Bump the github-action-updates group across 1 directory with 6 updates by dependabot[bot] · Pull Request #1001 · gaphor/gaphas

dependabot · 2026-04-13T12:17:53Z

Bumps the github-action-updates group with 6 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.16.0`	`2.17.0`
actions/upload-artifact	`7.0.0`	`7.0.1`
pypa/gh-action-pypi-publish	`1.13.0`	`1.14.0`
actions/create-github-app-token	`3.0.0`	`3.1.1`
peter-evans/create-pull-request	`8.1.0`	`8.1.1`
release-drafter/release-drafter	`7.1.1`	`7.2.0`

Updates step-security/harden-runner from 2.16.0 to 2.17.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.17.0

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

Commits

f808768 Feature/policy store (#656)
fe10465 v2.16.1 (#654)
See full diff in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.0

✨ What's Changed

The main change in this release is that verbose and print-hash inputs are now on by default. This was contributed by @whitequark💰 in #397.

📝 Docs

@woodruffw💰 updated the mentions of PEP 740 to stop implying that it might be experimental (it hasn't been for quite a while!) in #388 and @him2him2💰 brushed up some grammar in the README and SECURITY docs via #395.

🛠️ Internal Updates

@woodruffw💰 bumped sigstore and pypi-attestations in the lock file (#391) and @webknjaz💰 added infra for using type annotations in the project (#381).

💪 New Contributors

@him2him2 made their first contribution in #395

@whitequark made their first contribution in #397

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.13.0...v1.14.0

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

🙏 Special Thanks to @facutuesca💰 and @woodruffw💰 for helping maintain this project when I can't!

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

cef2210 Merge pull request #397 from whitequark/patch-1
b4595e2 Enable verbose and print-hash by default.
e2bab26 Merge pull request #395 from him2him2/docs/fix-typos-and-grammar
7495c38 docs: fix typos and grammar in README and SECURITY
03f86fe Merge pull request #388 from woodruffw-forks/ww/rm-experimental
4c78f1c Merge branch 'unstable/v1' into ww/rm-experimental
b5a6e8b deps: bump sigstore and pypi-attestations
a48a03e remove another experimental mention
8087a88 action: remove a lingering mention of PEP 740 being experimental
3317ede 🧪 Integrate actionlint via pre-commit framework
Additional commits viewable in compare view

Updates actions/create-github-app-token from 3.0.0 to 3.1.1

Release notes

Sourced from actions/create-github-app-token's releases.

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

add client-id input and deprecate app-id (#353) (e6bd4e6)

update permission inputs (#358) (076e948)

Commits

1b10c78 build(release): 3.1.1 [skip ci]
07e2b76 fix: improve error message when app identifier is empty (#362)
ea01216 ci: remove publish-immutable-action workflow (#361)
7bd0371 build(release): 3.1.0 [skip ci]
e6bd4e6 feat: add client-id input and deprecate app-id (#353)
076e948 feat: update permission inputs (#358)
3bbe07d fix(deps): bump p-retry from 7.1.1 to 8.0.0 (#357)
28a99e3 build(deps-dev): bump c8 from 10.1.3 to 11.0.0
4df5060 build(deps-dev): bump open-cli from 8.0.0 to 9.0.0
4843c53 build(deps-dev): bump the development-dependencies group with 3 updates
See full diff in compare view

Updates peter-evans/create-pull-request from 8.1.0 to 8.1.1

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.1.1

What's Changed

build(deps-dev): bump the npm group with 2 updates by @dependabot[bot] in peter-evans/create-pull-request#4305

build(deps): bump minimatch by @dependabot[bot] in peter-evans/create-pull-request#4311

build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in peter-evans/create-pull-request#4316

build(deps): bump @tootallnate/once and jest-environment-jsdom by @dependabot[bot] in peter-evans/create-pull-request#4323

build(deps-dev): bump undici from 6.23.0 to 6.24.0 by @dependabot[bot] in peter-evans/create-pull-request#4328

build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in peter-evans/create-pull-request#4334

build(deps): bump picomatch by @dependabot[bot] in peter-evans/create-pull-request#4339

build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in peter-evans/create-pull-request#4344

build(deps-dev): bump the npm group with 3 updates by @dependabot[bot] in peter-evans/create-pull-request#4349

fix: retry post-creation API calls on 422 eventual consistency errors by @peter-evans in peter-evans/create-pull-request#4356

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

Commits

5f6978f fix: retry post-creation API calls on 422 eventual consistency errors (#4356)
d32e88d build(deps-dev): bump the npm group with 3 updates (#4349)
8170bcc build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)
0041819 build(deps): bump picomatch (#4339)
b993918 build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)
36d7c84 build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)
a45d1fb build(deps): bump @tootallnate/once and jest-environment-jsdom (#4323)
3499eb6 build(deps): bump the github-actions group with 2 updates (#4316)
3f3b473 build(deps): bump minimatch (#4311)
6699836 build(deps-dev): bump the npm group with 2 updates (#4305)
See full diff in compare view

Updates release-drafter/release-drafter from 7.1.1 to 7.2.0

Release notes

Sourced from release-drafter/release-drafter's releases.

v7.2.0

What's Changed

New

feat: allow always collapsing a category (#1444) @mhanberg

Bug Fixes

fix: improve advanced substitutions in replacers (#1555) @jetersen

fix: support repo-only _extends and prevent .github/ path doubling (#1577) @jetersen

Maintenance

chore(deps): update dependency typescript to 6.0.2 (#1587) @renovate[bot]

chore(deps): update vitest to 4.1.4 (#1585) @renovate[bot]

ci(deps): update peter-evans/create-pull-request action to v8 (#1588) @renovate[bot]

chore(deps): update dependency vite to 8.0.5 (#1579) @renovate[bot]

chore(deps): update dependency nock to 14.0.12 (#1583) @renovate[bot]

chore(deps): update dependency @types/node to 24.12.2 (#1582) @renovate[bot]

chore(deps): update dependency @biomejs/biome to 2.4.10 (#1581) @renovate[bot]

chore: move codegen to monthly scheduled workflow (#1578) @jetersen

chore: replace vite-tsconfig-paths plugin with native resolve.tsconfigPaths (#1571) @jetersen

Documentation

docs: fix autolabeler example tag (#1568) @cchanche

Dependency Updates

build(deps): bump lodash and @graphql-codegen/plugin-helpers (#1589) @dependabot[bot]

fix(deps): update dependency @actions/github to 9.1.0 (#1586) @renovate[bot]

chore(deps): update dependency yaml to 2.8.3 (#1580) @renovate[bot]

chore(deps): update node.js to v24.14.1 (#1584) @renovate[bot]

chore(deps): update dependency @biomejs/biome to 2.4.10 (#1581) @renovate[bot]

Full Changelog: release-drafter/release-drafter@v7.1.1...v7.2.0

Commits

5de9358 7.2.0
e50d61c chore: rebuild dist
d3a61d3 chore: fix npm audit vulnerabilities
8bfa279 build(deps): bump lodash and @graphql-codegen/plugin-helpers (#1589)
c2a8a67 chore: remove engine-strict from .npmrc to fix Dependabot resolution
e51e4ad chore(deps): update dependency typescript to 6.0.2 (#1587)
0e7bd54 fix(deps): update dependency @actions/github to 9.1.0 (#1586)
9c0b0a8 chore(deps): update dependency yaml to 2.8.3 (#1580)
b27f820 chore(deps): update vitest to 4.1.4 (#1585)
eb90534 ci(deps): update peter-evans/create-pull-request action to v8 (#1588)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-action-updates group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.16.0` | `2.17.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.0.0` | `3.1.1` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` | | [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.1.1` | `7.2.0` | Updates `step-security/harden-runner` from 2.16.0 to 2.17.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@fa2e9d6...f808768) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210) Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Commits](actions/create-github-app-token@f8d387b...1b10c78) Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@c0f553f...5f6978f) Updates `release-drafter/release-drafter` from 7.1.1 to 7.2.0 - [Release notes](https://github.com/release-drafter/release-drafter/releases) - [Commits](release-drafter/release-drafter@139054a...5de9358) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-action-updates - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-action-updates - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-action-updates - dependency-name: actions/create-github-app-token dependency-version: 3.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-action-updates - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-action-updates - dependency-name: release-drafter/release-drafter dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-action-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the skip-changelog label Apr 13, 2026

danyeaw approved these changes Apr 15, 2026

View reviewed changes

danyeaw merged commit 242c085 into main Apr 15, 2026
11 checks passed

danyeaw deleted the dependabot/github_actions/github-action-updates-302141052d branch April 15, 2026 23:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the github-action-updates group across 1 directory with 6 updates#1001

Bump the github-action-updates group across 1 directory with 6 updates#1001
danyeaw merged 1 commit intomainfrom
dependabot/github_actions/github-action-updates-302141052d

dependabot bot commented on behalf of github Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Apr 13, 2026

v2.17.0

What's Changed

Policy Store Support

v2.16.1

What's Changed

v7.0.1

What's Changed

v1.14.0

✨ What's Changed

📝 Docs

🛠️ Internal Updates

💪 New Contributors

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

Features

Create Pull Request v8.1.1

What's Changed

v7.2.0

What's Changed

New

Bug Fixes

Maintenance

Documentation

Dependency Updates

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant