coverage, mutation, lint and documentation campaigns. Required ordinary CI, security scans, SBOMs, tag collision checks and module-proxy resolution remain; affected-contract qualification and clean public consumption stay separate.
  • Keep ordinary module contracts in reusable release CI and bound hosted rehearsal jobs to 30 minutes instead of six hours.
  • Route cold mutation-verifier construction to selected hosted integration

... (truncated)

Commits
  • ef9ae41 fix(release): align runtime attribution with Go 1.27.3
  • 99b8e9e test(security): iterate policy blocks without allocation
  • 2db250a test(security): distinguish synthetic fixture policy checks
  • 7cf7db6 fix(security): recognize exact public authentication vectors
  • 58e0e92 fix(tooling): build isolated analyzers with Go 1.27.3
  • 02c21d5 fix(ci): align the public consumer compiler guard
  • fd63509 fix(build): use the patched Go 1.27.3 toolchain
  • fdc6702 chore(release): prepare current source tags
  • baaaaea docs(ecosystem): clarify HTTP transport guidance
  • See full diff in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci: bump the github-actions group across 1 directory with 3 updates
ef67c52 
Bumps the github-actions group with 3 updates in the / directory: [faustbrian/go-library-tools/.github/workflows/library-ci.yml](https://github.com/faustbrian/go-library-tools), [actions/setup-node](https://github.com/actions/setup-node) and [actions/upload-artifact](https://github.com/actions/upload-artifact).


Updates `faustbrian/go-library-tools/.github/workflows/library-ci.yml` from 2.5.1 to 2.5.2
- [Release notes](https://github.com/faustbrian/go-library-tools/releases)
- [Changelog](https://github.com/faustbrian/go-library-tools/blob/main/CHANGELOG.md)
- [Commits](faustbrian/go-library-tools@09b43f4...ef9ae41)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

---
updated-dependencies:
- dependency-name: faustbrian/go-library-tools/.github/workflows/library-ci.yml
  dependency-version: 2.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants