Deps: Update GH Action Deps (major) by renovate[bot] · Pull Request #497 · nginxinc/nginx-hugo-theme

renovate · 2026-08-31T01:40:42Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v6.0.2` → `v7.0.1`
actions/deploy-pages	action	major	`v4.0.5` → `v5.0.1`
actions/github-script	action	major	`v8.0.0` → `v9.0.0`
actions/setup-go	action	major	`v6.3.0` → `v7.0.0`
actions/setup-node	action	major	`v6.3.0` → `v7.1.0`
actions/upload-pages-artifact	action	major	`v4` → `v5.0.0`
fossas/fossa-action	action	major	`v1.8.0` → `v2.0.0`
node	uses-with	major	`24.14.0` → `26.13.0`

Release Notes

actions/checkout

`v7.0.1`

Compare Source

Skip running unsafe pr check if input is default by @aiqiaoy in #2518
Trim only ascii whitespace for branch by @aiqiaoy in #2521
Escape values passed to --unset by @aiqiaoy in #2530
Various dependency updates

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Various dependency updates

`v6.1.0`

Compare Source

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in #2500
backport fixes to releases-v6 by @aiqiaoy in #2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

actions/deploy-pages

`v5.0.1`

Compare Source

Changelog

Add backoff and jitter to deployment polling @yoannchaudet (#444)
Improve deployment request test coverage @adwitiyagoyal (#440)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

`v5.0.0`

Compare Source

Changelog

Update Node.js version to 24.x @salmanmkc (#404)
Add workflow file for publishing releases to immutable action package @Jcambass (#374)
Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory @dependabot (#360)
Make the rebuild dist workflow work nicer with Dependabot @yoannchaudet (#361)
Bump the non-breaking-changes group across 1 directory with 3 updates @dependabot (#358)
Delete repeated sentence @garethsb (#359)
Update README.md @tsusdere (#348)
Bump the non-breaking-changes group with 4 updates @dependabot (#341)
Remove error message for file permissions @TooManyBees (#340)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

actions/github-script

`v9.0.0`

Compare Source

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in #695
ci: use deployment: false for integration test environments by @salmanmkc in #712
feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in #700

New Contributors

@Copilot made their first contribution in #695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

actions/setup-go

`v7.0.0`

Compare Source

What's Changed

Migrate to ESM and upgrade dependencies by @priyagupta108 in #763
chore(deps): bump @actions/cache to 6.2.0 by @philip-gai in #771

New Contributors

@philip-gai made their first contribution in #771

Full Changelog: actions/setup-go@v6...v7.0.0

`v6.5.0`

Compare Source

What's Changed

Dependency update

Upgrade actions dependencies by @priyagupta108 with @Copilot in #744
Upgrade @types/node and typescript-eslint dependencies to resolve npm audit findings by @HarithaVattikuti in #755
Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #758
Upgrade version to 6.5.0 in package.json and package-lock.json by @HarithaVattikuti in #762

New Contributors

@priyagupta108 with @Copilot made their first contribution in #744
@jasongin made their first contribution in #758

Full Changelog: actions/setup-go@v6...v6.5.0

`v6.4.0`

Compare Source

What's Changed

Enhancement

Add go-download-base-url input for custom Go distributions by @gdams in #721

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #727

Documentation update

Rearrange README.md, add advanced-usage.md by @priyagupta108 in #724
Fix Microsoft build of Go link by @gdams in #734

New Contributors

@gdams made their first contribution in #721

Full Changelog: actions/setup-go@v6...v6.4.0

actions/setup-node

`v7.1.0`

Compare Source

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in #1421
Support absolute paths in node-version-file by @v-mahabaleshwars in #1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in #1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in #1578
docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in #1593
Fixed cache recommendation syntax by @SubJunk in #1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in #1583
Upgrade @actions/cache to 6.2.0 by @philip-gai in #1584
Pin @types/node to v24 by @v-priyagupta108 in #1585
Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in #1599
Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #1598
Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in #1590
Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in #1610
Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in #1602
Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in #1629
Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in #1616
Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in #1615
Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in #1631
Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in #1636
Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in #1638
Update dependencies and add license files by @v-HarithaVattikuti in #1642
Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in #1635

New Contributors

@v-jitenderpalsingh made their first contribution in #1580
@philip-gai made their first contribution in #1584
@gperdomor made their first contribution in #1421
@SubJunk made their first contribution in #1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

`v7.0.0`

Compare Source

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in #1577
Migrate to ESM and upgrade dependencies by @gowridurgad in #1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in #1558
Only use mirrorToken in getManifest if it's provided by @deiga in #1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in #1536
docs: Update restore-only cache documentation by @priya-kinthali in #1550
docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in #1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #1569

New Contributors

@chiranjib-swain made their first contribution in #1536
@deiga made their first contribution in #1548
@jasongin made their first contribution in #1569

Full Changelog: actions/setup-node@v6...v7.0.0

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

`v6.4.0`

Compare Source

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in #1525
Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in #1533

New Contributors

@Copilot made their first contribution in #1525

Full Changelog: actions/setup-node@v6...v6.4.0

actions/upload-pages-artifact

`v5.0.0`

Compare Source

Changelog

Update upload-artifact action to version 7 @Tom-van-Woudenberg (#139)
feat: add include-hidden-files input @jonchurch (#137)

See details of all code changes since previous release.

fossas/fossa-action

`v2.0.0`

Compare Source

Breaking change: Node 24 runtime

This action now runs on the Node 24 GitHub Actions runtime (previously Node 20), via #277.

GitHub-hosted runners: no action needed.
Self-hosted runners: you must be on a runner version that bundles the Node 24 runtime. Update your runner if you pin fossas/fossa-action@v2.

The @v1 line is unchanged and stays on Node 20, so existing @v1 users are not affected until they opt into @v2. #277 is the only change that touches the action's runtime code (dist/) — everything else below is CI or dev-tooling only.

Everything in v1.9.0 → v2.0.0

Action runtime

Upgrade to Node.js 24 and Yarn 4 (Corepack, packageManager: yarn@4.13.0, engines.node >= 24.0.0) — #277

CI / repo tooling (no effect on consumers)

Fix the repo's fossa test --diff CI step to work with push events (first push to a new branch falls back to diffing the default branch) — #278
Make dependabot ignore major-version bumps of @types/node — #291

Dev-dependency bumps (no effect on consumers)