Skip to content

Update all dependencies (major) - #49

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all
Open

Update all dependencies (major)#49
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all

Conversation

@renovate

@renovate renovate Bot commented Nov 20, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/checkout action major v5 → v7
actions/setup-java action major v5 → v6
actions/upload-artifact action major v5 → v7
gradle/actions action major v5 → v6
java-jdk uses-with major 17 → 25

Release Notes

actions/checkout

v7.0.1

Compare Source

v7.0.0

Compare Source

  • Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
  • Various dependency updates

v6.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

actions/setup-java

v6.2.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/setup-java@v6.1.0...v6.2.0

v6.1.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

v6.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

v6.0.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/setup-java@v5.7.0...v6.0.0

actions/upload-artifact

v7.0.2

Compare Source

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

v7.0.1

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

Compare Source

v6 - What's new

[!IMPORTANT]
actions/upload-artifact@​v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

gradle/actions

v6.4.1

Compare Source

Security fix

This release fixes a security vulnerability in the dependency-submission action: GHSA-chpw-2mqm-95cc. All users should upgrade.

What's Changed

Full Changelog: gradle/actions@v6.4.0...v6.4.1

v6.4.0

Compare Source

Highlights

Gradle version support status in the Job Summary

The actions now report the support status of every Gradle version used in a workflow, as job
annotations and in the Job Summary (#​1057). Thanks to @​ov7a for the contribution.

version kind job annotation version table below the table
End-of-life — two or more major versions behind the latest release warning ⚠️ expandable section naming the affected release lines, pointing at the Gradle Security Subscription
Out of date — one major behind, or more than two minors behind on the current major notice ℹ️ one-line legend pointing at the Gradle release lifecycle docs
Current none — —

Deliberately not reported: patch releases (being on 9.7.0 when 9.7.1 exists is not flagged) and
pre-releases (release candidates, milestones and snapshots never produce annotations). The latest
Gradle release is determined from the wrapper checksum data already bundled with the action, so no
network access is required.

Note that these annotations are emitted independently of the add-job-summary setting: setting
add-job-summary: 'never' suppresses the Job Summary itself, but the warning and notice annotations
remain.

Gradle itself is now reported in the dependency graph

The dependency-submission action now applies v1.5.0 of the
GitHub Dependency Graph Gradle Plugin
(up from v1.4.2) (#​1069).

The headline change is that the Gradle Build Tool running the build is now reported as an
org.gradle:gradle-core dependency, so that GitHub can surface known vulnerabilities in the version
of Gradle used to run your build. These are the coordinates that GitHub advisories for the Gradle
Build Tool are published against.

Details worth knowing:

  • The entry is always reported as a direct dependency with development scope.
  • It is not affected by the project, configuration or scope filters, so it appears even in graphs
    that filter aggressively.
  • Expect dependency graphs to gain this one new entry the first time a build runs after upgrading.
A new Gradle signing key, if you use dependency verification

[!IMPORTANT]
If your build has dependency verification
enabled, you must add a second trusted key before upgrading, or Dependency Graph generation will
fail signature verification.

github-dependency-graph-gradle-plugin 1.5.0 is signed with a new Gradle signing subkey, and the
key previously documented in our setup guide has been revoked upstream:

Artifact Signing key
org.gradle:github-dependency-graph-gradle-plugin 1.5.0 and later E2879931BCA1A42E55F2D64DD9B2DFBD9F3298BA (new)
org.gradle plugin versions before the rotation 7B79ADD11F8A779FE90FD3D0893A028475557671 (old, revoked)
com.gradle Develocity Gradle plugin, including 4.5.0 7B79ADD11F8A779FE90FD3D0893A028475557671 (old, revoked)

Because the Develocity Gradle plugin is still signed with the old key, you should trust both keys
rather than swapping one for the other — replacing the old key outright will break Develocity
injection. The documented snippet in
docs/setup-gradle.md
has been updated accordingly (#​1071):

<trusted-keys>
   <trusted-key id="7B79ADD11F8A779FE90FD3D0893A028475557671">
      <trusting group="com.gradle"/>
      <trusting group="org.gradle"/>
   </trusted-key>
   <trusted-key id="E2879931BCA1A42E55F2D64DD9B2DFBD9F3298BA">
      <trusting group="org.gradle"/>
   </trusted-key>
</trusted-keys>
cache-provider: external for externally managed Gradle User Home

Builds that save and restore Gradle User Home by some other mechanism (Develocity Artifact Cache, for
example) previously had to set cache-disabled: true, which was misleading: caching wasn't disabled,
it just wasn't managed by this action, and the Job Summary reported it as "Disabled".

cache-provider: external skips Gradle User Home restore/save exactly as cache-disabled does, but
reports a distinct External status in the Job Summary explaining that caching is handled by
another provider (#​1059).

- uses: gradle/actions/setup-gradle@v6
  with:
    cache-provider: 'external'
Develocity access keys containing OIDC tokens now work

Short-lived-token handling validated the server=key[;server=key]* access key format with a regex
whose key portion was too strict, so an access key holding an OIDC token value was rejected
outright. Worse, had it passed the regex, parsing split each entry on = and kept only the second
field — silently truncating any key containing = (as JWT padding does) and sending the mangled
key to the server. Both problems are fixed (#​1061).

Job Summary attribution

Job summaries produced by setup-gradle and dependency-submission now carry a top-level heading
naming the action, so the block stays attributable when another action's summary content lands in the
same job (#​1058).

Updated defaults
  • GitHub Dependency Graph Gradle Plugin: 1.4.2 → 1.5.0
  • 5 new known-good wrapper checksums for wrapper-validation (368 → 373 entries)

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/major-all branch from 5fcb9a5 to 370c491 Compare December 12, 2025 23:34
@renovate renovate Bot changed the title Update actions/checkout action to v6 Update all dependencies to v6 (major) Dec 12, 2025
@renovate
renovate Bot force-pushed the renovate/major-all branch from 370c491 to 0363ced Compare February 26, 2026 19:03
@renovate renovate Bot changed the title Update all dependencies to v6 (major) Update all dependencies (major) Feb 26, 2026
@renovate
renovate Bot force-pushed the renovate/major-all branch from 0363ced to 6ccb830 Compare March 23, 2026 19:03
@renovate
renovate Bot force-pushed the renovate/major-all branch from 6ccb830 to 8ad8b34 Compare June 18, 2026 17:39
@renovate
renovate Bot force-pushed the renovate/major-all branch from 8ad8b34 to 3cf7c37 Compare August 25, 2026 15:50
@renovate
renovate Bot force-pushed the renovate/major-all branch from 3cf7c37 to 6606c02 Compare September 15, 2026 09:38
@renovate
Update all dependencies
ec81516 
| datasource   | package                 | from      | to             |
| ------------ | ----------------------- | --------- | -------------- |
| github-tags  | actions/checkout        | v5.1.0    | v7.0.1         |
| github-tags  | actions/setup-java      | v5.7.0    | v6.0.1         |
| github-tags  | actions/upload-artifact | v5.0.0    | v7.0.1         |
| github-tags  | gradle/actions          | v5.0.2    | v6.3.0         |
| java-version | java-jdk                | 17.0.20+8 | 25.0.4+7.0.LTS |
@renovate
renovate Bot force-pushed the renovate/major-all branch from 6606c02 to ec81516 Compare September 16, 2026 17:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants