Visitar URL original
chore(deps): bump actions/cache/save from 4.3.0 to 6.1.0 by dependabot[bot] · Pull Request #612 · preloop/preloop · GitHub
Skip to content

chore(deps): bump actions/cache/save from 4.3.0 to 6.1.0 - #612

Merged
d-mo merged 2 commits into
mainfrom
dependabot/github_actions/actions/cache/save-6.1.0
Sep 15, 2026
Merged

chore(deps): bump actions/cache/save from 4.3.0 to 6.1.0#612
d-mo merged 2 commits into
mainfrom
dependabot/github_actions/actions/cache/save-6.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •
edited by preloop-staging Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps actions/cache/save from 4.3.0 to 6.1.0.

Release notes

Sourced from actions/cache/save's releases.

v6.1.0

What's Changed

Full Changelog: https://github.com/actions/cache/compare/v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: https://github.com/actions/cache/compare/v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: https://github.com/actions/cache/compare/v5...v5.1.0

v5.0.5

What's Changed

Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.4

v5.0.3

What's Changed

  • Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
  • Bump @actions/core to v2.0.3

... (truncated)

Changelog

Sourced from actions/cache/save's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

  • Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
  • Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk
Two-line SHA pin update confined to the fuzz workflow; both pins are the verified actions/cache v6.1.0 commit, the save step's trusted-branch-only guard is unchanged, and the paired restore/save steps now run the same version already proven in this repo's ci.yml.

Overview
Bumps the pinned actions/cache/save action from v4.3.0 to v6.1.0 in the fuzz workflow's corpus-save step, and pairs the corpus-restore step to the same v6.1.0 pin per review feedback. The v6 line brings dependency security fixes (minimatch ReDoS, undici) and graceful handling of read-only-token cache writes. No inputs or behavior of the workflow change.

Written by Preloop PR Reviewer for commit 96bedb8. Updates automatically on new commits.

@dependabot
chore(deps): bump actions/cache/save from 4.3.0 to 6.1.0
056dcfc 
Bumps [actions/cache/save](https://github.com/actions/cache) from 4.3.0 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0057852...55cc834)

---
updated-dependencies:
- dependency-name: actions/cache/save
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added ci CI / GitHub Actions Dependabot updates dependencies Pull requests that update a dependency file labels Sep 14, 2026
preloop-staging[bot]
preloop-staging Bot approved these changes Sep 14, 2026
View reviewed changes

@preloop-staging preloop-staging Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Preloop approves this PR. A single minor consistency note below, but the change is verified and ready to merge. SHA pin correctly maps to actions/cache v6.1.0 (same pin ci.yml already uses), and the save step keeps its trusted-branch-only guard. See the summary comment for details.

preloop-staging[bot]
preloop-staging Bot reviewed Sep 14, 2026
View reviewed changes

@preloop-staging preloop-staging Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inline comment

Comment thread .github/workflows/fuzz.yml Resolved
@preloop-staging

preloop-staging Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🔍 Preloop Code Review

Last Updated: 2026-09-15
Reviewing Commit: 96bedb8
Review Status: ✅ Approved
Review Scope: Incremental since 056dcfc

📝 Summary

Dependabot bumps the SHA-pinned actions/cache/save action from v4.3.0 (0057852) to v6.1.0 (55cc834) in the fuzz workflow's corpus-save step. New commit 96bedb8 pairs the corpus-restore step to the same verified v6.1.0 pin, addressing the only (LOW) suggestion from the previous review. The workflow is internally consistent and merge-ready.

✅ What Looks Good

  • Incremental delta is exactly one line: the restore step at fuzz.yml:58 now uses 55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0, identical to the save pin already verified in the last pass and already proven in this repo's ci.yml.
  • Paired restore/save steps now run the same version against the shared fuzz-v1-* key — the pin mismatch flagged last review is gone.
  • Security posture unchanged: the save step's trusted-branch-only guard (if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request') is untouched, and no inputs (path, key, restore-keys) changed.

✅ Resolved Issues

  • [BestPractice]: Paired restore step (fuzz.yml:58) lagged the bumped save step (@v6.1.0) on the same fuzz-v1-* key — bump restore to the same pin for consistency - Fixed in 96bedb8

Progress: 1 of 1 issues addressed

This summary updates automatically on each review. Inline comments provide detailed feedback on specific lines.

@d-mo
chore(deps): pin fuzz cache restore to v6.1.0 with save
96bedb8 
Pair the restore step with the Dependabot save pin so both
fuzz-v1 cache steps use actions/cache 6.1.0.
preloop-staging[bot]
preloop-staging Bot approved these changes Sep 15, 2026
View reviewed changes

@preloop-staging preloop-staging Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Preloop approves this PR. The previously raised (LOW) suggestion has been addressed — commit 96bedb8 pairs the restore step to the same verified v6.1.0 pin, so both cache steps now run a single version. Great work! See the summary comment below for the full review history.

@d-mo
d-mo merged commit da7c759 into main Sep 15, 2026
22 checks passed
@d-mo
d-mo deleted the dependabot/github_actions/actions/cache/save-6.1.0 branch September 15, 2026 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@d-mo d-mo d-mo left review comments
@preloop-staging preloop-staging[bot] preloop-staging[bot] approved these changes

Assignees

No one assigned

Labels

ci CI / GitHub Actions Dependabot updates dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@d-mo