Skip to content

chore(deps): update github-actions (maint-29) (major) - #11781

Open
renovate-bot wants to merge 1 commit into
erlang:maint-29from
renovate-bot:renovate/maint-29-major-github-actions
Open

chore(deps): update github-actions (maint-29) (major)#11781
renovate-bot wants to merge 1 commit into
erlang:maint-29from
renovate-bot:renovate/maint-29-major-github-actions

Conversation

@renovate-bot

@renovate-bot renovate-bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
Vampire/setup-wsl action major v6.1.0 → v7.2.0
actions/attest-sbom action major v3 → v4
actions/cache action major v4 → v6
actions/cache action major v5.1.0 → v6.1.0
actions/checkout action major v6.1.0 → v7.0.1
actions/create-github-app-token action major v2.2.2 → v3.3.0
actions/github-script action major v8.0.0 → v9.0.0
docker/login-action action major v3.7.0 → v4.7.0
dorny/paths-filter action major v3.0.4 → v4.0.3
erlang/otp uses-with major 28 → 29.1.2
erlang/otp uses-with major 27 → 29.1.2
github/codeql-action action major v3.39.0 → v4.39.1
macos github-runner major 15 → 26

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

Vampire/setup-wsl

v7.2.0

Compare Source

Highlights

Support for Ubuntu 26.04 was added

Details

  • Increase version to 7.2.0 [faf9eae]
  • Add support for Ubuntu 26.04 [cacfb43]

v7.1.1

Compare Source

Highlights

  • Debian 11 now uses security updates from the package archive
  • Patch versions for Ubuntu 24.04, Debian 13, and Alpine 3.20 - 3.23 are updated
  • Support for Alpine 3.24 was added

Details

  • Fix verify-release workflow [2d33ce2]
  • Make tests with Debian 13 work again [c2d96e3]
  • Adapt to breaking typing change in dependency submission action [61d4c71]
  • Downgrade Kotlin to 2.3.10 for Workflow Script execution [d7ad2be]
  • Update setup-kotlin_action to v2 [209f715]
  • Remove work-around for missing zstd on windows-11-arm runners in tests [150c11a]
  • Upgrade Kotlin to 2.4.10 for Workflow Script execution [2b8984b]
  • Update github-workflows-kt to 4.0.0 [83cdd9e]
  • Remove work-around for Kotlin bug [3a37b24]
  • Use more debian archive repositories for archived debian distributions [53a71a7]
  • Increase version to 7.1.0 [259c51c]
  • Use Debian 11 security updates from package archive [ac90967]
  • Update Ubuntu 24.04 version to 24.04.5 [4432217]
  • Update Debian 13 version to 1.26.0.0 [b6d7e8f]
  • Update Alpine 3.10 version to 3.20.10 [abc15e6]
  • Update Alipne 3.21 version to 3.21.8 [af3cc07]
  • Update Alpine 3.22 version to 3.22.6 [9dad32c]
  • Update Alpine 3.23 version to 3.23.6 [001f9a7]
  • Add support for Alpine 3.24 [0d0ffc5]
  • Update work-around for actions/toolkit#1925 after actions/exec update changed the code to be replaced [cde7237]
  • Update versions Gradle plugin to 0.66.0 [54be1cd]
  • Update Kotlin for workflow preprocessing to 2.4.21 [ca22ab5]
  • Update Dependency Analysis Gradle plugin to 3.19.2 [3c4e3d7]
  • Update common-custom-user-data-gradle-plugin to 2.8.0 [623999b]
  • Update Develocity Gradle plugin to 4.6.0 [d3d968e]
  • Update release Gradle plugin to 3.2.0 [915c49c]
  • Update Kotlin to 2.4.21 [287e496]
  • Update kotlin wrappers to 2026.10.0 [61fa597]
  • Update kotlinx-coroutines to 1.11.0 [370f6a8]
  • Update snakeyaml to 2.7 [93fa162]
  • Update Gradle to 9.8.1 [13dfd71]
  • Replace abandoned Wooga GitHub Gradle plugin with deprecations by direct GitHub API usage [ddad446]
  • Increase version to 7.1.1 [97c7f16]

v7.0.0

Compare Source

Breaking Changes

  • Updated Node.js to 24 (#​83)
  • Changed default distributon to Debian-13
  • Changed Alpine-3.17 wslId to contain the version
  • Changed Ubuntu-20.04 wslId to contain the version
  • Changed Ubuntu-22.04 wslId to contain the version
  • Removed deprecated Debian distributon
  • Removed deprecated Alpine distributon

Details

  • Use Debian-11 instead of Debian in tests [953e6c3]
  • Increase version to 7.0.0 [efe0179]
  • Update Node.js to 24 (#​83) [04ef237]
  • Change default distributon to Debian-13 [b67c897]
  • Remove deprecated Debian [ab5ed27]
  • Remove deprecated Alpine [0dc99a1]
  • Change Alpine-3.17 wslId to contain the version [4e9c3b1]
  • Use wsl-file distribution for Ubuntu 20.04+ [9928f17]
  • Change Ubuntu-20.04 and Ubuntu-22.04 wslIds to contain the version [f9577ca]
  • Continue tests for specific wrapper script on installation failure [cf87199]
actions/attest-sbom

v4.1.0

Compare Source

[!WARNING]
As of version 4.0.0 this action is being deprecated in favor of actions/attest. actions/attest-sbom will continue to function as a wrapper on top of actions/attest for some period of time, but applications should make plans to migrate.

All of the existing action inputs are compatible with the actions/attest interface.

What's Changed

Full Changelog: actions/attest-sbom@v4.0.0...v4.1.0

v4.0.0

Compare Source

[!WARNING]
As of version 4.0.0 this action is being deprecated in favor of actions/attest. actions/attest-sbom will continue to function as a wrapper on top of actions/attest for some period of time, but applications should make plans to migrate.

All of the existing action inputs are compatible with the actions/attest interface.

What's Changed

Full Changelog: actions/attest-sbom@v3...v4.0.0

actions/cache

v6.1.0

Compare Source

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

Compare Source

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v5.0.2: v.5.0.2

Compare Source

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

Compare Source

[!IMPORTANT]
actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

What's Changed

v5.0.0

What's Changed

Full Changelog: actions/cache@v5...v5.0.1

v5.0.0

Compare Source

[!IMPORTANT]
actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

What's Changed

Full Changelog: actions/cache@v4.3.0...v5.0.0

actions/checkout

v7.0.1

Compare Source

v7.0.0

Compare Source

  • Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
  • Various dependency updates
actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)

v3.2.0

Compare Source

Features
Bug Fixes

v3.1.1

Compare Source

Bug Fixes

v3.1.0

Compare Source

Bug Fixes
Features

v3.0.0

Compare Source

Bug Fixes
BREAKING CHANGES
  • Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
  • Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.
actions/github-script

v9.0.0

Compare Source

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.
What's Changed
New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

docker/login-action

v4.7.0

Compare Source

Full Changelog: docker/login-action@v4.6.0...v4.7.0

v4.6.0

Compare Source

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Compare Source

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Compare Source

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Compare Source

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Compare Source

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Compare Source

Full Changelog: docker/login-action@v4.2.0...v4.3.0

v4.2.0

Compare Source

Full Changelog: docker/login-action@v4.1.0...v4.2.0

v4.1.0

Compare Source

Full Changelog: docker/login-action@v4.0.0...v4.1.0

v4.0.0

Compare Source

Full Changelog: docker/login-action@v3.7.0...v4.0.0

dorny/paths-filter

v4.0.3

Compare Source

v4.0.2

Compare Source

v4.0.1

Compare Source

v4.0.0

Compare Source

erlang/otp

v29.1.2: OTP 29.1.2

Compare Source

Patch Package:           OTP 29.1.2
Git Tag:                 OTP-29.1.2
Date:                    2026-10-14
Trouble Report Id:       OTP-20359, OTP-20360, OTP-20385, OTP-20392,
                         OTP-20394, OTP-20408, OTP-20415, OTP-20418,
                         OTP-20420, OTP-20423, OTP-20426, OTP-20427,
                         OTP-20428, OTP-20437, OTP-20438, OTP-20439,
                         OTP-20440, OTP-20442, OTP-20444, OTP-20445,
                         OTP-20447, OTP-20456
Seq num:                 CVE-2026-105236, CVE-2026-42789,
                         CVE-2026-48856, CVE-2026-94200,
                         CVE-2026-96596, ERIERL-1362, ERIERL-1367,
                         GH-11620, GH-11691, GH-11702, GH-11709,
                         GH-11724, GH-11735, GH-11748, GH-11762,
                         GH-SA-m75x-4vwg-ggjh, GH-SA-q7cq-pfgf-5hr7,
                         OTP-20155, OTP-20346, PR-11474, PR-11561,
                         PR-11623, PR-11662, PR-11692, PR-11707,
                         PR-11708, PR-11719, PR-11720, PR-11727,
                         PR-11753, PR-11755, PR-11763, PR-11767,
                         PR-11768, PR-11773, PR-11791, PR-11808,
                         PR-11823, PR-11824, PR-11825
System:                  OTP
Release:                 29
Application:             compiler-10.0.7, dialyzer-6.0.4, erts-17.1.1,
                         inets-9.8.1, mnesia-4.27.1, odbc-2.17.2,
                         public_key-1.21.8, snmp-5.20.6, ssh-6.0.7,
                         ssl-11.7.8, stdlib-8.1.1
Predecessor:             OTP 29.1.1

Check out the git tag OTP-29.1.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

  • When the max_channels limit is reached for a port-forwarding channel (direct-tcpip or forwarded-tcpip), the SSH daemon now refuses the individual channel with SSH_MSG_CHANNEL_OPEN_FAILURE and keeps the connection alive, instead of terminating the whole SSH connection. Port-forwarding channels now behave like session channels, which already survived the limit, and this matches OpenSSH. Applications that relied on the connection being closed when the channel limit was reached must instead handle the channel-open failure.

    Own Id: OTP-20420
    Application(s): ssh
    Related Id(s): [PR-11708]

compiler-10.0.7

The compiler-10.0.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Full runtime dependencies of compiler-10.0.7

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

dialyzer-6.0.4

The dialyzer-6.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Full runtime dependencies of dialyzer-6.0.4

compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-17.1.1

The erts-17.1.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Two trace sessions that trace garbage_collection on the same process crash the emulator on the first collection.

    trace_gc() in erl_trace.c builds the GC info list on a temporary heap for the first session and frees it inside the session loop. The next session reuses msg, which now points into freed memory.

    The memory is now freed after the session loop, which removes the use-after-free.

    Own Id: OTP-20385
    Related Id(s): [PR-11623]

  • Fix native record bugs when used together with try...catch

    Own Id: OTP-20415
    Related Id(s): [Internal consistency check fails on native record construction #11691], [PR-11719]

Full runtime dependencies of erts-17.1.1

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.8.1

The inets-9.8.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Credentials supplied in the userinfo component of a request URI (http://user:password@host/path) were still sent to the redirect target when httpc followed a cross-origin redirect. The userinfo component is now cleared together with the sensitive headers whenever the redirect target differs in host or port from the original request. Redirects that stay within the same origin are unaffected and still carry the credentials.

    Own Id: OTP-20456
    Related Id(s): [GH-SA-m75x-4vwg-ggjh], [PR-11825], [CVE-2026-48856], OTP-20155

Full runtime dependencies of inets-9.8.1

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

mnesia-4.27.1

The mnesia-4.27.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed the type specification for mnesia:restore/2, which incorrectly listed the operation restore_tables instead of recreate_tables, causing Dialyzer to reject valid calls and accept invalid ones.

    Own Id: OTP-20442
    Related Id(s): [PR-11755]

Full runtime dependencies of mnesia-4.27.1

erts-9.0, kernel-5.3, stdlib-5.0

odbc-2.17.2

The odbc-2.17.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fix error handling to avoid possible memory issues that could cause odbc port program to fail.

    Own Id: OTP-20439
    Related Id(s): [PR-11808]

Full runtime dependencies of odbc-2.17.2

erts-6.0, kernel-3.0, stdlib-2.0

public_key-1.21.8

The public_key-1.21.8 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Enforce the RFC 5280 basic-constraints CA checks for X.509 version 1 and version 2 certificates during certificate path validation. A v1/v2 certificate carries no extensions and therefore no basicConstraints, so it must never be accepted as a CA; such a certificate is now rejected in issuer position with {bad_cert, missing_basic_constraint} while remaining valid as a leaf. This closes the version-1 path left uncovered by the earlier CVE-2026-42789 fix.

    Own Id: OTP-20423
    Related Id(s): [PR-11727], [CVE-2026-42789]

Full runtime dependencies of public_key-1.21.8

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

snmp-5.20.6

The snmp-5.20.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • The SNMP agent no longer fails to answer an SNMPv3 message whose msgUserName matches the configured terminating-discovery trigger_username (by default the empty string) and whose msgAuthoritativeEngineID is the agent's own engine ID. Such a message is not a stage-1 discovery request, but the agent treated it as one and then failed while generating the report, logging a configuration error and discarding the request without responding. The agent now answers it with a usmStatsUnknownUserNames report, as prescribed by RFC 3414, section 3.2. As a consequence of the same change, a message carrying the trigger user name together with an unknown, non-empty engine ID is now answered with a usmStatsUnknownEngineIDs report instead of being silently discarded.

    Own Id: OTP-20427
    Related Id(s): ERIERL-1362, [PR-11823]

  • The byte-length bounds added in OTP-20346 for varbind values now apply to every integer field decoded by snmp_pdus: the v3 header fields msgID, msgMaxSize and msgSecurityModel, the USM security parameters msgAuthoritativeEngineBoots and msgAuthoritativeEngineTime, and the PDU fields request-id, error-status, error-index, non-repeaters, max-repetitions, generic-trap and specific-trap. Each field accepts at most the number of BER content octets that its type requires, instead of an arbitrary number of octets that were converted into a large integer. An over-long integer is now signalled with an exit rather than a throw. Code that calls the exported snmp_pdus decode functions inside a catch will receive {'EXIT', Reason} where it previously received the thrown term directly. Inside the agent and manager, such a message is now discarded and counted in snmpInASNParseErrs; previously it caused a case_clause failure during message processing.

    Own Id: OTP-20428
    Related Id(s): [GH-SA-q7cq-pfgf-5hr7], [PR-11824], OTP-20346

Full runtime dependencies of snmp-5.20.6

asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssh-6.0.7

The ssh-6.0.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed a bug where SSH CLI sessions using {shell, {shell, start, []}} did not handle latin1-encoded put_chars messages from the Erlang shell. This caused exception output (e.g. "** exception error: ...") to not be displayed on the SSH client, and {unhandled_request, ...} messages to appear on the daemon host.

    Own Id: OTP-20359
    Related Id(s): [PR-11474]

  • Fixed the following bugs in the SSH application:

    • The SFTP client (ssh_sftp) checked the channel state record against 0 instead of the exit status integer when handling an exit_status message. The success branch was therefore dead code, and every SFTP subsystem exit — including a clean exit with status 0 — was reported to callers as an error. A clean exit is now reported as a normal stop.
    • The SSH_FXP_EXTENDED_REPLY decoder in ssh_xfer bound only a single byte of the reply payload instead of the full binary (the pattern was missing a /binary specifier). This made SFTP extension operations such as statvfs@openssh.com fail with a function_clause crash whenever the payload was not exactly one byte.
    • The TCP forwarding acceptor supervisor used the default permanent restart strategy, causing the acceptor to be restarted unnecessarily when a forwarded socket closed normally. The child now uses a transient restart strategy.
    • The keyboard_interact_fun handling returned the atom nok instead of not_ok on an invalid response, causing a crash during SSH message encoding instead of a clean authentication rejection.
    • The ssh*client_channel catch pattern error:{undef, *} never matched Erlang's actual error:undef exception, so a missing optional handle_call/3 or handle_cast/2 callback crashed the channel process instead of being ignored. The catch now matches error:undef and uses erlang:function_exported/3 to tell a genuinely missing optional callback (ignored, as before) from an undef raised deeper inside an implemented callback (now re-raised instead of being silently swallowed).
    • Both ssh_tcpip_forward_client and ssh_tcpip_forward_srv called gen_tcp:close(undefined) in terminate/2 when the forwarding socket was never established (or already closed), producing noisy crash reports on normal forward teardown. terminate/2 now handles the undefined socket.

    Own Id: OTP-20360
    Related Id(s): [PR-11561]

  • Fix

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 2am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate forking-renovate Bot added the team:VM Assigned to OTP team VM label Oct 7, 2026
@CLAassistant

CLAassistant commented Oct 7, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@github-actions

github-actions Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CT Test Results

  1 files   11 suites   3m 48s ⏱️
 96 tests  92 ✅ 4 💤 0 ❌
112 runs  108 ✅ 4 💤 0 ❌

Results for commit 0709e67.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

@renovate-bot
renovate-bot force-pushed the renovate/maint-29-major-github-actions branch 6 times, most recently from ba9f14b to ebb5f91 Compare October 15, 2026 12:12
kikofernandez
kikofernandez previously approved these changes Oct 19, 2026
View reviewed changes
@renovate-bot
renovate-bot force-pushed the renovate/maint-29-major-github-actions branch from ebb5f91 to 4a8d3c2 Compare October 19, 2026 11:09
kikofernandez
kikofernandez previously approved these changes Oct 19, 2026
View reviewed changes
@renovate-bot
renovate-bot force-pushed the renovate/maint-29-major-github-actions branch from 4a8d3c2 to 244a2b0 Compare October 20, 2026 10:55
@renovate-bot
renovate-bot force-pushed the renovate/maint-29-major-github-actions branch from 244a2b0 to 2723ad7 Compare October 21, 2026 16:24
@renovate-bot
renovate-bot force-pushed the renovate/maint-29-major-github-actions branch from 2723ad7 to 0709e67 Compare October 23, 2026 17:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kikofernandez kikofernandez kikofernandez left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@garazdawi garazdawi

@kikofernandez kikofernandez

Labels

team:VM Assigned to OTP team VM

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@renovate-bot @CLAassistant @kikofernandez @garazdawi