Skip to content

Bump the github-actions group with 6 updates - #106

Merged
0verEngineer merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-723073175f
Sep 7, 2026
Merged

Bump the github-actions group with 6 updates#106
0verEngineer merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-723073175f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 6 updates:

Package From To
actions/checkout 4 7
actions/setup-java 4 6
gradle/actions 4 6
gradle/wrapper-validation-action 2 3
actions/upload-artifact 4 7
JetBrains/qodana-action 2024.2 2026.2

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-java from 4 to 6

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

... (truncated)

Commits

Updates gradle/actions from 4 to 6

Release notes

Sourced from gradle/actions's releases.

v6.0.0

[!IMPORTANT] The release of gradle/actions@v6 contains important changes to the license terms. More details in this blog post. TL;DR: By upgrading to v6, you accept the Terms of Use for the gradle-actions-caching component.

Summary

  • Caching functionality of 'gradle-actions' has been extracted into a separate gradle-actions-caching library, and is no longer open-source. See this blog post for more context.
  • Existing, rudimentary, configuration-cache support has been removed, pending a fully functional implementation in gradle-actions-caching.
  • Dependencies updated to address security vulnerabilities

[!IMPORTANT]

Licensing notice

The caching functionality in `gradle-actions` has been extracted into `gradle-actions-caching`, a proprietary commercial component that is not covered by the MIT License. The bundled `gradle-actions-caching` component is licensed and governed by a separate license, available at https://gradle.com/legal/terms-of-use/.

The `gradle-actions-caching` component is used only when caching is enabled and is not loaded or used when caching is disabled.

Use of the `gradle-actions-caching` component is subject to a separate license, available at https://gradle.com/legal/terms-of-use/. If you do not agree to these license terms, do not use the `gradle-actions-caching` component.

What's Changed

Full Changelog: gradle/actions@v5.0.2...v6.0.0

v5.0.2

Summary

This release contains no functional changes. It updates dependencies and known Gradle wrapper checksums.

What's Changed

... (truncated)

Commits
  • 9c97196 Bump the github-actions group across 2 directories with 9 updates (#1024)
  • 760e4a4 Bump the npm-dependencies group across 1 directory with 2 updates (#1037)
  • 73e4c42 Update gradle-actions-caching library to v1.0.0 (#1029)
  • a9d1438 Add dependabot ignore rules for TypeScript 7.x and @​types/node 25.x/26.x
  • 68f3700 [bot] Update dist directory
  • 5971332 Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...
  • b5bc804 [bot] Update dist directory
  • dcbab4e Bump npm-dependencies group with TypeScript 6.0.3, @​types/node 24.x, and secu...
  • ca8d957 Move non-smoke restore-gradle-home tests back to the integ-test suite (#1032)
  • 4318659 [bot] Update dist directory
  • Additional commits viewable in compare view

Updates gradle/wrapper-validation-action from 2 to 3

Release notes

Sourced from gradle/wrapper-validation-action's releases.

v2.1.3

What's Changed

  • Update various NPM dependencies
  • Update wrapper checksums to include Gradle 8.7

Full Changelog: gradle/wrapper-validation-action@v2.1.2...v2.1.3

v2.1.2

What's Changed

  • Update various NPM dependencies
  • Update wrapper checksums

Full Changelog: gradle/wrapper-validation-action@v2.1.1...v2.1.2

v2.1.1

Changelog

  • [FIX] Add hardcoded checksum for Gradle 7.6.4

Full Changelog: gradle/wrapper-validation-action@v2...v2.1.1

v2.1.0

This release should vastly reduce the number of network requests made by the wrapper-validation-action, by hardcoding the checksums of all known Gradle wrapper jars at time of release. With this improvement, a number of long-standing issues should be addressed (#164, #162, #57).

The action should now only make network requests to validate the checksums of an unknown gradle-wrapper.jar. This can happen if:

  • The Gradle version was published after this action was released
  • The gradle-wrapper.jar is truly invalid

Changelog

  • [NEW] Hardcode list of known checksums to avoid network requests in most cases (#161)

Huge thanks to @​Marcono1234 for contributing this long-awaited improvement.

v2.0.1

This patch release fixes error reporting when failing to retrieve the checksums from services.gradle.org

  • [FIX] After migration from v1 to v2 silently fails (#174)
Commits

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates JetBrains/qodana-action from 2024.2 to 2026.2

Release notes

Sourced from JetBrains/qodana-action's releases.

v2026.2.0

Changelog

  • 69c00ce 🐛 Fix azure release workflow husky error (#604)
  • f4341f6 QD-14362 bump color able axios version to 1.15.2
  • 97d17d6 QD-13746 pass Qodana exit code in action
  • cf5541e QD-12982 skip pull in action if arg is specified
  • f28920a :docs: Update qodana-maven-plugin version to 2026.1.3
  • 1f6f293 QD-15472 bump tar dependency
  • e11337f QD-15410 check that in case of pr-mode: true the repository checked out to source branch
  • 8069c0f QD-15420 Warn about sanity problems in the summary posted in the pull request comments
  • d37471b 🐛 QD-14507 Add title parameter to gh release create command (#593)
  • b588768 QD-15622 ⬆️ Update qodana to v2026.2.0 (#611)

v2026.1.3

Changelog

  • b0eaa86 ⬆️ Bump Kotlin to 2.3.0
  • c91a70c ✨ Add Maven plugin for Qodana
  • ca746a1 🐛 QD-14658 Fix Maven integration test with reliable Python issue detection
  • 1ca399e 🧱 Update vsts/QodanaScan/index.js
  • 6975b5c ✅ QD-14666 Update GitHub Action tests to use new CLI arguments (#597)
  • ab64602 ⬆️ Update qodana to v2026.1.1 (#595)
  • ac6b2a1 🐛 QD-14655 fix cache copy error and update the component
  • f44cbf3 🐛 QD-14679 Append native cache key as prefix, not suffix
  • cfac2b9 :feature: QD-14680 Switch auto-push of dist changes to local pre-commit check
  • c3af492 🐛 QD-15013 Fix azure-dev-release workflow failure due to missing husky (#602)
  • 4861e01 ⬆️ Update qodana to v2026.1.3 (#603)

v2026.1.0

Changelog

  • 91e26dc ✨ Add support for retrieving and using the latest nightly release tags
  • 203eab0 ✨ QD-13829 remove auto-addition of --within-docker for qodana docker executions
  • 93546d8 ✨ QD-13829 distinguish native/docker caches
  • 3492039 ✨ QD-14035 bump node version to 24
  • d22cd6b ✨ QD-14035 prioritize real merge-base computation to avoid stale pr.base.sha issue
  • e1b97b3 🐛 QD-13829 fix incorrect check for QODANA_DOCKER environment variable
  • 7cc2d8d ⬆️ Update Node.js version to 24.14.1 and add .npmrc with min-release-age=7d
  • d436fca ⬆️ Bump the dependencies group across 1 directory with 2 updates
  • 2268e0f ✨ QD-14278 allow to specify which nightly to use
  • 498e15f ⬆️ Bump the dependencies group across 1 directory with 14 updates #590
  • d7b5ec2 ⬆️ Update qodana to the v2026.1.0 (#592)

v2025.3.2

Changelog

  • 412e8b0 ⬆️ Bump qs from 6.14.0 to 6.14.1 in /gitlab
  • 58285fd ⬆️ Bump actions/upload-artifact in the dependencies group
  • c500323 ⬆️ Bump tar from 7.5.2 to 7.5.3
  • 63097d0 ⬆️ Bump tar from 7.5.3 to 7.5.4
  • d2cddc4 ⬆️ Bump lodash from 4.17.21 to 4.17.23
  • 747a46a ⬆️ Bump tar from 7.5.2 to 7.5.4 in /gitlab (#554)
  • 58fe1b8 ✨ QD-5339 Switch to space-separated arguments

... (truncated)

Commits
  • 10be116 ⬆️ Update qodana to v2026.2.1 (#615)
  • e0675fb Handle originalUriBaseIds in GitHub
  • 829c6a5 ✨ QD-13944 allow the usage of preinstalled qodana-cli
  • ecb4241 🧱 QD-15585 Bump vulnarable dependency
  • 7ce8bde 🔧 clean up code after review
  • eb64353 🔧 Add scan/tsconfig.spec.json for editor type-checking in tests
  • c89fe30 🐛 Remove the eyes reaction when analysis finishes
  • b588768 QD-15622 ⬆️ Update qodana to v2026.2.0 (#611)
  • d37471b 🐛 QD-14507 Add title parameter to gh release create command (#593)
  • 8069c0f QD-15420 Warn about sanity problems in the summary posted in the pull request...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [actions/setup-java](https://github.com/actions/setup-java) | `4` | `6` |
| [gradle/actions](https://github.com/gradle/actions) | `4` | `6` |
| [gradle/wrapper-validation-action](https://github.com/gradle/wrapper-validation-action) | `2` | `3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [JetBrains/qodana-action](https://github.com/jetbrains/qodana-action) | `2024.2` | `2026.2` |


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `actions/setup-java` from 4 to 6
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v4...v6)

Updates `gradle/actions` from 4 to 6
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@v4...v6)

Updates `gradle/wrapper-validation-action` from 2 to 3
- [Release notes](https://github.com/gradle/wrapper-validation-action/releases)
- [Commits](gradle/wrapper-validation-action@v2...v3)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `JetBrains/qodana-action` from 2024.2 to 2026.2
- [Release notes](https://github.com/jetbrains/qodana-action/releases)
- [Commits](JetBrains/qodana-action@v2024.2...v2026.2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: gradle/actions
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: gradle/wrapper-validation-action
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: JetBrains/qodana-action
  dependency-version: '2026.2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 7, 2026
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

Qodana for JVM

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.2.1
        with:
          upload-result: true
Contact Qodana team

Contact us at qodana-support@jetbrains.com

@0verEngineer
0verEngineer merged commit 02c596a into main Sep 7, 2026
6 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-723073175f branch September 7, 2026 11:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant