Skip to content

build(deps): bump the ci-dependencies group across 1 directory with 8 updates#118

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/ci-dependencies-82d340216f
Open

build(deps): bump the ci-dependencies group across 1 directory with 8 updates#118
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/ci-dependencies-82d340216f

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 22, 2025

Bumps the ci-dependencies group with 8 updates in the / directory:

Package From To
stumpylog/image-cleaner-action 0.11.0 0.12.0
actions/checkout 5.0.0 6.0.1
astral-sh/setup-uv 6.6.0 7.1.6
docker/metadata-action 5.8.0 5.10.0
docker/setup-qemu-action 3.6.0 3.7.0
docker/setup-buildx-action 3.11.1 3.12.0
docker/login-action 3.5.0 3.6.0
hadolint/hadolint-action 3.1.0 3.3.0

Updates stumpylog/image-cleaner-action from 0.11.0 to 0.12.0

Release notes

Sourced from stumpylog/image-cleaner-action's releases.

v0.12.0

Changed

  • Updates locked dependencies
  • Bumps actions/checkout from 4 to 5
  • Updated astral-sh/setup-uv to v6.8.0
  • Responses from the GitHub API are now typed using models derived from the JSON schema provided in the documentation
  • Implement RegistryClient for talking directly with a compliant registry host
    • Determination of the tagged/untagged status for multi-architecture images now directly uses the registry instead of calling docker via subprocess
    • Validation the registry still holds all tags and multi-arch pointers now uses the registry as well
    • This should be much faster to determine both items now
    • HTTP calls include automatic retry with exponential backoff and jitter
    • HTTP calls handle authenticating with a temporary token to the registry, including expiration
  • uv caching should now be enabled
  • Much improved rate limit handling
    • All requests now check the X-RateLimit-Remaining header and if approaching the limit, utilize X-RateLimit-Reset to sleep until it resets
  • Updates uv to the 0.9.x branch

Fixed

  • Various warnings from astral-sh/setup-uv have been silenced or fixed
Changelog

Sourced from stumpylog/image-cleaner-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.12.0] - 2025-10-21

Changed

  • Updates locked dependencies
  • Bumps actions/checkout from 4 to 5
  • Updated astral-sh/setup-uv to v6.8.0
  • Responses from the GitHub API are now typed using models derived from the JSON schema provided in the documentation
  • Implement RegistryClient for talking directly with a compliant registry host
    • Determination of the tagged/untagged status for multi-architecture images now directly uses the registry instead of calling docker via subprocess
    • Validation the registry still holds all tags and multi-arch pointers now uses the registry as well
    • This should be much faster to determine both items now
    • HTTP calls include automatic retry with exponential backoff and jitter
    • HTTP calls handle authenticating with a temporary token to the registry, including expiration
  • uv caching should now be enabled
  • Much improved rate limit handling
    • All requests now check the X-RateLimit-Remaining header and if approaching the limit, utilize X-RateLimit-Reset to sleep until it resets
  • Updates uv to the 0.9.x branch

Fixed

  • Various warnings from astral-sh/setup-uv have been silenced or fixed

[0.11.0] - 2025-08-04

Added

  • Initial unit testing of the GitHub API interactions

Changed

  • Updated astral-sh/setup-uv to v6.4.3
  • Updates uv to 0.8.x
  • Updates locked dependencies

[0.10.0] - 2025-02-14

Changed

  • Dependency updates
  • Updated astral-sh/setup-uv to v4
  • Updated default Python to 3.12

... (truncated)

Commits
  • 4fe057d Merge branch 'release/0.12.0'
  • 1140f85 Bumps version to 0.12.0
  • 47fa123 Adds a funding, not that anyone uses this
  • eaa541e Bump ruff from 0.13.2 to 0.14.1 (#139)
  • 7f433da Bump httpx-retries from 0.4.2 to 0.4.5 (#138)
  • e003c8c Bump pre-commit-uv from 4.1.5 to 4.2.0 (#136)
  • 6ed7962 Formats the yml, upgrades uv
  • 54d4538 Bump actions/setup-python from 5 to 6 (#132)
  • 779974e feature: Converts everything to async and paralellize network tasks (#133)
  • 7ccf89c Bump astral-sh/setup-uv from 6.4.3 to 6.8.0 (#125)
  • Additional commits viewable in compare view

Updates actions/checkout from 5.0.0 to 6.0.1

Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

... (truncated)

Commits

Updates astral-sh/setup-uv from 6.6.0 to 7.1.6

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.1.6 🌈 add OS version to cache key to prevent binary incompatibility

Changes

This release will invalidate your cache existing keys!

The os version e.g. ubuntu-22.04 is now part of the cache key. This prevents failing builds when a cache got populated with wheels built with different tools (e.g. glibc) than are present on the runner where the cache got restored.

🐛 Bug fixes

  • feat: add OS version to cache key to prevent binary incompatibility @​eifinger (#716)

🧰 Maintenance

⬆️ Dependency updates

v7.1.5 🌈 allow setting cache-local-path without enable-cache: true

Changes

astral-sh/setup-uv#612 fixed a faulty behavior where this action set UV_CACHE_DIR even though enable-cache was false. It also fixed the cases were the cache dir is already configured in a settings file like pyproject.toml or UV_CACHE_DIR was already set. Here the action shouldn't overwrite or set UV_CACHE_DIR.

These fixes introduced an unwanted behavior: You can still set cache-local-path but this action didn't do anything. This release fixes that.

You can now use cache-local-path to automatically set UV_CACHE_DIR even when enable-cache is false (or gets set to false by default e.g. on self-hosted runners)

- name: This is now possible
  uses: astral-sh/setup-uv@v7
  with:
    enable-cache: false
    cache-local-path: "/path/to/cache"

🐛 Bug fixes

🧰 Maintenance

... (truncated)

Commits
  • 681c641 Bump actions/checkout from 5.0.0 to 6.0.1 (#712)
  • 2e85713 Bump actions/setup-node from 6.0.0 to 6.1.0 (#715)
  • 58b6d7b fix: add OS version to cache key to prevent binary incompatibility (#716)
  • e8b52af chore: update known checksums for 0.9.17 (#714)
  • ed21f2f Bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 (#695)
  • 93202d8 bump dependencies (#709)
  • 5ce0900 set biome files.maxSize to 2MiB (#708)
  • 4180991 allow cache-local-path w/o enable-cache (#707)
  • 0439606 Bump github/codeql-action from 4.30.9 to 4.31.6 (#698)
  • 7dd56c1 chore: update known checksums for 0.9.16 (#706)
  • Additional commits viewable in compare view

Updates docker/metadata-action from 5.8.0 to 5.10.0

Release notes

Sourced from docker/metadata-action's releases.

v5.10.0

Full Changelog: docker/metadata-action@v5.9.0...v5.10.0

v5.9.0

Full Changelog: docker/metadata-action@v5.8.0...v5.9.0

Commits
  • c299e40 Merge pull request #569 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • f015d79 chore: update generated content
  • 121bcc2 chore(deps): Bump @​docker/actions-toolkit from 0.67.0 to 0.68.0
  • f7b6bf4 Merge pull request #564 from docker/dependabot/npm_and_yarn/js-yaml-3.14.2
  • 0b95c6b Merge pull request #565 from docker/dependabot/github_actions/actions/checkout-6
  • 17f70d7 Merge pull request #568 from motoki317/docs/fix-to-24h-schedule-pattern
  • afd7e6d docs(README): Fix date format from 12h to 24h in schedule pattern
  • 602aff8 chore(deps): Bump actions/checkout from 5 to 6
  • aecb1a4 chore(deps): Bump js-yaml from 3.14.1 to 3.14.2
  • 8d8c7c1 Merge pull request #559 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • Additional commits viewable in compare view

Updates docker/setup-qemu-action from 3.6.0 to 3.7.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v3.7.0

Full Changelog: docker/setup-qemu-action@v3.6.0...v3.7.0

Commits
  • c7c5346 Merge pull request #230 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 3a517a1 chore: update generated content
  • a5b45ed build(deps): bump @​docker/actions-toolkit from 0.62.1 to 0.67.0
  • 3a64278 Merge pull request #220 from docker/dependabot/npm_and_yarn/brace-expansion-1...
  • 94906ba chore: update generated content
  • 4027abf build(deps): bump brace-expansion from 1.1.11 to 1.1.12
  • bee0aaa Merge pull request #221 from docker/dependabot/npm_and_yarn/tmp-0.2.4
  • 0d7e257 chore: update generated content
  • b869601 build(deps): bump tmp from 0.2.3 to 0.2.4
  • 3a043ed Merge pull request #219 from docker/dependabot/npm_and_yarn/undici-5.29.0
  • Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.11.1 to 3.12.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.12.0

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

Commits
  • 8d2750c Merge pull request #455 from crazy-max/install-deprecated
  • e81846b deprecate install input
  • 65d18f8 Merge pull request #454 from docker/dependabot/github_actions/actions/checkout-6
  • 000d75d build(deps): bump actions/checkout from 5 to 6
  • 1583c0f Merge pull request #443 from nicolasleger/patch-1
  • ed158e7 doc: bump actions/checkout from 4 to 5
  • 4cc794f Merge pull request #441 from docker/dependabot/github_actions/actions/checkout-5
  • 4dfc3d6 build(deps): bump actions/checkout from 4 to 5
  • af1b253 Merge pull request #440 from crazy-max/k3s-build
  • 3c6ab92 ci: k3s test with latest buildx
  • Additional commits viewable in compare view

Updates docker/login-action from 3.5.0 to 3.6.0

Release notes

Sourced from docker/login-action's releases.

v3.6.0

Full Changelog: docker/login-action@v3.5.0...v3.6.0

Commits
  • 5e57cd1 Merge pull request #890 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • 97e3143 chore: update generated content
  • 3a0796b build(deps): bump the aws-sdk-dependencies group with 2 updates
  • 5b7b28b Merge pull request #882 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • abc9fb3 chore: update generated content
  • d468688 build(deps): bump the aws-sdk-dependencies group with 2 updates
  • a99b2f8 Merge pull request #883 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 0d7fae8 chore: update generated content
  • 9832253 build(deps): bump @​docker/actions-toolkit from 0.62.1 to 0.63.0
  • 09e05bb Merge pull request #881 from docker/dependabot/npm_and_yarn/tmp-0.2.4
  • Additional commits viewable in compare view

Updates hadolint/hadolint-action from 3.1.0 to 3.3.0

Release notes

Sourced from hadolint/hadolint-action's releases.

v3.3.0

3.3.0 (2025-09-22)

Features

  • trigger release workflow (2332a7b)

v3.2.0

3.2.0 (2025-09-03)

Features

Commits
  • 2332a7b feat: trigger release workflow
  • 2bfd2b9 Don't trigger release workflow on Tag
  • 0931ae0 Release v3.3.0
  • 3fc49fb feat: new minor release
  • 45eb072 Trigger release workflow on tag
  • 97f3e4f Merge pull request #94 from felipecrs/patch-1
  • 3e9a095 Merge branch 'master' into patch-1
  • 3285327 Merge pull request #96 from m-ildefons/update-ci-yml
  • 8bde06f Update CI yml
  • 24598f4 Update base image for Hadolint
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates

Bumps the ci-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [stumpylog/image-cleaner-action](https://github.com/stumpylog/image-cleaner-action) | `0.11.0` | `0.12.0` |
| [actions/checkout](https://github.com/actions/checkout) | `5.0.0` | `6.0.1` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.6.0` | `7.1.6` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.8.0` | `5.10.0` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.6.0` | `3.7.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.11.1` | `3.12.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.5.0` | `3.6.0` |
| [hadolint/hadolint-action](https://github.com/hadolint/hadolint-action) | `3.1.0` | `3.3.0` |



Updates `stumpylog/image-cleaner-action` from 0.11.0 to 0.12.0
- [Release notes](https://github.com/stumpylog/image-cleaner-action/releases)
- [Changelog](https://github.com/stumpylog/image-cleaner-action/blob/main/CHANGELOG.md)
- [Commits](stumpylog/image-cleaner-action@7e246b8...4fe057d)

Updates `actions/checkout` from 5.0.0 to 6.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@08c6903...8e8c483)

Updates `astral-sh/setup-uv` from 6.6.0 to 7.1.6
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@4959332...681c641)

Updates `docker/metadata-action` from 5.8.0 to 5.10.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)

Updates `docker/setup-qemu-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)

Updates `docker/setup-buildx-action` from 3.11.1 to 3.12.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)

Updates `docker/login-action` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)

Updates `hadolint/hadolint-action` from 3.1.0 to 3.3.0
- [Release notes](https://github.com/hadolint/hadolint-action/releases)
- [Commits](hadolint/hadolint-action@54c9adb...2332a7b)

---
updated-dependencies:
- dependency-name: stumpylog/image-cleaner-action
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: astral-sh/setup-uv
  dependency-version: 7.1.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: docker/metadata-action
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: docker/setup-qemu-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
- dependency-name: hadolint/hadolint-action
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Dec 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants