build(deps): Bump actions/download-artifact from 4 to 8 - #641
build(deps): Bump actions/download-artifact from 4 to 8#641dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
The Supply Chain (OSV-Scanner) gate was red on every open PR, including all nine Dependabot bumps, on a finding none of them introduced: five undici advisories published after main's last green scan. undici is transitive under the jsdom test environment and already pinned via `overrides` from the previous round of this same fix (#446), so the repair is a one-line bump of that pin to 7.29.0. With the shared blocker gone, the nine bumps are folded in here rather than merged one at a time: #641 actions/download-artifact 4 -> 8 #642 docker/login-action 4.5.1 -> 4.6.0 #643 actions/upload-artifact 4 -> 7 #644 posthog-node 5.46.1 -> 5.47.7 #645 jsdom 30.0.0 -> 30.0.1 #646 @tanstack/react-virtual 3.14.8 -> 3.14.9 #647 lucide-react 1.27.0 -> 1.28.0 #648 @types/node 26.1.1 -> 26.1.2 #649 @vitejs/plugin-react 6.0.3 -> 6.0.5 The two artifact actions are major bumps and have to land together, because build-daemon.yml uploads the failproofaid-* binaries that publish.yml downloads. Every input in use was checked against each target's action.yml rather than assumed: name/path/if-no-files-found and pattern/path/merge-multiple all survive, and the new `archive` input defaults to true so the zip round trip is unchanged. translate-docs.yml was already on v7/v8, so this leaves the repo on one major instead of straddling two. Verified with CI's own scanner image (osv-scanner-action:v2.3.8) against the updated lockfile: No issues found, exit 0, with osv-scanner.toml still holding zero ignored vulnerabilities. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013zdtoUrNwGKm7ZYpQTdBZy
|
Superseded by #650, which lands this bump along with the other eight open Dependabot PRs (#641–#649). This PR's CI was red only on the Supply Chain (OSV-Scanner) gate, and on a finding it did not introduce: five advisories against Verified there: CI's own scanner image reports Closing in favour of #650 — no change is lost. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps actions/download-artifact from 4 to 8.
Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issuesbd7976bAdd a setting to specify what to do on hash mismatch and default it toerrorac21fcfMerge pull request #460 from actions/danwkennedy/download-no-unzip15999bfAdd note about package bumps974686eBump the version tov8and add release notesfbe48b1Update test names to make it clearer what they doDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)