⬆️(dependencies) update GitHub Actions dependencies by renovate[bot] · Pull Request #2371 · suitenumerique/docs

renovate · 2026-06-01T08:47:07Z

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	major	`v5` → `v6`
actions/checkout	action	major	`v6` → `v7`
actions/setup-python (changelog)	action	digest	`a309ff8` → `ece7cb0`
astral-sh/setup-uv	action	minor	`v8.1.0` → `v8.3.2`
azure/setup-helm (changelog)	action	digest	`dda3372` → `9bc31f4`
crowdin/github-action (changelog)	action	digest	`8868a33` → `e0c8f73`
docker/build-push-action (changelog)	action	digest	`bcafcac` → `53b7df9`
docker/login-action (changelog)	action	digest	`4907a6d` → `af1e73f`
docker/login-action	action	major	`v3` → `v4`
docker/metadata-action (changelog)	action	digest	`030e881` → `dc80280`
docker/setup-buildx-action (changelog)	action	digest	`4d04d5d` → `bb05f3f`
docker/setup-buildx-action	action	major	`v3` → `v4`
docker/setup-qemu-action (changelog)	action	digest	`ce36039` → `96fe6ef`
dorny/paths-filter (changelog)	action	digest	`fbd0ab8` → `7b450ff`
node	uses-with	major	`22.x` → `24.x`
numerique-gouv/action-trivy-cache	action	pinDigest	→ `d6e94cf`
preactjs/compressed-size-action (changelog)	action	digest	`66325aa` → `f322c29`

Release Notes

actions/cache (actions/cache)

`v6.1.0`

Compare Source

What's Changed

Bump @actions/cache to v6.1.0 - handle read-only cache access by @jasongin in #1768

Full Changelog: actions/cache@v6...v6.1.0

`v6.0.0`

Compare Source

What's Changed

Update packages, migrate to ESM by @Samirat in #1760

Full Changelog: actions/cache@v5...v6.0.0

`v6`

Compare Source

actions/checkout (actions/checkout)

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

astral-sh/setup-uv (astral-sh/setup-uv)

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

fix: report unexpected cache save failures @eifinger (#896)
fix: report unexpected setup failures @eifinger (#895)
fix: add timeout to fetch to prevent silent hangs @eifinger-bot (#883)
Limit GitHub tokens to github.com download URLs @zsol (#878)
increase libuv-workaround timeout to 100ms @eifinger (#880)

🚀 Enhancements

Add quiet input to suppress info-level log output @eifinger (#898)
feat: add download-from-astral-mirror input @eifinger (#897)

🧰 Maintenance

docs: update dependabot rollup biome guidance @eifinger (#902)
chore: update known checksums for 0.11.18 @github-actions[bot] (#899)
chore: update known checksums for 0.11.17 @github-actions[bot] (#892)
chore: update known checksums for 0.11.16 @github-actions[bot] (#889)
chore: update known checksums for 0.11.15 @github-actions[bot] (#885)
chore: update known checksums for 0.11.14 @github-actions[bot] (#879)
chore: update known checksums for 0.11.13 @github-actions[bot] (#877)
chore: update known checksums for 0.11.12 @github-actions[bot] (#876)
chore: update known checksums for 0.11.11 @github-actions[bot] (#873)
chore: update known checksums for 0.11.9/0.11.10 @github-actions[bot] (#871)
chore: update known checksums for 0.11.8 @github-actions[bot] (#867)
Bump setup-uv references to v8.1.0 SHA in docs @eifinger (#862)
Add update-docs.yml workflow @eifinger (#861)

⬆️ Dependency updates

chore(deps): roll up dependabot updates @eifinger (#903)
chore(deps): roll up dependabot updates @eifinger (#901)
chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 @dependabot[bot] (#900)
chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 @dependabot[bot] (#842)
chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 @dependabot[bot] (#893)
chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 @dependabot[bot] (#891)
chore(deps): bump release-drafter/release-drafter from 7.2.0 to 7.3.0 @dependabot[bot] (#884)
chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5 @dependabot[bot] (#888)
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 @dependabot[bot] (#881)
chore(deps): bump github/codeql-action from 4.32.2 to 4.35.3 @dependabot[bot] (#875)
chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 @dependabot[bot] (#866)
chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 @dependabot[bot] (#864)
chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 @dependabot[bot] (#863)

docker/login-action (docker/login-action)

`v4.4.0`

Compare Source

`v4.3.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #1022
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 #999 #1030
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #1004 #1027
Bump @sigstore/core from 3.1.0 to 3.2.1 in #1023
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #1029
Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #1017
Bump js-yaml from 4.1.1 to 5.2.0 in #1028
Bump sigstore from 4.1.0 to 4.1.1 in #1031
Bump tmp from 0.2.5 to 0.2.7 in #1002
Bump undici from 6.24.1 to 6.27.0 in #1020
Bump vite from 7.3.3 to 7.3.6 in #1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

`v4.2.0`

Compare Source

Bump @actions/core from 3.0.0 to 3.0.1 in #976
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1050.0 in #960
Bump @docker/actions-toolkit from 0.86.0 to 0.90.0 in #970
Bump brace-expansion from 2.0.1 to 5.0.6 in #993
Bump fast-xml-builder from 1.1.4 to 1.2.0 in #985
Bump fast-xml-parser from 5.3.6 to 5.8.0 in #963
Bump http-proxy-agent and https-proxy-agent to 9.0.0 in #961
Bump postcss from 8.5.6 to 8.5.10 in #979
Bump tar from 6.2.1 to 7.5.15 in #991
Bump vite from 7.3.1 to 7.3.3 in #986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

`v4.1.0`

Compare Source

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in #945
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in #930
Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in #932 #936
Bump brace-expansion from 1.1.12 to 1.1.13 in #952
Bump fast-xml-parser from 5.3.4 to 5.3.6 in #942
Bump flatted from 3.3.3 to 3.4.2 in #944
Bump glob from 10.3.12 to 10.5.0 in #940
Bump handlebars from 4.7.8 to 4.7.9 in #949
Bump http-proxy-agent and https-proxy-agent to 8.0.0 in #937
Bump lodash from 4.17.23 to 4.18.1 in #958
Bump minimatch from 3.1.2 to 3.1.5 in #941
Bump picomatch from 4.0.3 to 4.0.4 in #948
Bump undici from 6.23.0 to 6.24.1 in #938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

`v4.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #929
Switch to ESM and update config/test wiring by @crazy-max in #927
Bump @actions/core from 1.11.1 to 3.0.0 in #919
Bump @aws-sdk/client-ecr from 3.890.0 to 3.1000.0 in #909 #920
Bump @aws-sdk/client-ecr-public from 3.890.0 to 3.1000.0 in #909 #920
Bump @docker/actions-toolkit from 0.63.0 to 0.77.0 in #910 #928
Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in #921
Bump js-yaml from 4.1.0 to 4.1.1 in #901

Full Changelog: docker/login-action@v3.7.0...v4.0.0

`v4`

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

`v4.2.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #572
Bump @actions/core from 3.0.0 to 3.0.1 in #551
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #557 #580
Bump @sigstore/core from 3.1.0 to 3.2.1 in #573
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #576
Bump js-yaml from 4.1.1 to 5.2.0 in #562
Bump sigstore from 4.1.0 to 4.1.1 in #577
Bump tmp from 0.2.5 to 0.2.7 in #556
Bump undici from 6.25.0 to 6.27.0 in #570
Bump vite from 7.3.2 to 7.3.6 in #569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

`v4.1.0`

Compare Source

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in #489
Bump brace-expansion from 1.1.12 to 5.0.6 in #547 #508
Bump fast-xml-builder from 1.0.0 to 1.2.0 in #540
Bump fast-xml-parser from 5.4.2 to 5.8.0 in #496
Bump flatted from 3.3.3 to 3.4.2 in #499
Bump glob from 10.3.12 to 13.0.6 in #495
Bump handlebars from 4.7.8 to 4.7.9 in #504
Bump lodash from 4.17.23 to 4.18.1 in #523
Bump picomatch from 4.0.3 to 4.0.4 in #503
Bump postcss from 8.5.6 to 8.5.10 in #537
Bump tar from 6.2.1 to 7.5.15 in #545
Bump undici from 6.23.0 to 6.25.0 in #492
Bump vite from 7.3.1 to 7.3.2 in #520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

`v4.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #483
Remove deprecated inputs/outputs by @crazy-max in #464
Switch to ESM and update config/test wiring by @crazy-max in #481
Bump @actions/core from 1.11.1 to 3.0.0 in #475
Bump @docker/actions-toolkit from 0.63.0 to 0.79.0 in #482 #485
Bump js-yaml from 4.1.0 to 4.1.1 in #452
Bump lodash from 4.17.21 to 4.17.23 in #472
Bump minimatch from 3.1.2 to 3.1.5 in #480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

`v4`

Compare Source

actions/node-versions (node)

`v24.18.0`: 24.18.0

Compare Source

Node.js 24.18.0

`v24.17.0`: 24.17.0

Compare Source

Node.js 24.17.0

`v24.16.0`: 24.16.0

Compare Source

Node.js 24.16.0

`v24.15.0`: 24.15.0

Compare Source

Node.js 24.15.0

`v24.14.1`: 24.14.1

Compare Source

Node.js 24.14.1

`v24.14.0`: 24.14.0

Compare Source

Node.js 24.14.0

`v24.13.1`: 24.13.1

Compare Source

Node.js 24.13.1

`v24.13.0`: 24.13.0

Compare Source

Node.js 24.13.0

`v24.12.0`: 24.12.0

Compare Source

Node.js 24.12.0

`v24.11.1`: 24.11.1

Compare Source

Node.js 24.11.1

`v24.11.0`: 24.11.0

Compare Source

Node.js 24.11.0

`v24.10.0`: 24.10.0

Compare Source

Node.js 24.10.0

`v24.9.0`: 24.9.0

Compare Source

Node.js 24.9.0

`v24.8.0`: 24.8.0

Compare Source

Node.js 24.8.0

`v24.7.0`: 24.7.0

Compare Source

Node.js 24.7.0

`v24.6.0`: 24.6.0

Compare Source

Node.js 24.6.0

`v24.5.0`: 24.5.0

Compare Source

Node.js 24.5.0

`v24.4.1`: 24.4.1

Compare Source

Node.js 24.4.1

`v24.4.0`: 24.4.0

Compare Source

Node.js 24.4.0

`v24.3.0`: 24.3.0

Compare Source

Node.js 24.3.0

`v24.2.0`: 24.2.0

Compare Source

Node.js 24.2.0

`v24.1.0`: 24.1.0

Compare Source

Node.js 24.1.0

`v24.0.2`: 24.0.2

Compare Source

Node.js 24.0.2

`v24.0.1`: 24.0.1

Compare Source

Node.js 24.0.1

`v24.0.0`: 24.0.0

Compare Source

Node.js 24.0.0

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 7am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added automated Pull request created automatically dependencies Pull requests that update a dependency file noChangeLog labels Jun 1, 2026

renovate Bot force-pushed the renovate/github-actions-dependencies branch from 31ff8f9 to 4662486 Compare June 8, 2026 02:00

renovate Bot changed the title ~~⬆️(dependencies) Pin dependencies~~ ⬆️(dependencies) update GitHub Actions dependencies Jun 8, 2026

renovate Bot force-pushed the renovate/github-actions-dependencies branch from 4662486 to d40ff26 Compare June 15, 2026 01:32

renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 7656c8d to 07bbe5b Compare June 22, 2026 08:19

renovate Bot force-pushed the renovate/github-actions-dependencies branch 2 times, most recently from 7e92fd1 to a237cdf Compare July 6, 2026 02:47

renovate Bot force-pushed the renovate/github-actions-dependencies branch from a237cdf to 8a87b91 Compare July 13, 2026 00:57

⬆️(dependencies) update GitHub Actions dependencies

989ea0e

renovate Bot force-pushed the renovate/github-actions-dependencies branch from 8a87b91 to 989ea0e Compare July 20, 2026 02:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

⬆️(dependencies) update GitHub Actions dependencies#2371

⬆️(dependencies) update GitHub Actions dependencies#2371
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-dependencies

renovate Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

v8.2.0: 🌈 New inputs quiet and download-from-astral-mirror

Changes

New inputs

quiet

download-from-astral-mirror

Bugfixes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v24.18.0: 24.18.0

v24.17.0: 24.17.0

v24.16.0: 24.16.0

v24.15.0: 24.15.0

v24.14.1: 24.14.1

v24.14.0: 24.14.0

v24.13.1: 24.13.1

v24.13.0: 24.13.0

v24.12.0: 24.12.0

v24.11.1: 24.11.1

v24.11.0: 24.11.0

v24.10.0: 24.10.0

v24.9.0: 24.9.0

v24.8.0: 24.8.0

v24.7.0: 24.7.0

v24.6.0: 24.6.0

v24.5.0: 24.5.0

v24.4.1: 24.4.1

v24.4.0: 24.4.0

v24.3.0: 24.3.0

v24.2.0: 24.2.0

v24.1.0: 24.1.0

v24.0.2: 24.0.2

v24.0.1: 24.0.1

v24.0.0: 24.0.0

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jun 1, 2026 •

edited

Loading

`v8.2.0`: 🌈 New inputs `quiet` and `download-from-astral-mirror`

`v24.18.0`: 24.18.0

`v24.17.0`: 24.17.0

`v24.16.0`: 24.16.0

`v24.15.0`: 24.15.0

`v24.14.1`: 24.14.1

`v24.14.0`: 24.14.0

`v24.13.1`: 24.13.1

`v24.13.0`: 24.13.0

`v24.12.0`: 24.12.0

`v24.11.1`: 24.11.1

`v24.11.0`: 24.11.0

`v24.10.0`: 24.10.0

`v24.9.0`: 24.9.0

`v24.8.0`: 24.8.0

`v24.7.0`: 24.7.0

`v24.6.0`: 24.6.0

`v24.5.0`: 24.5.0

`v24.4.1`: 24.4.1

`v24.4.0`: 24.4.0

`v24.3.0`: 24.3.0

`v24.2.0`: 24.2.0

`v24.1.0`: 24.1.0

`v24.0.2`: 24.0.2

`v24.0.1`: 24.0.1

`v24.0.0`: 24.0.0