Skip to content

chore(deps): Bump the github-actions group with 2 updates - #454

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/github-actions-97b7c952da
Open

chore(deps): Bump the github-actions group with 2 updates#454
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/github-actions-97b7c952da

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates: actions/setup-dotnet and jdx/mise-action.

Updates actions/setup-dotnet from 5 to 6

Release notes

Sourced from actions/setup-dotnet's releases.

v6.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-dotnet@v5...v6.0.0

v5.4.0

What's Changed

Enhancements

The action now validates the sdk.version field in global.json when rollForward is specified. The version must be a fully-qualified SDK version (e.g., 8.0.100, 10.0.100). Wildcard versions (e.g., 10.0.*) and runtime-style versions (e.g., 8.0.0) will now fail. See the .NET SDK version specification for details.

Documentation

Bug Fixes

Dependency Updates

New Contributors

Full Changelog: actions/setup-dotnet@v5.3.0...v5.4.0

v5.3.0

What's Changed

Enhancements

Dependency Updates

... (truncated)

Commits

Updates jdx/mise-action from 4.2.1 to 4.2.3

Release notes

Sourced from jdx/mise-action's releases.

v4.2.3: Restore mise PATH propagation

A patch release that restores mise's PATH propagation to subsequent workflow steps — without reintroducing the full-PATH snapshot behavior that v4.2.1 fixed.

Fixed

Export mise PATH entries to subsequent steps (#575) by @​jdx

v4.2.1 stopped exporting the complete PATH returned by mise env --json into GITHUB_ENV, which correctly prevented snapshotting the runner's environment into subsequent steps. However, that also dropped mise-produced PATH entries — tool shims, [env] _.path directories, and similar — that workflows relied on after the setup step. See #565.

The action now computes only the prefix that mise prepended to the existing PATH and forwards those directories individually through GITHUB_PATH. This preserves mise's configured ordering, composes cleanly with PATH changes from other actions, and never persists the runner's full PATH through GITHUB_ENV. The dotenv fallback path (used with older mise versions) also strips PATH= lines and re-derives additions from mise env --json.

A new export_path input (default true) lets workflows keep regular env exports while opting out of PATH changes:

- uses: jdx/mise-action@v4
  with:
    export_path: false # keep env vars, skip mise PATH additions

Full Changelog: jdx/mise-action@v4.2.2...v4.2.3

v4.2.2: Zstd tar fallback for older runners

A small patch release that fixes archive selection on runners with an older tar and corrects a stale default in the README.

Fixed

Verify tar supports Zstd before picking .tar.zst (#569 by @​JackMyers001

The action previously chose the .tar.zst mise archive whenever zstd --version succeeded, then extracted it with tar --zstd. On RHEL 8-compatible runners that ship zstd 1.4.4 alongside GNU tar 1.30, the --zstd option isn't recognized and installation failed.

Detection now runs both checks:

zstd --version
tar --zstd --version

If either fails, the action falls back to the .tar.gz archive. No configuration change is required — existing workflows on affected runners just start working again. Fixes #568.

Documentation

  • Update the cache_key_prefix example in the README to reflect the current default of mise-v1 (previously documented as mise-v0) (#570 by @​muzimuzhi).

New Contributors

Full Changelog: jdx/mise-action@v4.2.1...v4.2.2

Changelog

Sourced from jdx/mise-action's changelog.

4.2.3 - 2026-07-24

🐛 Bug Fixes

4.2.2 - 2026-07-24

🐛 Bug Fixes

📚 Documentation

New Contributors

Commits
  • 9e7f763 chore: release v4.2.3 (#578)
  • 0f85637 fix: export mise path entries to subsequent steps (#575)
  • a24c375 chore(deps): migrate to aube lockfile (#576)
  • f10502f chore: release v4.2.2 (#567)
  • 5df6b79 chore(deps): update zizmorcore/zizmor-action action to v0.6.0 (#574)
  • be707ec chore(deps): update jdx/mise-action action to v4.2.1 (#572)
  • d0f7879 chore(deps): update github/codeql-action action to v4.37.1 (#571)
  • fc371b7 docs: update default value of cache_key_prefix (#570)
  • 5c77551 fix: ensure tar supports Zstd (#569)
  • a63ca4f fix(release-plz): exit when git-cliff produces no version bump (#566)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the github-actions group with 2 updates
45ea3b9 
Bumps the github-actions group with 2 updates: [actions/setup-dotnet](https://github.com/actions/setup-dotnet) and [jdx/mise-action](https://github.com/jdx/mise-action).


Updates `actions/setup-dotnet` from 5 to 6
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@v5...v6)

Updates `jdx/mise-action` from 4.2.1 to 4.2.3
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](jdx/mise-action@v4.2.1...v4.2.3)

---
updated-dependencies:
- dependency-name: actions/setup-dotnet
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: jdx/mise-action
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 1, 2026
@cursor

cursor Bot commented Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Summary

Low Risk
Version-only CI action bumps with the same dotnet and mise configuration; main regression risk is a workflow break from the action major/minor upgrades, not application code.

Overview
Bumps GitHub Actions dependencies across reusable and common workflows with no changes to job logic or inputs.

actions/setup-dotnet moves from v5 to v6 on every Install net10.0 step in build-container-reusable.yml, build-reusable.yml, and common.yml (C# quality and vulnerability scan jobs). dotnet-version: 10.0.x is unchanged.

jdx/mise-action moves from v4.2.1 to v4.2.3 only in the Semantic Conventions job in common.yml, still with cache: false.

Reviewed by Cursor Bugbot for commit 45ea3b9. Bugbot is set up for automated code reviews on this repo. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants