chore(deps): update github actions to v7 by renovate[bot] · Pull Request #2540 · prettier/plugin-php

docs: update README.md by @motss in #1971
Add internal repos for checking out multiple repositories by @mouismail in #1977
Documentation update - add recommended permissions to Readme by @benwells in #2043
Adjust positioning of user email note and permissions heading by @joshmgross in #2044
Update README.md by @nebuk89 in #2194
Update CODEOWNERS for actions by @TingluoHuang in #2224
Update package dependencies by @salmanmkc in #2236

`v4.2.2`

Compare Source

url-helper.ts now leverages well-known environment variables by @jww3 in #1941
Expand unit test coverage for isGhes by @jww3 in #1946

`v4.2.1`

Compare Source

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in #1924

`v4.2.0`

Compare Source

Add Ref and Commit outputs by @lucacome in #1180
Dependency updates by @dependabot- #1777, #1872

`v4.1.7`

Compare Source

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in #1739
Bump actions/checkout from 3 to 4 by @dependabot in #1697
Check out other refs/* by commit by @orhantoy in #1774
Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in #1776

`v4.1.6`

Compare Source

Check platform to set archive extension appropriately by @cory-miller in #1732

`v4.1.5`

Compare Source

Update NPM dependencies by @cory-miller in #1703
Bump github/codeql-action from 2 to 3 by @dependabot in #1694
Bump actions/setup-node from 1 to 4 by @dependabot in #1696
Bump actions/upload-artifact from 2 to 4 by @dependabot in #1695
README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @cory-miller in #1707

`v4.1.4`

Compare Source

Disable extensions.worktreeConfig when disabling sparse-checkout by @jww3 in #1692
Add dependabot config by @cory-miller in #1688
Bump the minor-actions-dependencies group with 2 updates by @dependabot in #1693
Bump word-wrap from 1.2.3 to 1.2.5 by @dependabot in #1643

`v4.1.3`

Compare Source

Check git version before attempting to disable sparse-checkout by @jww3 in #1656
Add SSH user parameter by @cory-miller in #1685
Update actions/checkout version in update-main-version.yml by @jww3 in #1650

`v4.1.2`

Compare Source

Fix: Disable sparse checkout whenever sparse-checkout option is not present @dscho in #1598

`v4.1.1`

Compare Source

Correct link to GitHub Docs by @peterbe in #1511
Link to release page from what's new section by @cory-miller in #1514

`v4.1.0`

Compare Source

Add support for partial checkout filters

actions/setup-node

`v7.1.0`

Compare Source

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in #1421
Support absolute paths in node-version-file by @v-mahabaleshwars in #1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in #1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in #1578
docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in #1593
Fixed cache recommendation syntax by @SubJunk in #1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in #1583
Upgrade @actions/cache to 6.2.0 by @philip-gai in #1584
Pin @types/node to v24 by @v-priyagupta108 in #1585
Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in #1599
Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #1598
Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in #1590
Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in #1610
Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in #1602
Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in #1629
Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in #1616
Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in #1615
Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in #1631
Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in #1636
Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in #1638
Update dependencies and add license files by @v-HarithaVattikuti in #1642
Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in #1635

New Contributors

@v-jitenderpalsingh made their first contribution in #1580
@philip-gai made their first contribution in #1584
@gperdomor made their first contribution in #1421
@SubJunk made their first contribution in #1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

`v7.0.0`

Compare Source

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in #1577
Migrate to ESM and upgrade dependencies by @gowridurgad in #1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in #1558
Only use mirrorToken in getManifest if it's provided by @deiga in #1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in #1536
docs: Update restore-only cache documentation by @priya-kinthali in #1550
docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in #1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #1569

New Contributors

@chiranjib-swain made their first contribution in #1536
@deiga made their first contribution in #1548
@jasongin made their first contribution in #1569

Full Changelog: actions/setup-node@v6...v7.0.0

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

`v6.4.0`

Compare Source

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in #1525
Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in #1533

New Contributors

@Copilot made their first contribution in #1525

Full Changelog: actions/setup-node@v6...v6.4.0

`v6.3.0`

Compare Source

What's Changed

Enhancements:

Support parsing devEngines field by @susnux in #1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Fix npm audit issues by @gowridurgad in #1491
Replace uuid with crypto.randomUUID() by @trivikr in #1378
Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #1498

Bug fixes:

Remove hardcoded bearer for mirror-url @marco-ippolito in #1467
Scope test lockfiles by package manager and update cache tests by @gowridurgad in #1495

New Contributors

@susnux made their first contribution in #1283

Full Changelog: actions/setup-node@v6...v6.3.0

`v6.2.0`

Compare Source

What's Changed

Documentation

Documentation update related to absence of Lockfile by @mahabaleshwars in #1454
Correct mirror option typos by @MikeMcC399 in #1442
Readme update on checkout version v6 by @deining in #1446
Readme typo fixes @munyari in #1226
Advanced document update on checkout version v6 by @aparnajyothi-y in #1468

Dependency updates:

Upgrade @actions/cache to v5.0.1 by @salmanmkc in #1449

New Contributors

@mahabaleshwars made their first contribution in #1454
@MikeMcC399 made their first contribution in #1442
@deining made their first contribution in #1446
@munyari made their first contribution in #1226

Full Changelog: actions/setup-node@v6...v6.2.0

`v6.1.0`

Compare Source

What's Changed

Enhancement:

Remove always-auth configuration handling by @priyagupta108 in #1436

Dependency updates:

Upgrade @actions/cache from 4.0.3 to 4.1.0 by @dependabot[bot] in #1384
Upgrade actions/checkout from 5 to 6 by @dependabot[bot] in #1439
Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in #1435

Documentation update:

Add example for restore-only cache in documentation by @aparnajyothi-y in #1419

Full Changelog: actions/setup-node@v6...v6.1.0

`v6.0.0`

Compare Source

What's Changed

Breaking Changes

Limit automatic caching to npm, update workflows and documentation by @priyagupta108 in #1374

Dependency Upgrades

Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336
Upgrade prettier from 2.8.8 to 3.6.2 by @dependabot[bot] in #1334
Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot[bot] in #1362

Full Changelog: actions/setup-node@v5...v6.0.0

`v5.0.0`

Compare Source

What's Changed

Breaking Changes

Enhance caching in setup-node with automatic package manager detection by @priya-kinthali in #1348

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Upgrade action to use node24 by @salmanmkc in #1325

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

Upgrade @octokit/request-error and @actions/github by @dependabot[bot] in #1227
Upgrade uuid from 9.0.1 to 11.1.0 by @dependabot[bot] in #1273
Upgrade undici from 5.28.5 to 5.29.0 by @dependabot[bot] in #1295
Upgrade form-data to bring in fix for critical vulnerability by @gowridurgad in #1332
Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in #1345

New Contributors

@priya-kinthali made their first contribution in #1348
@salmanmkc made their first contribution in #1325

Full Changelog: actions/setup-node@v4...v5.0.0

`v4.4.0`

Compare Source

What's Changed

Bug fixes:

Make eslint-compact matcher compatible with Stylelint by @FloEdelmann in #98
Add support for indented eslint output by @fregante in #1245

Enhancement:

Support private mirrors by @marco-ippolito in #1240

Dependency update:

Upgrade @action/cache from 4.0.2 to 4.0.3 by @aparnajyothi-y in #1262

New Contributors

@FloEdelmann made their first contribution in #98
@fregante made their first contribution in #1245
@marco-ippolito made their first contribution in #1240

Full Changelog: actions/setup-node@v4...v4.4.0

`v4.3.0`

Compare Source

What's Changed

Dependency updates

Upgrade @actions/glob from 0.4.0 to 0.5.0 by @dependabot in #1200
Upgrade @action/cache from 4.0.0 to 4.0.2 by @gowridurgad in #1251
Upgrade @vercel/ncc from 0.38.1 to 0.38.3 by @dependabot in #1203
Upgrade @actions/tool-cache from 2.0.1 to 2.0.2 by @dependabot in #1220

New Contributors

@gowridurgad made their first contribution in #1251

Full Changelog: actions/setup-node@v4...v4.3.0

`v4.2.0`

Compare Source

What's Changed

Enhance workflows and upgrade publish-actions from 0.2.2 to 0.3.0 by @aparnajyothi-y in #1174
Add recommended permissions section to readme by @benwells in #1193
Configure Dependabot settings by @HarithaVattikuti in #1192
Upgrade @actions/cache to ^4.0.0 by @priyagupta108 in #1191
Upgrade pnpm/action-setup from 2 to 4 by @dependabot in #1194
Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @dependabot in #1195
Upgrade semver from 7.6.0 to 7.6.3 by @dependabot in #1196
Upgrade @types/jest from 29.5.12 to 29.5.14 by @dependabot in #1201
Upgrade undici from 5.28.4 to 5.28.5 by @dependabot in #1205

New Contributors

@benwells made their first contribution in #1193

Full Changelog: actions/setup-node@v4...v4.2.0

`v4.1.0`

Compare Source

What's Changed

Resolve High Security Alerts by upgrading Dependencies by @aparnajyothi-y in #1132
Upgrade IA Publish by @Jcambass in #1134
Revise isGhes logic by @jww3 in #1148
Add architecture to cache key by @pengx17 in #843
This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts.
Note: This change may break previous cache keys as they will no longer be compatible with the new format.

New Contributors

@jww3 made their first contribution in #1148
@pengx17 made their first contribution in #843

Full Changelog: actions/setup-node@v4...v4.1.0

`v4.0.4`

Compare Source

What's Changed

Add workflow file for publishing releases to immutable action package by @Jcambass in #1125
Enhance Windows ARM64 Setup and Update micromatch Dependency by @priyagupta108 in #1126

Documentation changes:

Documentation update in the README file by @suyashgaonkar in #1106
Correct invalid 'lts' version string reference by @fulldecent in #1124

New Contributors

@suyashgaonkar made their first contribution in #1106
@priyagupta108 made their first contribution in #1126
@Jcambass made their first contribution in #1125
@fulldecent made their first contribution in #1124

Full Changelog: actions/setup-node@v4...v4.0.4

`v4.0.3`

Compare Source

What's Changed

Bug fixes:

Fix macos latest check failures by @HarithaVattikuti in #1041

Documentation changes:

Documentation update to update default Node version to 20 by @bengreeley in #949

Dependency updates:

Bump undici from 5.26.5 to 5.28.3 by @dependabot in #965
Bump braces from 3.0.2 to 3.0.3 and other dependency updates by @dependabot in #1087

New Contributors

@bengreeley made their first contribution in #949
@HarithaVattikuti made their first contribution in #1041

Full Changelog: actions/setup-node@v4...v4.0.3

`v4.0.2`

Compare Source

What's Changed

Add support for volta.extends by @ThisIsManta in #921
Add support for arm64 Windows by @dmitry-shibanov in #927

New Contributors

@ThisIsManta made their first contribution in #921

Full Changelog: actions/setup-node@v4.0.1...v4.0.2

`v4.0.1`

Compare Source

What's Changed

Ignore engines in Yarn 1 e2e-cache tests by @trivikr in #882
Update setup-node references in the README.md file to setup-node@v4 by @jwetzell in #884
Update reusable workflows to use Node.js v20 by @MaksimZhukov in #889
Add fix for cache to resolve slow post action step by @aparnajyothi-y in #917
Fix README.md by @takayamaki in #898
Add package.json to node-version-file list of examples. by @TWiStErRob in #879
Fix node-version-file interprets entire package.json as a version by @NullVoxPopuli in #865

New Contributors

@trivikr made their first contribution in #882
@jwetzell made their first contribution in #884
@aparnajyothi-y made their first contribution in #917
@takayamaki made their first contribution in #898
@TWiStErRob made their first contribution in #879
@NullVoxPopuli made their first contribution in #865

Full Changelog: actions/setup-node@v4...v4.0.1

codecov/codecov-action

`v7.1.1`

Compare Source

What's Changed

chore(release): 7.1.1 by @thomasrockhu-codecov in #1973

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

`v7.1.0`

Compare Source

What's Changed

chore(release): 7.1.0 by @thomasrockhu-codecov in #1971

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

`v7.0.0`

Compare Source

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

ci: remove Enforce License Compliance workflow by @thomasrockhu-codecov in #1950
chore(release): 7.0.0 by @thomasrockhu-codecov in #1957

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

`v6.0.2`

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

ci: remove Enforce License Compliance workflow by @thomasrockhu-codecov in #1950
chore(release): 7.0.0 by @thomasrockhu-codecov in #1957

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

`v6.0.1`

Compare Source

What's Changed

fix: prevent template injection in run: steps (VULN-1652) by @thomasrockhu-codecov in #1947
chore(release): 6.0.1 by @thomasrockhu-codecov in #1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

`v6.0.0`

Compare Source

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by @thomasrockhu-codecov in #1929
Th/6.0.0 by @thomasrockhu-codecov in #1928

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

`v5.5.5`

Compare Source

This release only contains the keybase.io change as described here.

Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5

`v5.5.4`

Compare Source

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by @thomasrockhu-codecov in #1926
chore(release): 5.5.4 by @thomasrockhu-codecov in #1927

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

`v5.5.3`

Compare Source

What's Changed

build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #1874
chore(release): bump to 5.5.3 by @thomasrockhu-codecov in #1922

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

What's Changed

fix: overwrite pr number on fork by @thomasrockhu-codecov in #1871
build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @app/dependabot in #1868
build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by @app/dependabot in #1867
fix: update to use local app/ dir by @thomasrockhu-codecov in #1872
docs: fix typo in README by @datalater in #1866
Document a codecov-cli version reference example by @webknjaz in #1774
build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by @app/dependabot in #1861
build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @app/dependabot in #1833

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

`v5.5.0`

Compare Source

What's Changed

feat: upgrade wrapper to 0.2.4 by @jviall in #1864
Pin actions/github-script by Git SHA by @martincostello in #1859
fix: check reqs exist by @joseph-sentry in #1835
fix: Typo in README by @spalmurray in #1838
docs: Refine OIDC docs by @spalmurray in #1837
build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by [@app/dep

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): update github actions to v7

0de41b8

fisker merged commit 045f415 into main Oct 20, 2026
12 checks passed

fisker deleted the renovate/major-github-actions branch October 20, 2026 03:42

Navigation Menu

Repository navigation

chore(deps): update github actions to v7 - #2540

chore(deps): update github actions to v7#2540
fisker merged 1 commit into
mainfrom
renovate/major-github-actions

renovate Bot commented Oct 20, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 20, 2026

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

What's Changed

What's Changed

Dependency updates:

New Contributors

What's Changed

Enhancements:

Dependency updates:

Bug fixes:

New Contributors

What's Changed

Documentation

Dependency updates:

New Contributors

What's Changed

Enhancement:

Dependency updates:

Documentation update:

What's Changed

What's Changed

Breaking Changes

Dependency Upgrades

New Contributors

What's Changed

Bug fixes:

Enhancement:

Dependency update:

New Contributors

What's Changed

Dependency updates

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Documentation changes:

New Contributors

What's Changed

Bug fixes:

Documentation changes:

Dependency updates:

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

Uh oh!

Uh oh!

Reviewers