Skip to content

ci: bump the github-actions group across 1 directory with 3 updates - #739

Open
dependabot[bot] wants to merge 1 commit into
mfrom
dependabot/github_actions/github-actions-d2f41061b6
Open

ci: bump the github-actions group across 1 directory with 3 updates#739
dependabot[bot] wants to merge 1 commit into
mfrom
dependabot/github_actions/github-actions-d2f41061b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 3 updates in the / directory: actions/setup-node, actions/create-github-app-token and cycjimmy/semantic-release-action.

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)
Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view

Updates cycjimmy/semantic-release-action from 6.0.0 to 8.1.3

Release notes

Sourced from cycjimmy/semantic-release-action's releases.

v8.1.3

8.1.3 (2026-10-19)

Bug Fixes

  • locate npm-cli.js from PATH on Windows runners (b810ddb), closes #332

v8.1.2

8.1.2 (2026-10-16)

Bug Fixes

v8.1.1

8.1.1 (2026-10-16)

Bug Fixes

  • split extends configurations on whitespace (6938171)

v8.1.0

8.1.0 (2026-10-14)

Features

  • output last_release_* from Git tags when no release is published (ef475bf)

v8.0.2

8.0.2 (2026-10-14)

Bug Fixes

  • resolve extra plugins with working_directory and relative extends (340bd34), closes #254

v8.0.1

8.0.1 (2026-10-13)

Bug Fixes

  • bypass package manager shims for internal npm calls (45d3d9c), closes #258

v8.0.0

8.0.0 (2026-10-12)

... (truncated)

Changelog

Sourced from cycjimmy/semantic-release-action's changelog.

8.1.3 (2026-10-19)

Bug Fixes

  • locate npm-cli.js from PATH on Windows runners (b810ddb), closes #332

8.1.2 (2026-10-16)

Bug Fixes

8.1.1 (2026-10-16)

Bug Fixes

  • split extends configurations on whitespace (6938171)

8.1.0 (2026-10-14)

Features

  • output last_release_* from Git tags when no release is published (ef475bf)

8.0.2 (2026-10-14)

Bug Fixes

  • resolve extra plugins with working_directory and relative extends (340bd34), closes #254

8.0.1 (2026-10-13)

Bug Fixes

  • bypass package manager shims for internal npm calls (45d3d9c), closes #258

8.0.0 (2026-10-12)

Features

  • require semantic-release v20 or above (1d650fa)

... (truncated)

Commits
  • d9bf53a chore(release): 8.1.3 [skip ci]
  • b810ddb fix: locate npm-cli.js from PATH on Windows runners
  • 9e4326c chore(ci): drop stale 'master' branch to restore latest npm dist-tag
  • 03595b5 chore(release): 8.1.2 [skip ci]
  • 2479d22 fix(deps): update @​semantic-release/github to 12.0.10
  • f4e0ba2 Merge pull request #331 from dajiaohuang/docs/config-defaults-20261015
  • 010067f chore(ci): add unit test workflow running node --test
  • 163a6cb chore(release): 8.1.1 [skip ci]
  • 8ee3045 Merge pull request #330 from dajiaohuang/fix/extends-whitespace-20261015
  • 079af5e docs: correct semantic-release configuration defaults
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 20, 2026
@socket-security

socket-security Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgithub/​actions/​create-github-app-token@​bcd2ba49218906704ab6c1aa796996da409d3eb1 ⏵ 64ab729a6294000f5aa4a4bc0b73d1f32bc4551090100100100100
Updatedgithub/​cycjimmy/​semantic-release-action@​b12c8f6015dc215fe37bc154d4ad456dd3833c90 ⏵ d9bf53a078bd2f86aaffaec796dbb3d28f1b6f3497100100100100

View full report

@socket-security

socket-security Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
Potential security risk (AI signal): github cycjimmy/semantic-release-action is 99.0% likely risky

Notes: This is an unsafe JavaScript-expression evaluator. It is not evidence of malware by itself, but it creates a code-injection risk when given untrusted strings. Use JSON.parse if JSON parsing is intended.

Confidence: 0.99

Severity: 0.78

From: .github/workflows/preview-next-version.yaml → github/cycjimmy/semantic-release-action@d9bf53a078bd2f86aaffaec796dbb3d28f1b6f34

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/cycjimmy/semantic-release-action@d9bf53a078bd2f86aaffaec796dbb3d28f1b6f34. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block
Low priority
Potential code anomaly (AI signal): github actions/create-github-app-token is 93.0% likely to have a medium risk anomaly

Notes: No direct malware is evident in this workflow. Running dependency installation and a repository-controlled script in a write-enabled pull-request job creates a meaningful supply-chain risk, particularly for same-repository pull requests. Consider isolating untrusted execution from write-capable credentials and granting write permissions only to a separately gated job.

Confidence: 0.93

Severity: 0.62

From: .github/workflows/manual-release.yaml → github/actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block
Low priority
Filesystem access: github cycjimmy/semantic-release-action

Location: Package overview

From: .github/workflows/preview-next-version.yaml → github/cycjimmy/semantic-release-action@d9bf53a078bd2f86aaffaec796dbb3d28f1b6f34

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/cycjimmy/semantic-release-action@d9bf53a078bd2f86aaffaec796dbb3d28f1b6f34. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block

View full report

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-d2f41061b6 branch from 797f623 to 4fc796f Compare October 21, 2026 22:17
@dependabot
ci: bump the github-actions group across 1 directory with 3 updates
fda402c 
Bumps the github-actions group with 3 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node), [actions/create-github-app-token](https://github.com/actions/create-github-app-token) and [cycjimmy/semantic-release-action](https://github.com/cycjimmy/semantic-release-action).


Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

Updates `cycjimmy/semantic-release-action` from 6.0.0 to 8.1.3
- [Release notes](https://github.com/cycjimmy/semantic-release-action/releases)
- [Changelog](https://github.com/cycjimmy/semantic-release-action/blob/main/docs/CHANGELOG.md)
- [Commits](cycjimmy/semantic-release-action@b12c8f6...d9bf53a)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: cycjimmy/semantic-release-action
  dependency-version: 8.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-d2f41061b6 branch from 4fc796f to fda402c Compare October 27, 2026 04:25

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants