Skip to content

build(deps): bump the compatible group across 1 directory with 6 updates - #322

Merged
frequenz-auto-dependabot[bot] merged 1 commit into
v0.x.xfrom
dependabot/github_actions/compatible-3a3c7bc0d1
Nov 6, 2026
Merged

frequenz-auto-dependabot[bot] merged 1 commit into
v0.x.xfrom
dependabot/github_actions/compatible-3a3c7bc0d1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the compatible group with 6 updates in the / directory:

Package From To
actions/create-github-app-token 3.2.0 3.3.0
frequenz-floss/dependabot-auto-approve 1.5.0 1.6.0
frequenz-floss/gh-action-setup-python-with-deps 1.0.6 1.0.7
actions/upload-artifact 7.0.1 7.0.2
actions/download-artifact 8.0.1 8.0.2
pypa/gh-action-pypi-publish 1.14.2 1.14.3

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)
Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view

Updates frequenz-floss/dependabot-auto-approve from 1.5.0 to 1.6.0

Release notes

Sourced from frequenz-floss/dependabot-auto-approve's releases.

v1.6.0

Dependency updates since v1.5.0:

  • Update dependabot/fetch-metadata from v2 to v3.
  • Update actions/create-github-app-token from v2.2.1 to v3.3.0 in the repository auto-merge workflow.

Compatibility: dependabot/fetch-metadata v3 uses Node.js 24. Self-hosted runners must support Node.js 24 actions.

What's Changed

New Contributors

Full Changelog: frequenz-floss/dependabot-auto-approve@v1.5.0...v1.6.0

Commits
  • 2a24095 Bump actions/create-github-app-token from 3.2.0 to 3.3.0 in the compatible gr...
  • 0bee533 Bump actions/create-github-app-token
  • 412bc4a Bump actions/create-github-app-token from 3.1.1 to 3.2.0 in the compatible gr...
  • 913526d Bump actions/create-github-app-token in the compatible group
  • 77421b5 Bump dependabot/fetch-metadata from 2 to 3 (#11)
  • 786b3f8 Bump actions/create-github-app-token from 3.0.0 to 3.1.1 in the compatible gr...
  • 15f7cbc Bump dependabot/fetch-metadata from 2 to 3
  • 2f87821 Bump actions/create-github-app-token in the compatible group
  • 3f4cc39 Bump actions/create-github-app-token from 2.2.1 to 3.0.0 (#9)
  • b26b7b6 Bump actions/create-github-app-token from 2.2.1 to 3.0.0
  • See full diff in compare view

Updates frequenz-floss/gh-action-setup-python-with-deps from 1.0.6 to 1.0.7

Release notes

Sourced from frequenz-floss/gh-action-setup-python-with-deps's releases.

v1.0.7

What's Changed

Full Changelog: frequenz-floss/gh-action-setup-python-with-deps@v1.0.6...v1.0.7

Commits
  • be072b9 Bump actions/setup-python from 7.0.0 to 7.1.0 (#28)
  • 1f571ef Bump actions/setup-python from 7.0.0 to 7.1.0
  • ab22d06 Update Ubuntu to 24.04 (#27)
  • 652e16f Update Ubuntu to 24.04
  • 45236d0 Bump actions/setup-python from 6.3.0 to 7.0.0 (#25)
  • 24afadb Bump actions/labeler from 6.1.0 to 7.0.0 (#26)
  • 42dbf50 Bump actions/labeler from 6.1.0 to 7.0.0
  • beea3b4 Bump actions/setup-python from 6.3.0 to 7.0.0
  • See full diff in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

Commits
  • 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
  • 331eccb Upgrade certifi and sigstore
  • f68fee4 💰 Sync the FUNDING config
  • c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
  • 9090099 🧪 Make smoke test deps hash-pinned in CI
  • 34e40c2 📌 Bump pip-tools managed transitive deptrees
  • e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
  • dd8c5f4 🔧 Make pip-tools config available in container
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the compatible group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` |
| [frequenz-floss/dependabot-auto-approve](https://github.com/frequenz-floss/dependabot-auto-approve) | `1.5.0` | `1.6.0` |
| [frequenz-floss/gh-action-setup-python-with-deps](https://github.com/frequenz-floss/gh-action-setup-python-with-deps) | `1.0.6` | `1.0.7` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` |



Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

Updates `frequenz-floss/dependabot-auto-approve` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/frequenz-floss/dependabot-auto-approve/releases)
- [Commits](frequenz-floss/dependabot-auto-approve@e943399...2a24095)

Updates `frequenz-floss/gh-action-setup-python-with-deps` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/frequenz-floss/gh-action-setup-python-with-deps/releases)
- [Commits](frequenz-floss/gh-action-setup-python-with-deps@29d63cb...be072b9)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@dc37677...7245906)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: compatible
- dependency-name: frequenz-floss/dependabot-auto-approve
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: compatible
- dependency-name: frequenz-floss/gh-action-setup-python-with-deps
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested review from a team as code owners November 6, 2026 14:07
@dependabot dependabot Bot added the part:tooling Affects the development tooling (CI, deployment, dependency management, etc.) label Nov 6, 2026
@dependabot
dependabot Bot requested review from hannah-stevenson-frequenz and removed request for a team November 6, 2026 14:07
@dependabot dependabot Bot added the type:tech-debt Improves the project without visible changes for users label Nov 6, 2026
@dependabot
dependabot Bot requested review from llucax and removed request for a team November 6, 2026 14:07
@frequenz-auto-dependabot frequenz-auto-dependabot Bot added the tool:auto-merged PR was auto-merged by automation label Nov 6, 2026
@frequenz-auto-dependabot
frequenz-auto-dependabot Bot added this pull request to the merge queue Nov 6, 2026
Merged via the queue into v0.x.x with commit 774c361 Nov 6, 2026
22 checks passed
@frequenz-auto-dependabot
frequenz-auto-dependabot Bot deleted the dependabot/github_actions/compatible-3a3c7bc0d1 branch November 6, 2026 14:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

part:tooling Affects the development tooling (CI, deployment, dependency management, etc.) tool:auto-merged PR was auto-merged by automation type:tech-debt Improves the project without visible changes for users

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants