Skip to content

chore(deps): bump the github-actions group across 1 directory with 6 updates - #14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-19d2ea2a31
Open

chore(deps): bump the github-actions group across 1 directory with 6 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-19d2ea2a31

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the github-actions group with 6 updates in the / directory:

Package From To
actions/checkout 4.2.2 7.0.1
dorny/paths-filter 4.0.1 4.0.3
pnpm/action-setup 6.0.9 6.0.10
actions/setup-node 4.4.0 7.0.0
actions/setup-python 5.6.0 7.0.0
fallow-rs/fallow 2.101.0 3.14.0

Updates actions/checkout from 4.2.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates dorny/paths-filter from 4.0.1 to 4.0.3

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.3

What's Changed

Security

New Contributors

Full Changelog: dorny/paths-filter@v4...v4.0.3

v4.0.2

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v4.0.1...v4.0.2

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.3

v4.0.2

v4.0.1

v4.0.0

v3.0.4

v3.0.3

v3.0.2

v3.0.1

v3.0.0

v2.11.1

v2.11.0

v2.10.2

... (truncated)

Commits
  • ceb8a2b Update CHANGELOG.md for v4.0.3 and v3.0.4 (#327)
  • ef09b88 Document safe handling of file list outputs in workflows (#326)
  • 44adc5b Merge commit from fork
  • 4711b7a feat: add 'some-with-excludes' predicate quantifier (#322)
  • 93c889f fix: escape multi-line filenames in list-files shell and csv output
  • b41dfa9 docs: add contents permission to PR example (#248)
  • 9af6e5a fix: scope base-ignored warning to API path (#319)
  • cae9006 docs: update outputs in readme to account for the 'every' predicate-quantifie...
  • 7b450ff docs: update changelog for v4.0.2 (#318)
  • 9280377 fix: work around git dubious ownership errors in container jobs (#317)
  • Additional commits viewable in compare view

Updates pnpm/action-setup from 6.0.9 to 6.0.10

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.10

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v6...v6.0.10

Commits

Updates actions/setup-node from 4.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates actions/setup-python from 5.6.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

... (truncated)

Commits

Updates fallow-rs/fallow from 2.101.0 to 3.14.0

Release notes

Sourced from fallow-rs/fallow's releases.

v3.14.0: doMock-aware coverage, faster discovery and alias propagation

Mock-aware coverage learns doMock, workspace discovery and alias propagation got faster, and type-aware status tells the truth about how it found the sidecar.

Features

vi.doMock and jest.doMock join the mock-aware coverage model. They never mask test reachability (they are unhoisted and order-sensitive, so masking could produce false uncovered findings), but static path-shaped targets and their __mocks__ manual-mock siblings now receive credit edges on every proven receiver shape, and doUnmock cannot clear a sound hoisted mask. Automock (vi.mock without a factory) keeps coverage credit by pinned, documented decision. The --coverage-gaps docs now spell out the full mock-aware semantics, including what abstains.

Performance

  • Workspace discovery: a per-discovery manifest cache stops members reached via multiple workspace sources from being re-read and re-parsed, and Deno config probing collapses to a single filesystem probe per directory. Discovery and diagnostics benchmarks improved 7 to 12 percent with identical behavior.
  • Alias propagation: cross-package namespace alias propagation dropped its per-consumer string formatting and redundant clones, recovering the earlier regression and landing faster than the pre-regression baseline.

Fixes

  • type-aware status reports truthful discovery sources. Fallow's own launchers now mark self-injected wiring, so status distinguishes npm-wrapper and github-action from a genuinely user-set environment-override, and wrapper-wired discovery failures get the right remediation.
  • maxUnitSize semantics are now unambiguous. The schema and docs state explicitly that the four max* health thresholds govern which findings are listed and never move health_score, whose bins keep their fixed cross-project calibration; a regression test locks the score as byte-identical when thresholds change. Thanks @​DeLuke84 for the report that exposed the ambiguity.
  • The flaky Windows process-tree lifecycle tests were hardened with deadline polling, serialized execution, and slow-runner headroom.

Full Changelog: fallow-rs/fallow@v3.13.0...v3.14.0

v3.13.0: Action-provisioned type-aware sidecar, flag-proof agent gate

The GitHub Action now provisions the type-aware sidecar itself, and the agent gate stops being fooled by git-level flags.

Features

The Action wires type-aware analysis end to end. A new tri-state type-aware input defaults to auto, which reads your project config: when typeAware.enabled is on (and audit.typeAware does not override it), the Action installs fallow-type-aware at exactly the CLI version it resolved, verifies the version match fail-closed, and exports FALLOW_TYPE_AWARE_BIN. Set true to force provisioning or false to skip it and run fully syntactic. Until now the Action installed only the standalone binary, so typeAware-enabled projects needed manual sidecar wiring in CI.

Bug fixes

The agent gate recognizes git -c … commit and friends. The gate installed by fallow hooks install --target agent only audited git commit / git push when the subcommand immediately followed git, so ordinary forms like git -c user.name=x commit, git --no-pager commit, or git -C dir push silently skipped the audit. Command recognition now tokenizes and steps over git-level options (including value-taking ones like -c, -C, --git-dir) while still ignoring lookalikes such as git log commit-message.txt or git stash push. A new FALLOW_GATE_DEBUG environment variable surfaces skip decisions on stderr for troubleshooting. Thanks @​wouterkroes for the meticulously reproduced report, the payload-based test approach went straight into the test suite.

Full Changelog: fallow-rs/fallow@v3.12.0...v3.13.0

v3.12.0: type-aware audit enablement, rename-aware gating, sturdier baselines

Type-aware analysis and audit --gate new-only now work together out of the box, audits survive git mv, and health baselines got sturdier.

Type-aware + audit, fixed end to end

Three reports converged on the same enablement wall, and all three are gone:

  • One config is enough. With typeAware.enabled in .fallowrc, audit --gate new-only no longer exits 2 when base and head semantic identities differ: attribution falls back to identity-independent syntactic sets with a clear warning, semantic-only findings demote to advisory, and a genuinely new finding still fails the gate. A global --no-type-aware flag and an audit.typeAware config field give you an explicit syntactic escape hatch, and macOS /var vs /private/var temp paths no longer abort the run. Thanks @​hckhanh for the detailed enablement-DX report.
  • Adding a file no longer degrades the gate. Identity comparison now uses the compatibility rules the identity type was designed with instead of raw equality, and the sidecar's project hash no longer includes the root file listing, so the everyday "this PR adds a new .ts file" diff compares cleanly. Thanks @​lightsound for the precise source-level analysis.
  • The npm sidecar wiring is repaired. fallow@3.11.0 pinned fallow-type-aware to the previous version while the launcher requires an exact match, so the sidecar never wired and type-aware hard-failed on npm installs. Both the manifest and the release pipeline now bump the pin in lockstep. Thanks @​lightsound for the report and the bun workaround notes.

Audit survives renames

git mv no longer turns audit --gate new-only red: base findings relocate onto post-rename paths via git rename detection across dead code, complexity, duplication, styling, and cycles, so pure renames attribute as inherited while a rename with edits still gates genuinely new debt. Validated on a real multi-directory rename that previously reported 21 introduced findings and now reports zero. Thanks @​YoniChechik for the excellent report with the minimal repro.

Health and analysis improvements

... (truncated)

Commits
  • 3cf8074 chore: release v3.14.0
  • 5de19d4 test(process): harden the Unix process-tree registry test against slow runners
  • b6f6adc fix(mcp): satisfy redundant_pub_crate on the Windows test lock
  • 6e80883 feat(health): credit doMock targets and pin the automock coverage decision (#...
  • e054def test(mcp): harden the Windows process-tree lifecycle tests against slow runne...
  • b7d1d43 docs(health): state that max thresholds govern findings, never the score (#2118)
  • d00354b fix(api): report truthful type-aware discovery sources (#2113)
  • 4bc061f perf(config): cache manifest probes during workspace discovery (#2115)
  • 85eaa3b perf(graph): cut allocations in cross-package alias propagation (#2114)
  • a99fb67 fix(vscode): override brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the github-actions group across 1 directory with 6 …
5ec7c9c 
…updates

Bumps the github-actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.1` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.3` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.9` | `6.0.10` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` |
| [fallow-rs/fallow](https://github.com/fallow-rs/fallow) | `2.101.0` | `3.14.0` |



Updates `actions/checkout` from 4.2.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.2.2...3d3c42e)

Updates `dorny/paths-filter` from 4.0.1 to 4.0.3
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](dorny/paths-filter@fbd0ab8...ceb8a2b)

Updates `pnpm/action-setup` from 6.0.9 to 6.0.10
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@0ebf471...0977fd9)

Updates `actions/setup-node` from 4.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4.4.0...8207627)

Updates `actions/setup-python` from 5.6.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...5fda3b9)

Updates `fallow-rs/fallow` from 2.101.0 to 3.14.0
- [Release notes](https://github.com/fallow-rs/fallow/releases)
- [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml)
- [Commits](fallow-rs/fallow@5da5e73...3cf8074)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dorny/paths-filter
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: fallow-rs/fallow
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants