Sandbox::https://github.com/actions/checkout/pull/2501

aiqiaoy · 2026-07-06T19:58:05Z

Backport #2454 to v5. This is a breaking change

…2454) * block checking out fork pr for some events * address copilot and reviewer feedback * run prettier formatting * build * update urls * update readme * update description and url again * edit url one more time

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v6...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v5.1.0...v6) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v5...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) ### [`v5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v4.4.0...v5) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v4.4.0`](https://github.com/actions/checkout/releases/tag/v4.4.0) [Compare Source](actions/checkout@v4.3.1...v4.4.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v4 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2502](actions/checkout#2502) - backport fixes to releases-v4 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2524](actions/checkout#2524) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v4.3.1...v4.4.0> ### [`v4.3.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v431) [Compare Source](actions/checkout@v4.3.0...v4.3.1) - Port v6 cleanup to v4 by [@ericsciple](https://github.com/ericsciple) in [#2305](actions/checkout#2305) ### [`v4.3.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v430) [Compare Source](actions/checkout@v4.2.2...v4.3.0) - docs: update README.md by [@motss](https://github.com/motss) in [#1971](actions/checkout#1971) - Add internal repos for checking out multiple repositories by [@mouismail](https://github.com/mouismail) in [#1977](actions/checkout#1977) - Documentation update - add recommended permissions to Readme by [@benwells](https://github.com/benwells) in [#2043](actions/checkout#2043) - Adjust positioning of user email note and permissions heading by [@joshmgross](https://github.com/joshmgross) in [#2044](actions/checkout#2044) - Update README.md by [@nebuk89](https://github.com/nebuk89) in [#2194](actions/checkout#2194) - Update CODEOWNERS for actions by [@TingluoHuang](https://github.com/TingluoHuang) in [#2224](actions/checkout#2224) - Update package dependencies by [@salmanmkc](https://github.com/salmanmkc) in [#2236](actions/checkout#2236) ### [`v4.2.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v422) [Compare Source](actions/checkout@v4.2.1...v4.2.2) - `url-helper.ts` now leverages well-known environment variables by [@jww3](https://github.com/jww3) in [#1941](actions/checkout#1941) - Expand unit test coverage for `isGhes` by [@jww3](https://github.com/jww3) in [#1946](actions/checkout#1946) ### [`v4.2.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v421) [Compare Source](actions/checkout@v4.2.0...v4.2.1) - Check out other refs/\* by commit if provided, fall back to ref by [@orhantoy](https://github.com/orhantoy) in [#1924](actions/checkout#1924) ### [`v4.2.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v420) [Compare Source](actions/checkout@v4.1.7...v4.2.0) - Add Ref and Commit outputs by [@lucacome](https://github.com/lucacome) in [#1180](actions/checkout#1180) - Dependency updates by [@dependabot-](https://github.com/dependabot-) [#1777](actions/checkout#1777), [#1872](actions/checkout#1872) ### [`v4.1.7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v417) [Compare Source](actions/checkout@v4.1.6...v4.1.7) - Bump the minor-npm-dependencies group across 1 directory with 4 updates by [@dependabot](https://github.com/dependabot) in [#1739](actions/checkout#1739) - Bump actions/checkout from 3 to 4 by [@dependabot](https://github.com/dependabot) in [#1697](actions/checkout#1697) - Check out other refs/\* by commit by [@orhantoy](https://github.com/orhantoy) in [#1774](actions/checkout#1774) - Pin actions/checkout's own workflows to a known, good, stable version. by [@jww3](https://github.com/jww3) in [#1776](actions/checkout#1776) ### [`v4.1.6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v416) [Compare Source](actions/checkout@v4.1.5...v4.1.6) - Check platform to set archive extension appropriately by [@cory-miller](https://github.com/cory-miller) in [#1732](actions/checkout#1732) ### [`v4.1.5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v415) [Compare Source](actions/checkout@v4.1.4...v4.1.5) - Update NPM dependencies by [@cory-miller](https://github.com/cory-miller) in [#1703](actions/checkout#1703) - Bump github/codeql-action from 2 to 3 by [@dependabot](https://github.com/dependabot) in [#1694](actions/checkout#1694) - Bump actions/setup-node from 1 to 4 by [@dependabot](https://github.com/dependabot) in [#1696](actions/checkout#1696) - Bump actions/upload-artifact from 2 to 4 by [@dependabot](https://github.com/dependabot) in [#1695](actions/checkout#1695) - README: Suggest `user.email` to be `41898282+github-actions[bot]@users.noreply.github.com` by [@cory-miller](https://github.com/cory-miller) in [#1707](actions/checkout#1707) ### [`v4.1.4`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v414) [Compare Source](actions/checkout@v4.1.3...v4.1.4) - Disable `extensions.worktreeConfig` when disabling `sparse-checkout` by [@jww3](https://github.com/jww3) in [#1692](actions/checkout#1692) - Add dependabot config by [@cory-miller](https://github.com/cory-miller) in [#1688](actions/checkout#1688) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot) in [#1693](actions/checkout#1693) - Bump word-wrap from 1.2.3 to 1.2.5 by [@dependabot](https://github.com/dependabot) in [#1643](actions/checkout#1643) ### [`v4.1.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v413) [Compare Source](actions/checkout@v4.1.2...v4.1.3) - Check git version before attempting to disable `sparse-checkout` by [@jww3](https://github.com/jww3) in [#1656](actions/checkout#1656) - Add SSH user parameter by [@cory-miller](https://github.com/cory-miller) in [#1685](actions/checkout#1685) - Update `actions/checkout` version in `update-main-version.yml` by [@jww3](https://github.com/jww3) in [#1650](actions/checkout#1650) ### [`v4.1.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v412) [Compare Source](actions/checkout@v4.1.1...v4.1.2) - Fix: Disable sparse checkout whenever `sparse-checkout` option is not present [@dscho](https://github.com/dscho) in [#1598](actions/checkout#1598) ### [`v4.1.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v411) [Compare Source](actions/checkout@v4.1.0...v4.1.1) - Correct link to GitHub Docs by [@peterbe](https://github.com/peterbe) in [#1511](actions/checkout#1511) - Link to release page from what's new section by [@cory-miller](https://github.com/cory-miller) in [#1514](actions/checkout#1514) ### [`v4.1.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v410) [Compare Source](actions/checkout@v4...v4.1.0) - [Add support for partial checkout filters](actions/checkout#1396) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.vicoli.de/piscis/agent-skills/pulls/2

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.baer.one/phbaer/ha-poolsensor/pulls/3

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.baer.one/phbaer/waterrower-local-ble/pulls/3

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.baer.one/phbaer/walldisplay/pulls/12

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). Reviewed-on: https://git.web.home.dark-link.info/waldemar/nixos-common/pulls/8 Co-authored-by: Renovate Bot <renovate@home.lab>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v7...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v6.1.0...v7) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v6...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v5.1.0...v6) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v5...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) ### [`v5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v4.4.0...v5) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.nadeko.net/Fijxu/ytproxy-go/pulls/183

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/PwnedPW-Rust/pulls/5 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

…(#5) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (https://github.com/actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6.0.0...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6.0.0) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5.0.0...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5.0.0) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.homelab.devncode.it/marco/vinted-search-mcp/pulls/5

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6.0.0...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6.0.0) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5.0.0...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5.0.0) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) ### [`v4.4.0`](https://github.com/actions/checkout/releases/tag/v4.4.0) [Compare Source](actions/checkout@v4.3.1...v4.4.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v4 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2502](actions/checkout#2502) - backport fixes to releases-v4 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2524](actions/checkout#2524) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v4.3.1...v4.4.0> ### [`v4.3.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v431) [Compare Source](actions/checkout@v4.3.0...v4.3.1) - Port v6 cleanup to v4 by [@ericsciple](https://github.com/ericsciple) in [#2305](actions/checkout#2305) ### [`v4.3.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v430) [Compare Source](actions/checkout@v4.2.2...v4.3.0) - docs: update README.md by [@motss](https://github.com/motss) in [#1971](actions/checkout#1971) - Add internal repos for checking out multiple repositories by [@mouismail](https://github.com/mouismail) in [#1977](actions/checkout#1977) - Documentation update - add recommended permissions to Readme by [@benwells](https://github.com/benwells) in [#2043](actions/checkout#2043) - Adjust positioning of user email note and permissions heading by [@joshmgross](https://github.com/joshmgross) in [#2044](actions/checkout#2044) - Update README.md by [@nebuk89](https://github.com/nebuk89) in [#2194](actions/checkout#2194) - Update CODEOWNERS for actions by [@TingluoHuang](https://github.com/TingluoHuang) in [#2224](actions/checkout#2224) - Update package dependencies by [@salmanmkc](https://github.com/salmanmkc) in [#2236](actions/checkout#2236) ### [`v4.2.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v422) [Compare Source](actions/checkout@v4.2.1...v4.2.2) - `url-helper.ts` now leverages well-known environment variables by [@jww3](https://github.com/jww3) in [#1941](actions/checkout#1941) - Expand unit test coverage for `isGhes` by [@jww3](https://github.com/jww3) in [#1946](actions/checkout#1946) ### [`v4.2.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v421) [Compare Source](actions/checkout@v4.2.0...v4.2.1) - Check out other refs/\* by commit if provided, fall back to ref by [@orhantoy](https://github.com/orhantoy) in [#1924](actions/checkout#1924) ### [`v4.2.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v420) [Compare Source](actions/checkout@v4.1.7...v4.2.0) - Add Ref and Commit outputs by [@lucacome](https://github.com/lucacome) in [#1180](actions/checkout#1180) - Dependency updates by [@dependabot-](https://github.com/dependabot-) [#1777](actions/checkout#1777), [#1872](actions/checkout#1872) ### [`v4.1.7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v417) [Compare Source](actions/checkout@v4.1.6...v4.1.7) - Bump the minor-npm-dependencies group across 1 directory with 4 updates by [@dependabot](https://github.com/dependabot) in [#1739](actions/checkout#1739) - Bump actions/checkout from 3 to 4 by [@dependabot](https://github.com/dependabot) in [#1697](actions/checkout#1697) - Check out other refs/\* by commit by [@orhantoy](https://github.com/orhantoy) in [#1774](actions/checkout#1774) - Pin actions/checkout's own workflows to a known, good, stable version. by [@jww3](https://github.com/jww3) in [#1776](actions/checkout#1776) ### [`v4.1.6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v416) [Compare Source](actions/checkout@v4.1.5...v4.1.6) - Check platform to set archive extension appropriately by [@cory-miller](https://github.com/cory-miller) in [#1732](actions/checkout#1732) ### [`v4.1.5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v415) [Compare Source](actions/checkout@v4.1.4...v4.1.5) - Update NPM dependencies by [@cory-miller](https://github.com/cory-miller) in [#1703](actions/checkout#1703) - Bump github/codeql-action from 2 to 3 by [@dependabot](https://github.com/dependabot) in [#1694](actions/checkout#1694) - Bump actions/setup-node from 1 to 4 by [@dependabot](https://github.com/dependabot) in [#1696](actions/checkout#1696) - Bump actions/upload-artifact from 2 to 4 by [@dependabot](https://github.com/dependabot) in [#1695](actions/checkout#1695) - README: Suggest `user.email` to be `41898282+github-actions[bot]@users.noreply.github.com` by [@cory-miller](https://github.com/cory-miller) in [#1707](actions/checkout#1707) ### [`v4.1.4`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v414) [Compare Source](actions/checkout@v4.1.3...v4.1.4) - Disable `extensions.worktreeConfig` when disabling `sparse-checkout` by [@jww3](https://github.com/jww3) in [#1692](actions/checkout#1692) - Add dependabot config by [@cory-miller](https://github.com/cory-miller) in [#1688](actions/checkout#1688) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot) in [#1693](actions/checkout#1693) - Bump word-wrap from 1.2.3 to 1.2.5 by [@dependabot](https://github.com/dependabot) in [#1643](actions/checkout#1643) ### [`v4.1.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v413) [Compare Source](actions/checkout@v4.1.2...v4.1.3) - Check git version before attempting to disable `sparse-checkout` by [@jww3](https://github.com/jww3) in [#1656](actions/checkout#1656) - Add SSH user parameter by [@cory-miller](https://github.com/cory-miller) in [#1685](actions/checkout#1685) - Update `actions/checkout` version in `update-main-version.yml` by [@jww3](https://github.com/jww3) in [#1650](actions/checkout#1650) ### [`v4.1.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v412) [Compare Source](actions/checkout@v4.1.1...v4.1.2) - Fix: Disable sparse checkout whenever `sparse-checkout` option is not present [@dscho](https://github.com/dscho) in [#1598](actions/checkout#1598) ### [`v4.1.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v411) [Compare Source](actions/checkout@v4.1.0...v4.1.1) - Correct link to GitHub Docs by [@peterbe](https://github.com/peterbe) in [#1511](actions/checkout#1511) - Link to release page from what's new section by [@cory-miller](https://github.com/cory-miller) in [#1514](actions/checkout#1514) ### [`v4.1.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v410) [Compare Source](actions/checkout@v4.0.0...v4.1.0) - [Add support for partial checkout filters](actions/checkout#1396) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  --------- Co-authored-by: Renovate Bot <renovate@solidrust.net> Reviewed-on: https://gitea.hq.solidrust.net:30008/solidrust/solidrust-ai-docs.github.io/pulls/12 Co-authored-by: renovate-bot <renovate-bot+shaun@solidrust.net> Co-committed-by: renovate-bot <renovate-bot+shaun@solidrust.net>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull_request_target and workflow_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6.0.0...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6.0.0) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5.0.0...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5.0.0) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  --------- Co-authored-by: Karl-Einar Bergstrøm <1+keb@noreply.localhost> Reviewed-on: https://git.kebcloud.no/keb/lazysecrets/pulls/38 Co-authored-by: Renovate Bot <renovate-bot@noreply.git.kebcloud.no>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7.0.1` | --- ### Release Notes <details> <summary>actions/checkout</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull_request_target and workflow_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6.0.0...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6.0.0) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5.0.0...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5.0.0) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) ### [`v4.4.0`](https://github.com/actions/checkout/releases/tag/v4.4.0) [Compare Source](actions/checkout@v4.3.1...v4.4.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v4 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2502](actions/checkout#2502) - backport fixes to releases-v4 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2524](actions/checkout#2524) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v4.3.1...v4.4.0> ### [`v4.3.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v431) [Compare Source](actions/checkout@v4.3.0...v4.3.1) - Port v6 cleanup to v4 by [@ericsciple](https://github.com/ericsciple) in [#2305](actions/checkout#2305) ### [`v4.3.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v430) [Compare Source](actions/checkout@v4.2.2...v4.3.0) - docs: update README.md by [@motss](https://github.com/motss) in [#1971](actions/checkout#1971) - Add internal repos for checking out multiple repositories by [@mouismail](https://github.com/mouismail) in [#1977](actions/checkout#1977) - Documentation update - add recommended permissions to Readme by [@benwells](https://github.com/benwells) in [#2043](actions/checkout#2043) - Adjust positioning of user email note and permissions heading by [@joshmgross](https://github.com/joshmgross) in [#2044](actions/checkout#2044) - Update README.md by [@nebuk89](https://github.com/nebuk89) in [#2194](actions/checkout#2194) - Update CODEOWNERS for actions by [@TingluoHuang](https://github.com/TingluoHuang) in [#2224](actions/checkout#2224) - Update package dependencies by [@salmanmkc](https://github.com/salmanmkc) in [#2236](actions/checkout#2236) ### [`v4.2.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v422) [Compare Source](actions/checkout@v4.2.1...v4.2.2) - `url-helper.ts` now leverages well-known environment variables by [@jww3](https://github.com/jww3) in [#1941](actions/checkout#1941) - Expand unit test coverage for `isGhes` by [@jww3](https://github.com/jww3) in [#1946](actions/checkout#1946) ### [`v4.2.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v421) [Compare Source](actions/checkout@v4.2.0...v4.2.1) - Check out other refs/\* by commit if provided, fall back to ref by [@orhantoy](https://github.com/orhantoy) in [#1924](actions/checkout#1924) ### [`v4.2.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v420) [Compare Source](actions/checkout@v4.1.7...v4.2.0) - Add Ref and Commit outputs by [@lucacome](https://github.com/lucacome) in [#1180](actions/checkout#1180) - Dependency updates by [@dependabot-](https://github.com/dependabot-) [#1777](actions/checkout#1777), [#1872](actions/checkout#1872) ### [`v4.1.7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v417) [Compare Source](actions/checkout@v4.1.6...v4.1.7) - Bump the minor-npm-dependencies group across 1 directory with 4 updates by [@dependabot](https://github.com/dependabot) in [#1739](actions/checkout#1739) - Bump actions/checkout from 3 to 4 by [@dependabot](https://github.com/dependabot) in [#1697](actions/checkout#1697) - Check out other refs/\* by commit by [@orhantoy](https://github.com/orhantoy) in [#1774](actions/checkout#1774) - Pin actions/checkout's own workflows to a known, good, stable version. by [@jww3](https://github.com/jww3) in [#1776](actions/checkout#1776) ### [`v4.1.6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v416) [Compare Source](actions/checkout@v4.1.5...v4.1.6) - Check platform to set archive extension appropriately by [@cory-miller](https://github.com/cory-miller) in [#1732](actions/checkout#1732) ### [`v4.1.5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v415) [Compare Source](actions/checkout@v4.1.4...v4.1.5) - Update NPM dependencies by [@cory-miller](https://github.com/cory-miller) in [#1703](actions/checkout#1703) - Bump github/codeql-action from 2 to 3 by [@dependabot](https://github.com/dependabot) in [#1694](actions/checkout#1694) - Bump actions/setup-node from 1 to 4 by [@dependabot](https://github.com/dependabot) in [#1696](actions/checkout#1696) - Bump actions/upload-artifact from 2 to 4 by [@dependabot](https://github.com/dependabot) in [#1695](actions/checkout#1695) - README: Suggest `user.email` to be `41898282+github-actions[bot]@users.noreply.github.com` by [@cory-miller](https://github.com/cory-miller) in [#1707](actions/checkout#1707) ### [`v4.1.4`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v414) [Compare Source](actions/checkout@v4.1.3...v4.1.4) - Disable `extensions.worktreeConfig` when disabling `sparse-checkout` by [@jww3](https://github.com/jww3) in [#1692](actions/checkout#1692) - Add dependabot config by [@cory-miller](https://github.com/cory-miller) in [#1688](actions/checkout#1688) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot) in [#1693](actions/checkout#1693) - Bump word-wrap from 1.2.3 to 1.2.5 by [@dependabot](https://github.com/dependabot) in [#1643](actions/checkout#1643) ### [`v4.1.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v413) [Compare Source](actions/checkout@v4.1.2...v4.1.3) - Check git version before attempting to disable `sparse-checkout` by [@jww3](https://github.com/jww3) in [#1656](actions/checkout#1656) - Add SSH user parameter by [@cory-miller](https://github.com/cory-miller) in [#1685](actions/checkout#1685) - Update `actions/checkout` version in `update-main-version.yml` by [@jww3](https://github.com/jww3) in [#1650](actions/checkout#1650) ### [`v4.1.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v412) [Compare Source](actions/checkout@v4.1.1...v4.1.2) - Fix: Disable sparse checkout whenever `sparse-checkout` option is not present [@dscho](https://github.com/dscho) in [#1598](actions/checkout#1598) ### [`v4.1.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v411) [Compare Source](actions/checkout@v4.1.0...v4.1.1) - Correct link to GitHub Docs by [@peterbe](https://github.com/peterbe) in [#1511](actions/checkout#1511) - Link to release page from what's new section by [@cory-miller](https://github.com/cory-miller) in [#1514](actions/checkout#1514) ### [`v4.1.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v410) [Compare Source](actions/checkout@v4.0.0...v4.1.0) - [Add support for partial checkout filters](actions/checkout#1396) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on tuesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.futo.org/harbor/harbor/pulls/1841 Reviewed-by: Thomas de Zeeuw <thomas@futo.org>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v6...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v5.1.0...v6) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v5...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) ### [`v5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v4.4.0...v5) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v4.4.0`](https://github.com/actions/checkout/releases/tag/v4.4.0) [Compare Source](actions/checkout@v4.3.1...v4.4.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v4 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2502](actions/checkout#2502) - backport fixes to releases-v4 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2524](actions/checkout#2524) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v4.3.1...v4.4.0> ### [`v4.3.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v431) [Compare Source](actions/checkout@v4.3.0...v4.3.1) - Port v6 cleanup to v4 by [@ericsciple](https://github.com/ericsciple) in [#2305](actions/checkout#2305) ### [`v4.3.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v430) [Compare Source](actions/checkout@v4.2.2...v4.3.0) - docs: update README.md by [@motss](https://github.com/motss) in [#1971](actions/checkout#1971) - Add internal repos for checking out multiple repositories by [@mouismail](https://github.com/mouismail) in [#1977](actions/checkout#1977) - Documentation update - add recommended permissions to Readme by [@benwells](https://github.com/benwells) in [#2043](actions/checkout#2043) - Adjust positioning of user email note and permissions heading by [@joshmgross](https://github.com/joshmgross) in [#2044](actions/checkout#2044) - Update README.md by [@nebuk89](https://github.com/nebuk89) in [#2194](actions/checkout#2194) - Update CODEOWNERS for actions by [@TingluoHuang](https://github.com/TingluoHuang) in [#2224](actions/checkout#2224) - Update package dependencies by [@salmanmkc](https://github.com/salmanmkc) in [#2236](actions/checkout#2236) ### [`v4.2.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v422) [Compare Source](actions/checkout@v4.2.1...v4.2.2) - `url-helper.ts` now leverages well-known environment variables by [@jww3](https://github.com/jww3) in [#1941](actions/checkout#1941) - Expand unit test coverage for `isGhes` by [@jww3](https://github.com/jww3) in [#1946](actions/checkout#1946) ### [`v4.2.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v421) [Compare Source](actions/checkout@v4.2.0...v4.2.1) - Check out other refs/\* by commit if provided, fall back to ref by [@orhantoy](https://github.com/orhantoy) in [#1924](actions/checkout#1924) ### [`v4.2.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v420) [Compare Source](actions/checkout@v4.1.7...v4.2.0) - Add Ref and Commit outputs by [@lucacome](https://github.com/lucacome) in [#1180](actions/checkout#1180) - Dependency updates by [@dependabot-](https://github.com/dependabot-) [#1777](actions/checkout#1777), [#1872](actions/checkout#1872) ### [`v4.1.7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v417) [Compare Source](actions/checkout@v4.1.6...v4.1.7) - Bump the minor-npm-dependencies group across 1 directory with 4 updates by [@dependabot](https://github.com/dependabot) in [#1739](actions/checkout#1739) - Bump actions/checkout from 3 to 4 by [@dependabot](https://github.com/dependabot) in [#1697](actions/checkout#1697) - Check out other refs/\* by commit by [@orhantoy](https://github.com/orhantoy) in [#1774](actions/checkout#1774) - Pin actions/checkout's own workflows to a known, good, stable version. by [@jww3](https://github.com/jww3) in [#1776](actions/checkout#1776) ### [`v4.1.6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v416) [Compare Source](actions/checkout@v4.1.5...v4.1.6) - Check platform to set archive extension appropriately by [@cory-miller](https://github.com/cory-miller) in [#1732](actions/checkout#1732) ### [`v4.1.5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v415) [Compare Source](actions/checkout@v4.1.4...v4.1.5) - Update NPM dependencies by [@cory-miller](https://github.com/cory-miller) in [#1703](actions/checkout#1703) - Bump github/codeql-action from 2 to 3 by [@dependabot](https://github.com/dependabot) in [#1694](actions/checkout#1694) - Bump actions/setup-node from 1 to 4 by [@dependabot](https://github.com/dependabot) in [#1696](actions/checkout#1696) - Bump actions/upload-artifact from 2 to 4 by [@dependabot](https://github.com/dependabot) in [#1695](actions/checkout#1695) - README: Suggest `user.email` to be `41898282+github-actions[bot]@users.noreply.github.com` by [@cory-miller](https://github.com/cory-miller) in [#1707](actions/checkout#1707) ### [`v4.1.4`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v414) [Compare Source](actions/checkout@v4.1.3...v4.1.4) - Disable `extensions.worktreeConfig` when disabling `sparse-checkout` by [@jww3](https://github.com/jww3) in [#1692](actions/checkout#1692) - Add dependabot config by [@cory-miller](https://github.com/cory-miller) in [#1688](actions/checkout#1688) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot) in [#1693](actions/checkout#1693) - Bump word-wrap from 1.2.3 to 1.2.5 by [@dependabot](https://github.com/dependabot) in [#1643](actions/checkout#1643) ### [`v4.1.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v413) [Compare Source](actions/checkout@v4.1.2...v4.1.3) - Check git version before attempting to disable `sparse-checkout` by [@jww3](https://github.com/jww3) in [#1656](actions/checkout#1656) - Add SSH user parameter by [@cory-miller](https://github.com/cory-miller) in [#1685](actions/checkout#1685) - Update `actions/checkout` version in `update-main-version.yml` by [@jww3](https://github.com/jww3) in [#1650](actions/checkout#1650) ### [`v4.1.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v412) [Compare Source](actions/checkout@v4.1.1...v4.1.2) - Fix: Disable sparse checkout whenever `sparse-checkout` option is not present [@dscho](https://github.com/dscho) in [#1598](actions/checkout#1598) ### [`v4.1.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v411) [Compare Source](actions/checkout@v4.1.0...v4.1.1) - Correct link to GitHub Docs by [@peterbe](https://github.com/peterbe) in [#1511](actions/checkout#1511) - Link to release page from what's new section by [@cory-miller](https://github.com/cory-miller) in [#1514](actions/checkout#1514) ### [`v4.1.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v410) [Compare Source](actions/checkout@v4...v4.1.0) - [Add support for partial checkout filters](actions/checkout#1396) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.vicoli.de/piscis/agent-skills/pulls/2

@aiqiaoy

@aiqiaoy

@aiqiaoy

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull_request_target and workflow_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6.0.0...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6.0.0) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) ##### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5.0.0...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5.0.0) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.kebcloud.no/keb/lazysecrets.nvim/pulls/5 Co-authored-by: Renovate Bot <renovate-bot@noreply.git.kebcloud.no>

@aiqiaoy

@aiqiaoy

@aiqiaoy

@aiqiaoy

@aiqiaoy

08c6903c is v5.0.0, two releases behind what `@v5` resolves to, so the pin rolled checkout back and dropped v5.1.0's safer pull_request_target default (actions/checkout#2501) and the v5.0.1 cleanup port. Pin all 22 refs to fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 (refs/tags/v5 and refs/tags/v5.1.0) so workflow behavior is unchanged.

@v5

* ci: pin checkout actions to immutable commits * ci: pin actions/checkout to v5.1.0, the commit @v5 runs today 08c6903c is v5.0.0, two releases behind what `@v5` resolves to, so the pin rolled checkout back and dropped v5.1.0's safer pull_request_target default (actions/checkout#2501) and the v5.0.1 cleanup port. Pin all 22 refs to fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 (refs/tags/v5 and refs/tags/v5.1.0) so workflow behavior is unchanged. * ci: take the running kernel's modules from -proposed when no other po… …cket has them BLO-50264 rolled every Ubuntu runner host to 6.8.0-149-generic for CVE-2026-98432 while that kernel is still only in noble-proposed. Topotest host-prep installs linux-modules-$(uname -r), so every Test leg on arc-e2e now fails before a test runs: "E: Unable to locate package linux-modules-6.8.0-149-generic". Enable <codename>-proposed only when the running kernel's modules are in no enabled pocket. Its Release is NotAutomatic (priority 100), so kmod, python3-xmltodict and linux-modules-extra-azure still come from -updates; only the module packages that exist nowhere else come from -proposed. A kernel with no package in any pocket (Talos, BLO-43500) still fails the step as before. Checked in ubuntu:24.04 on a 6.8.0-149-generic host: the step exits 0, both module packages resolve from noble-proposed and the other three from noble-updates. * ci: run the -proposed fallback as its own step The "Run topotests" script uses expression syntax, so GitHub parses the whole script as one expression, and expressions are capped at 21,000 characters. It was at 20,467; the fallback added in the previous commit took it to 21,183, and GitHub rejected the entire workflow: the push run 41359389406 failed at startup with no jobs, no pull_request run was created, and the PR rollup still read green. actionlint does not check this limit. Move the fallback into its own step just before "Run topotests". Its script has no expressions, and the topotests script is back to its original 20,467 characters. A comment above that run: block records the cap. Checked in ubuntu:24.04 on a 6.8.0-149-generic host: the new step adds noble-proposed, the unchanged install then takes both module packages from noble-proposed, and kmod and python3-xmltodict from noble-updates. actionlint exits 0; .github/scripts pytest 594 passed.

@aiqiaoy

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v4` → `v7` | | [node](https://github.com/actions/node-versions) | uses-with | major | `24` → `26` | --- ### Release Notes <details> <summary>actions/checkout</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull_request_target and workflow_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6.0.0...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v5.1.0...v6.0.0) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](actions/checkout@v5.0.1...v5.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](actions/checkout#2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](actions/checkout#2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5.0.0...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v4.4.0...v5.0.0) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) </details> <details> <summary>actions/setup-node</summary> ### [`v7.1.0`](https://github.com/actions/setup-node/releases/tag/v7.1.0) [Compare Source](actions/setup-node@v7.0.0...v7.1.0) #### What's Changed ##### Enhancements: - Add support for mise.toml file by [@gperdomor](https://github.com/gperdomor) in [#1421](actions/setup-node#1421) - Support absolute paths in node-version-file by [@v-mahabaleshwars](https://github.com/v-mahabaleshwars) in [#1633](actions/setup-node#1633) ##### Bug fixes: - Add Node version validation and manifest fetch retry by [@v-jitenderpalsingh](https://github.com/v-jitenderpalsingh) in [#1580](actions/setup-node#1580) ##### Documentation updates: - README.md: bump actions/checkout to latest version 7 by [@deining](https://github.com/deining) in [#1578](actions/setup-node#1578) - docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by [@v-gowridurgad](https://github.com/v-gowridurgad) in [#1593](actions/setup-node#1593) - Fixed cache recommendation syntax by [@SubJunk](https://github.com/SubJunk) in [#1603](actions/setup-node#1603) ##### Dependency updates: - Update workflow pins and migrate Node matrices to modern versions by [@v-HarithaVattikuti](https://github.com/v-HarithaVattikuti) in [#1583](actions/setup-node#1583) - Upgrade [@actions/cache](https://github.com/actions/cache) to 6.2.0 by [@philip-gai](https://github.com/philip-gai) in [#1584](actions/setup-node#1584) - Pin [@types/node](https://github.com/types/node) to v24 by [@v-priyagupta108](https://github.com/v-priyagupta108) in [#1585](actions/setup-node#1585) - Override brace-expansion to 5.0.8 by [@v-priyagupta108](https://github.com/v-priyagupta108) with [@Copilot](https://github.com/Copilot) in [#1599](actions/setup-node#1599) - Upgrade actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#1598](actions/setup-node#1598) - Upgrade prettier from 3.8.4 to 3.9.6 by [@dependabot](https://github.com/dependabot) in [#1590](actions/setup-node#1590) - Upgrade [@vercel/ncc](https://github.com/vercel/ncc) from 0.44.0 to 0.45.0 by [@dependabot](https://github.com/dependabot) in [#1610](actions/setup-node#1610) - Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by [@dependabot](https://github.com/dependabot) in [#1602](actions/setup-node#1602) - Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by [@dependabot](https://github.com/dependabot) in [#1629](actions/setup-node#1629) - Upgrade [@types/semver](https://github.com/types/semver) from 7.7.1 to 7.8.0 by [@dependabot](https://github.com/dependabot) in [#1616](actions/setup-node#1616) - Upgrade [@typescript-eslint/parser](https://github.com/typescript-eslint/parser) from 8.62.0 to 8.70.0 by [@dependabot](https://github.com/dependabot) in [#1615](actions/setup-node#1615) - Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#1631](actions/setup-node#1631) - Upgrade jest-each from 30.4.1 to 30.5.2 by [@dependabot](https://github.com/dependabot) in [#1636](actions/setup-node#1636) - Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by [@dependabot](https://github.com/dependabot) in [#1638](actions/setup-node#1638) - Update dependencies and add license files by [@v-HarithaVattikuti](https://github.com/v-HarithaVattikuti) in [#1642](actions/setup-node#1642) - Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by [@dependabot](https://github.com/dependabot) in [#1635](actions/setup-node#1635) #### New Contributors - [@v-jitenderpalsingh](https://github.com/v-jitenderpalsingh) made their first contribution in [#1580](actions/setup-node#1580) - [@philip-gai](https://github.com/philip-gai) made their first contribution in [#1584](actions/setup-node#1584) - [@gperdomor](https://github.com/gperdomor) made their first contribution in [#1421](actions/setup-node#1421) - [@SubJunk](https://github.com/SubJunk) made their first contribution in [#1603](actions/setup-node#1603) **Full Changelog**: <actions/setup-node@v7.0.0...v7.1.0> ### [`v7.0.0`](https://github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](actions/setup-node@v6.5.0...v7.0.0) #### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://github.com/gowridurgad) in [#1577](actions/setup-node#1577) - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://github.com/gowridurgad) in [#1574](actions/setup-node#1574) ##### Bug fixes: - Remove dummy NODE_AUTH_TOKEN export by [@gowridurgad](https://github.com/gowridurgad) in [#1558](actions/setup-node#1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://github.com/deiga) in [#1548](actions/setup-node#1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1536](actions/setup-node#1536) - docs: Update restore-only cache documentation by [@priya-kinthali](https://github.com/priya-kinthali) in [#1550](actions/setup-node#1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1567](actions/setup-node#1567) ##### Dependency update: - Upgrade [@actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [#1569](actions/setup-node#1569) #### New Contributors - [@chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#1536](actions/setup-node#1536) - [@deiga](https://github.com/deiga) made their first contribution in [#1548](actions/setup-node#1548) - [@jasongin](https://github.com/jasongin) made their first contribution in [#1569](actions/setup-node#1569) **Full Changelog**: <actions/setup-node@v6...v7.0.0> ### [`v6.5.0`](https://github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](actions/setup-node@v6.4.0...v6.5.0) #### What's Changed - Update [@actions/cache](https://github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [#1579](actions/setup-node#1579) **Full Changelog**: <actions/setup-node@v6.4.0...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-node/releases/tag/v6.4.0) [Compare Source](actions/setup-node@v6.3.0...v6.4.0) #### What's Changed ##### Dependency updates: - Upgrade [@actions](https://github.com/actions) dependencies by [@Copilot](https://github.com/Copilot) in [#1525](actions/setup-node#1525) - Update Node.js versions in versions.yml and bump package to v6.4.0 by [@priya-kinthali](https://github.com/priya-kinthali) in [#1533](actions/setup-node#1533) #### New Contributors - [@Copilot](https://github.com/Copilot) made their first contribution in [#1525](actions/setup-node#1525) **Full Changelog**: <actions/setup-node@v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](actions/setup-node@v6.2.0...v6.3.0) #### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@susnux](https://github.com/susnux) in [#1283](actions/setup-node#1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@gowridurgad](https://github.com/gowridurgad) in [#1491](actions/setup-node#1491) - Replace uuid with crypto.randomUUID() by [@trivikr](https://github.com/trivikr) in [#1378](actions/setup-node#1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@dependabot](https://github.com/dependabot) in [#1498](actions/setup-node#1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@marco-ippolito](https://github.com/marco-ippolito) in [#1467](actions/setup-node#1467) - Scope test lockfiles by package manager and update cache tests by [@gowridurgad](https://github.com/gowridurgad) in [#1495](actions/setup-node#1495) #### New Contributors - [@susnux](https://github.com/susnux) made their first contribution in [#1283](actions/setup-node#1283) **Full Changelog**: <actions/setup-node@v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-node/releases/tag/v6.2.0) [Compare Source](actions/setup-node@v6.1.0...v6.2.0) #### What's Changed ##### Documentation - Documentation update related to absence of Lockfile by [@mahabaleshwars](https://github.com/mahabaleshwars) in [#1454](actions/setup-node#1454) - Correct mirror option typos by [@MikeMcC399](https://github.com/MikeMcC399) in [#1442](actions/setup-node#1442) - Readme update on checkout version v6 by [@deining](https://github.com/deining) in [#1446](actions/setup-node#1446) - Readme typo fixes [@munyari](https://github.com/munyari) in [#1226](actions/setup-node#1226) - Advanced document update on checkout version v6 by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1468](actions/setup-node#1468) ##### Dependency updates: - Upgrade [@actions/cache](https://github.com/actions/cache) to v5.0.1 by [@salmanmkc](https://github.com/salmanmkc) in [#1449](actions/setup-node#1449) #### New Contributors - [@mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#1454](actions/setup-node#1454) - [@MikeMcC399](https://github.com/MikeMcC399) made their first contribution in [#1442](actions/setup-node#1442) - [@deining](https://github.com/deining) made their first contribution in [#1446](actions/setup-node#1446) - [@munyari](https://github.com/munyari) made their first contribution in [#1226](actions/setup-node#1226) **Full Changelog**: <actions/setup-node@v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-node/releases/tag/v6.1.0) [Compare Source](actions/setup-node@v6.0.0...v6.1.0) #### What's Changed ##### Enhancement: - Remove always-auth configuration handling by [@priyagupta108](https://github.com/priyagupta108) in [#1436](actions/setup-node#1436) ##### Dependency updates: - Upgrade [@actions/cache](https://github.com/actions/cache) from 4.0.3 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1384](actions/setup-node#1384) - Upgrade actions/checkout from 5 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#1439](actions/setup-node#1439) - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#1435](actions/setup-node#1435) ##### Documentation update: - Add example for restore-only cache in documentation by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1419](actions/setup-node#1419) **Full Changelog**: <actions/setup-node@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/setup-node/releases/tag/v6.0.0) [Compare Source](actions/setup-node@v5.0.0...v6.0.0) #### What's Changed **Breaking Changes** - Limit automatic caching to npm, update workflows and documentation by [@priyagupta108](https://github.com/priyagupta108) in [#1374](actions/setup-node#1374) **Dependency Upgrades** - Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by [@dependabot](https://github.com/dependabot)\[bot] in [#1336](actions/setup-node#1336) - Upgrade prettier from 2.8.8 to 3.6.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#1334](actions/setup-node#1334) - Upgrade actions/publish-action from 0.3.0 to 0.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1362](actions/setup-node#1362) **Full Changelog**: <actions/setup-node@v5...v6.0.0> ### [`v5.0.0`](https://github.com/actions/setup-node/releases/tag/v5.0.0) [Compare Source](actions/setup-node@v4.4.0...v5.0.0) #### What's Changed ##### Breaking Changes - Enhance caching in setup-node with automatic package manager detection by [@priya-kinthali](https://github.com/priya-kinthali) in [#1348](actions/setup-node#1348) This update, introduces automatic caching when a valid `packageManager` field is present in your `package.json`. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set `package-manager-cache: false` ```yaml steps: - uses: actions/checkout@v5 - uses: actions/setup-node@v5 with: package-manager-cache: false ``` - Upgrade action to use node24 by [@salmanmkc](https://github.com/salmanmkc) in [#1325](actions/setup-node#1325) Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [See Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1) ##### Dependency Upgrades - Upgrade [@octokit/request-error](https://github.com/octokit/request-error) and [@actions/github](https://github.com/actions/github) by [@dependabot](https://github.com/dependabot)\[bot] in [#1227](actions/setup-node#1227) - Upgrade uuid from 9.0.1 to 11.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1273](actions/setup-node#1273) - Upgrade undici from 5.28.5 to 5.29.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1295](actions/setup-node#1295) - Upgrade form-data to bring in fix for critical vulnerability by [@gowridurgad](https://github.com/gowridurgad) in [#1332](actions/setup-node#1332) - Upgrade actions/checkout from 4 to 5 by [@dependabot](https://github.com/dependabot)\[bot] in [#1345](actions/setup-node#1345) #### New Contributors - [@priya-kinthali](https://github.com/priya-kinthali) made their first contribution in [#1348](actions/setup-node#1348) - [@salmanmkc](https://github.com/salmanmkc) made their first contribution in [#1325](actions/setup-node#1325) **Full Changelog**: <actions/setup-node@v4...v5.0.0> </details> <details> <summary>actions/node-versions (node)</summary> ### [`v26.13.1`](https://github.com/actions/node-versions/releases/tag/26.13.1-43134154182): 26.13.1 [Compare Source](actions/node-versions@26.13.0-40806794713...26.13.1-43134154182) Node.js 26.13.1 ### [`v26.13.0`](https://github.com/actions/node-versions/releases/tag/26.13.0-40806794713): 26.13.0 [Compare Source](actions/node-versions@26.12.1-39618969937...26.13.0-40806794713) Node.js 26.13.0 ### [`v26.12.1`](https://github.com/actions/node-versions/releases/tag/26.12.1-39618969937): 26.12.1 [Compare Source](actions/node-versions@26.12.0-38668157440...26.12.1-39618969937) Node.js 26.12.1 ### [`v26.12.0`](https://github.com/actions/node-versions/releases/tag/26.12.0-38668157440): 26.12.0 [Compare Source](actions/node-versions@26.11.1-37718106145...26.12.0-38668157440) Node.js 26.12.0 ### [`v26.11.1`](https://github.com/actions/node-versions/releases/tag/26.11.1-37718106145): 26.11.1 [Compare Source](actions/node-versions@26.11.0-37718124002...26.11.1-37718106145) Node.js 26.11.1 ### [`v26.11.0`](https://github.com/actions/node-versions/releases/tag/26.11.0-37718124002): 26.11.0 [Compare Source](actions/node-versions@26.10.0-35737674515...26.11.0-37718124002) Node.js 26.11.0 ### [`v26.10.0`](https://github.com/actions/node-versions/releases/tag/26.10.0-35737674515): 26.10.0 [Compare Source](actions/node-versions@26.9.0-35174947414...26.10.0-35737674515) Node.js 26.10.0 ### [`v26.9.0`](https://github.com/actions/node-versions/releases/tag/26.9.0-35174947414): 26.9.0 [Compare Source](actions/node-versions@26.8.2-34429851330...26.9.0-35174947414) Node.js 26.9.0 ### [`v26.8.2`](https://github.com/actions/node-versions/releases/tag/26.8.2-34429851330): 26.8.2 [Compare Source](actions/node-versions@26.8.1-33034053154...26.8.2-34429851330) Node.js 26.8.2 ### [`v26.8.1`](https://github.com/actions/node-versions/releases/tag/26.8.1-33034053154): 26.8.1 [Compare Source](actions/node-versions@26.8.0-33034064325...26.8.1-33034053154) Node.js 26.8.1 ### [`v26.8.0`](https://github.com/actions/node-versions/releases/tag/26.8.0-33034064325): 26.8.0 [Compare Source](actions/node-versions@26.7.0-31064755789...26.8.0-33034064325) Node.js 26.8.0 ### [`v26.7.0`](https://github.com/actions/node-versions/releases/tag/26.7.0-31064755789): 26.7.0 [Compare Source](actions/node-versions@26.6.0-30872438625...26.7.0-31064755789) Node.js 26.7.0 ### [`v26.6.0`](https://github.com/actions/node-versions/releases/tag/26.6.0-30872438625): 26.6.0 [Compare Source](actions/node-versions@26.5.1-30508404249...26.6.0-30872438625) Node.js 26.6.0 ### [`v26.5.1`](https://github.com/actions/node-versions/releases/tag/26.5.1-30508404249): 26.5.1 [Compare Source](actions/node-versions@26.5.0-28944078721...26.5.1-30508404249) Node.js 26.5.1 ### [`v26.5.0`](https://github.com/actions/node-versions/releases/tag/26.5.0-28944078721): 26.5.0 [Compare Source](actions/node-versions@26.4.0-28176665805...26.5.0-28944078721) Node.js 26.5.0 ### [`v26.4.0`](https://github.com/actions/node-versions/releases/tag/26.4.0-28176665805): 26.4.0 [Compare Source](actions/node-versions@26.3.1-27765697053...26.4.0-28176665805) Node.js 26.4.0 ### [`v26.3.1`](https://github.com/actions/node-versions/releases/tag/26.3.1-27765697053): 26.3.1 [Compare Source](actions/node-versions@26.3.0-26776574275...26.3.1-27765697053) Node.js 26.3.1 ### [`v26.3.0`](https://github.com/actions/node-versions/releases/tag/26.3.0-26776574275): 26.3.0 [Compare Source](actions/node-versions@26.2.0-26201774761...26.3.0-26776574275) Node.js 26.3.0 ### [`v26.2.0`](https://github.com/actions/node-versions/releases/tag/26.2.0-26201774761): 26.2.0 [Compare Source](actions/node-versions@26.1.0-25496618813...26.2.0-26201774761) Node.js 26.2.0 ### [`v26.1.0`](https://github.com/actions/node-versions/releases/tag/26.1.0-25496618813): 26.1.0 [Compare Source](actions/node-versions@26.0.0-25413736946...26.1.0-25496618813) Node.js 26.1.0 ### [`v26.0.0`](https://github.com/actions/node-versions/releases/tag/26.0.0-25413736946): 26.0.0 [Compare Source](actions/node-versions@24.22.3-43134179821...26.0.0-25413736946) Node.js 26.0.0 </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Phoenix) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Co-authored-by: Renovate Bot <renovate@example.com> Reviewed-on: http://ser8:3035/zach/herdr-mod-pixel-art/pulls/13

aiqiaoy added 2 commits July 6, 2026 19:07

update error wording (#2467)

116db4f

aiqiaoy changed the title ~~backport allow-unsafe-pr-checkout to v6~~ backport allow-unsafe-pr-checkout to v5 Jul 6, 2026

AllanGuigou approved these changes Jul 7, 2026

View reviewed changes

aiqiaoy merged commit 6026fb2 into releases/v5 Jul 7, 2026
9 checks passed

aiqiaoy deleted the aiqiaoy/backport-v5 branch July 7, 2026 20:34

ZhuLinsen mentioned this pull request Jul 21, 2026

[Bug] pr-review.yml 在 fork PR 上 security-check 强制 fail，建议加 allow-unsafe-pr-checkout: true ZhuLinsen/daily_stock_analysis#2051

Closed

This was referenced Jul 27, 2026

[PR] Update actions/checkout action to v7 vxfemboy/ghostport#7

Closed

Update actions/checkout action to v7 vxfemboy/nyancat-rs#11

Open

Update actions/checkout action to v7 vxfemboy/zoa.sh#18

Open

chapplehub mentioned this pull request Jul 31, 2026

chore(deps): update actions/checkout action to v7 chapplehub/estimate-management-system#729

Merged

1 task

graaaaaaa mentioned this pull request Oct 17, 2026

ci: Node.js 24 で動く版へ actions を更新する graaaaaaa/vrc-remote-test#6

Merged

3 tasks done

This was referenced Oct 31, 2026

ci: pin checkout actions to immutable commits Blockcast/paperclip#3181

Merged

ci: pin checkout actions to immutable commits Blockcast/frr#150

Merged

Navigation Menu

Repository navigation

backport `allow-unsafe-pr-checkout` to v5 - #2501

backport `allow-unsafe-pr-checkout` to v5#2501
aiqiaoy merged 2 commits into
releases/v5from
aiqiaoy/backport-v5

aiqiaoy commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

aiqiaoy commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants