chore(deps): update github-actions (major) by renovate[bot] · Pull Request #539 · unjs/unimport

renovate · 2026-05-22T02:47:51Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v5` → `v7`
actions/setup-node	action	major	`v5` → `v6`
codecov/codecov-action	action	major	`v5` → `v7`
pnpm/action-setup	action	major	`v4` → `v6`

Release Notes

actions/checkout (actions/checkout)

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Compare Source

Add worktree support for persist-credentials includeIf by @ericsciple in #2327

`v6.0.0`

Compare Source

Persist creds to a separate file by @ericsciple in #2286
Update README to include Node.js 24 support details and requirements by @salmanmkc in #2248

`v6`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v5.0.1`

Compare Source

Port v6 cleanup to v5 by @ericsciple in #2301

actions/setup-node (actions/setup-node)

`v6.4.0`

Compare Source

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in #1525
Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in #1533

New Contributors

@Copilot made their first contribution in #1525

Full Changelog: actions/setup-node@v6...v6.4.0

`v6.3.0`

Compare Source

What's Changed

Enhancements:

Support parsing devEngines field by @susnux in #1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Fix npm audit issues by @gowridurgad in #1491
Replace uuid with crypto.randomUUID() by @trivikr in #1378
Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #1498

Bug fixes:

Remove hardcoded bearer for mirror-url @marco-ippolito in #1467
Scope test lockfiles by package manager and update cache tests by @gowridurgad in #1495

New Contributors

@susnux made their first contribution in #1283

Full Changelog: actions/setup-node@v6...v6.3.0

`v6.2.0`

Compare Source

What's Changed

Documentation

Documentation update related to absence of Lockfile by @mahabaleshwars in #1454
Correct mirror option typos by @MikeMcC399 in #1442
Readme update on checkout version v6 by @deining in #1446
Readme typo fixes @munyari in #1226
Advanced document update on checkout version v6 by @aparnajyothi-y in #1468

Dependency updates:

Upgrade @actions/cache to v5.0.1 by @salmanmkc in #1449

New Contributors

@mahabaleshwars made their first contribution in #1454
@MikeMcC399 made their first contribution in #1442
@deining made their first contribution in #1446
@munyari made their first contribution in #1226

Full Changelog: actions/setup-node@v6...v6.2.0

`v6.1.0`

Compare Source

What's Changed

Enhancement:

Remove always-auth configuration handling by @priyagupta108 in #1436

Dependency updates:

Upgrade @actions/cache from 4.0.3 to 4.1.0 by @dependabot[bot] in #1384
Upgrade actions/checkout from 5 to 6 by @dependabot[bot] in #1439
Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in #1435

Documentation update:

Add example for restore-only cache in documentation by @aparnajyothi-y in #1419

Full Changelog: actions/setup-node@v6...v6.1.0

`v6.0.0`

Compare Source

What's Changed

Breaking Changes

Limit automatic caching to npm, update workflows and documentation by @priyagupta108 in #1374

Dependency Upgrades

Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336
Upgrade prettier from 2.8.8 to 3.6.2 by @dependabot[bot] in #1334
Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot[bot] in #1362

Full Changelog: actions/setup-node@v5...v6.0.0

`v6`

Compare Source

codecov/codecov-action (codecov/codecov-action)

`v7.0.0`

Compare Source

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

ci: remove Enforce License Compliance workflow by @thomasrockhu-codecov in #1950
chore(release): 7.0.0 by @thomasrockhu-codecov in #1957

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

`v7`

Compare Source

`v6.0.2`

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

ci: remove Enforce License Compliance workflow by @thomasrockhu-codecov in #1950
chore(release): 7.0.0 by @thomasrockhu-codecov in #1957

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

`v6.0.1`

Compare Source

What's Changed

fix: prevent template injection in run: steps (VULN-1652) by @thomasrockhu-codecov in #1947
chore(release): 6.0.1 by @thomasrockhu-codecov in #1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

`v6.0.0`

Compare Source

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by @thomasrockhu-codecov in #1929
Th/6.0.0 by @thomasrockhu-codecov in #1928

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

`v6`

Compare Source

`v5.5.5`

Compare Source

This release only contains the keybase.io change as described here.

Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5

`v5.5.4`

Compare Source

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by @thomasrockhu-codecov in #1926
chore(release): 5.5.4 by @thomasrockhu-codecov in #1927

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

`v5.5.3`

Compare Source

What's Changed

build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #1874
chore(release): bump to 5.5.3 by @thomasrockhu-codecov in #1922

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

What's Changed

fix: overwrite pr number on fork by @thomasrockhu-codecov in #1871
build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @app/dependabot in #1868
build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by @app/dependabot in #1867
fix: update to use local app/ dir by @thomasrockhu-codecov in #1872
docs: fix typo in README by @datalater in #1866
Document a codecov-cli version reference example by @webknjaz in #1774
build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by @app/dependabot in #1861
build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @app/dependabot in #1833

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

`v5.5.0`

Compare Source

What's Changed

feat: upgrade wrapper to 0.2.4 by @jviall in #1864
Pin actions/github-script by Git SHA by @martincostello in #1859
fix: check reqs exist by @joseph-sentry in #1835
fix: Typo in README by @spalmurray in #1838
docs: Refine OIDC docs by @spalmurray in #1837
build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @app/dependabot in #1829

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

`v5.4.3`

Compare Source

What's Changed

build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by @app/dependabot in #1822
fix: OIDC on forks by @joseph-sentry in #1823

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

`v5.4.2`

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2

`v5.4.1`

Compare Source

What's Changed

fix: use the github core methods by @thomasrockhu-codecov in #1807
build(deps): bump github/codeql-action from 3.28.12 to 3.28.13 by @app/dependabot in #1803
build(deps): bump github/codeql-action from 3.28.11 to 3.28.12 by @app/dependabot in #1797
build(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 by @app/dependabot in #1798
chore(release): wrapper -0.2.1 by @app/codecov-releaser-app in #1788
build(deps): bump github/codeql-action from 3.28.10 to 3.28.11 by @app/dependabot in #1786

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0..v5.4.1

`v5.4.0`

Compare Source

What's Changed

update wrapper submodule to 0.2.0, add recurse_submodules arg by @matt-codecov in #1780
build(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 by @app/dependabot in #1775
build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @app/dependabot in #1776
build(deps): bump github/codeql-action from 3.28.9 to 3.28.10 by @app/dependabot in #1777
Clarify in README that use_pypi bypasses integrity checks too by @webknjaz in #1773
Fix use of safe.directory inside containers by @Flamefire in #1768
Fix description for report_type input by @craigscott-crascit in #1770
build(deps): bump github/codeql-action from 3.28.8 to 3.28.9 by @app/dependabot in #1765
Fix a typo in the example by @miranska in #1758
build(deps): bump github/codeql-action from 3.28.5 to 3.28.8 by @app/dependabot in #1757
build(deps): bump github/codeql-action from 3.28.1 to 3.28.5 by @app/dependabot in #1753

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0

`v5.3.1`

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.0..v5.3.1

`v5.3.0`

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.2.0..v5.3.0

`v5.2.0`

Compare Source

What's Changed

Fix typo in README by @tserg in #1747
Th/add commands by @thomasrockhu-codecov in #1745
use correct audience when requesting oidc token by @juho9000 in #1744
build(deps): bump github/codeql-action from 3.27.9 to 3.28.1 by @app/dependabot in #1742
build(deps): bump actions/upload-artifact from 4.4.3 to 4.6.0 by @app/dependabot in #1743
chore(deps): bump wrapper to 0.0.32 by @thomasrockhu-codecov in #1740
feat: add disable-telem feature by @thomasrockhu-codecov in #1739
fix: remove erroneous linebreak in readme by @Vampire in #1734

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.2..v5.2.0

`v5.1.2`

Compare Source

What's Changed

fix: update statment by @thomasrockhu-codecov in #1726
fix: update action script by @thomasrockhu-codecov in #1725
fix: prevent oidc on tokenless due to permissioning by @thomasrockhu-codecov in #1724
chore(release): wrapper-0.0.31 by @app/codecov-releaser-app in #1723
Put quotes around ${{ inputs.token }} in action.yml by @jwodder in #1721
build(deps): bump github/codeql-action from 3.27.6 to 3.27.9 by @app/dependabot in #1722
Remove mistake from options table by @Acconut in #1718
build(deps): bump github/codeql-action from 3.27.5 to 3.27.6 by @app/dependabot in #1717

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.1..v5.1.2

`v5.1.1`

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.0..v5.1.1

`v5.1.0`

Compare Source

What's Changed

fix: hide unnecessary error on shasum by @thomasrockhu-codecov in #1692
build(deps): bump github/codeql-action from 3.27.4 to 3.27.5 by @app/dependabot in #1701
chore(release): wrapper-0.0.29 by @app/codecov-releaser-app in #1713

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.7..v5.1.0

`v5.0.7`

Compare Source

What's Changed

fix: use HEAD_REPO by @thomasrockhu-codecov in #1690

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.6..v5.0.7

`v5.0.6`

Compare Source

What's Changed

fix: update CODECOV_TOKEN and fix tokenless by @thomasrockhu-codecov in #1688

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.5..v5.0.6

`v5.0.5`

Compare Source

What's Changed

chore(release): wrapper-0.0.27 by @app/codecov-releaser-app in #1685

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.4..v5.0.5

`v5.0.4`

Compare Source

What's Changed

chore(deps): bump wrapper to 0.0.26 by @thomasrockhu-codecov in #1681
fix: strip out a trailing /n from input tokens by @thomasrockhu-codecov in #1679
fix: add action version by @thomasrockhu-codecov in #1678

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.3..v5.0.4

`v5.0.3`

Compare Source

What's Changed

fix: update OIDC audience by @thomasrockhu-codecov in #1675
fix: use double-quotes for OIDC by @thomasrockhu-codecov in #1669
fix: prevent always setting tokenless to be true by @thomasrockhu-codecov in #1673
fix: update CHANGELOG and automate by @thomasrockhu-codecov in #1674
fix: bump to v5 and update README by @thomasrockhu-codecov in #1655
build(deps): bump github/codeql-action from 3.27.0 to 3.27.4 by @app/dependabot in #1665
fix: typo in inputs.disable_safe_directory by @mkroening in #1666

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.2..v5.0.3

`v5.0.2`

Compare Source

What's Changed

fix: override commit and pr values for PR cases by @thomasrockhu-codecov in #1657

Full Changelog: codecov/codecov-action@v5.0.1...v5.0.2

`v5.0.1`

Compare Source

What's Changed

fix: use marketplace v5 badge by @thomasrockhu-codecov in #1646
fix: update tokenless branch logic by @thomasrockhu-codecov in #1650
chore(release): 5.0.1 by @thomasrockhu-codecov in #1656

Full Changelog: codecov/codecov-action@v5.0.0...v5.0.1

pnpm/action-setup (pnpm/action-setup)

`v6.0.9`

Compare Source

What's Changed

fix: update pnpm to v11.7.0 by @zkochan in #267

Full Changelog: pnpm/action-setup@v6...v6.0.9

`v6.0.8`

Compare Source

What's Changed

docs(README): fix cache_dependency_path type by @haines in #257
fix: drop patchPnpmEnv so standalone+self-update works on Windows by @zkochan in #258
fix: update pnpm to 11.1.1 by @mungodewar in #248

New Contributors

@mungodewar made their first contribution in #248

Full Changelog: pnpm/action-setup@v6.0.7...v6.0.8

`v6.0.7`

Compare Source

What's Changed

fix: honor devEngines.packageManager.onFail=error (#252) by @zkochan in #254
fix: restore inputs from state in post by @haines in #255
fix: self-update bootstrap to packageManager-pinned version (#233) by @zkochan in #256

New Contributors

@haines made their first contribution in #255

Full Changelog: pnpm/action-setup@v6.0.6...v6.0.7

`v6.0.6`

Compare Source

What's Changed

fix: bin_dest output points to self-updated pnpm, not bootstrap by @zkochan in #249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

`v6.0.5`

Compare Source

What's Changed

fix: append (not prepend) action node dir to PATH for npm bootstrap by @zkochan in #241

Full Changelog: pnpm/action-setup@v6.0.4...v6.0.5

`v6.0.4`

Compare Source

What's Changed

fix: use npm co-located with the action node binary by @benquarmby in #239

New Contributors

@benquarmby made their first contribution in #239

Full Changelog: pnpm/action-setup@v6.0.3...v6.0.4

`v6.0.3`

Compare Source

Updated pnpm to v11.0.0-rc.5

Full Changelog: pnpm/action-setup@v6.0.2...v6.0.3

`v6.0.2`

Compare Source

What's Changed

fix: pnpm self-update binary shadowed by bootstrap on PATH by @oniani1 in #230

New Contributors

@oniani1 made their first contribution in #230

Full Changelog: pnpm/action-setup@v6.0.1...v6.0.2

`v6.0.1`

Compare Source

Update pnpm to v11.0.0-rc.2. pnpm-lock.yaml will not be saved with two documents unless the packageManager is set via devEngines.packageManager. Related issue: #228

`v6.0.0`

Compare Source

Added support for pnpm v11.

`v6`

Compare Source

`v5.0.0`

Compare Source

Updated the action to use Node.js 24.

`v5`

Compare Source

`v4.4.0`

Compare Source

Updated the action to use Node.js 24.

`v4.3.0`

Compare Source

What's Changed

docs: fix the run_install example in the Readme by @dreyks in #175
chore: remove unused @types/node-fetch dependency by @silverwind in #186
Clarify that package_json_file is relative to GITHUB_WORKSPACE by @chris-martin in #184
feat: store caching by @jrmajor in #188
refactor: remove star imports by @KSXGitHub in #196
fix(ci): exclude macos by @KSXGitHub in #197

New Contributors

@dreyks made their first contribution in #175
@silverwind made their first contribution in #186
@chris-martin made their first contribution in #184
@jrmajor made their first contribution in #188
@Boosted-Bonobo made their first contribution in #199

Full Changelog: pnpm/action-setup@v4.2.0...v4.3.0

`v4.2.0`

Compare Source

When there's a .npmrc file at the root of the repository, pnpm will be fetched from the registry that is specified in that .npmrc file #179

`v4.1.0`

Compare Source

Add support for package.yaml #156.

Configuration

📅 Schedule: (UTC)

Branch creation
- "after 2am and before 3am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/major-github-actions branch from b3f5571 to 0688659 Compare May 22, 2026 17:08

renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from 0057ca6 to cb5bd74 Compare June 8, 2026 03:13

renovate Bot changed the title ~~chore(deps): update github-actions to v6~~ chore(deps): update github-actions (major) Jun 8, 2026

renovate Bot force-pushed the renovate/major-github-actions branch from cb5bd74 to 50f32e3 Compare June 16, 2026 13:13

chore(deps): update github-actions

55e393a

renovate Bot force-pushed the renovate/major-github-actions branch from 50f32e3 to 55e393a Compare June 19, 2026 02:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update github-actions (major)#539

chore(deps): update github-actions (major)#539
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions

renovate Bot commented May 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Dependency updates:

New Contributors

What's Changed

Enhancements:

Dependency updates:

Bug fixes:

New Contributors

What's Changed

Documentation

Dependency updates:

New Contributors

What's Changed

Enhancement:

Dependency updates:

Documentation update:

What's Changed

What's Changed

What's Changed

What's Changed

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 22, 2026 •

edited

Loading