Skip to content

Bump the "weekly-dependencies" group with 1 update across multiple ecosystems - #30

Merged
PSchmiedmayer merged 2 commits into
mainfrom
dependabot/weekly_dependencies-fc21458f78
Aug 15, 2026
Merged

Bump the "weekly-dependencies" group with 1 update across multiple ecosystems#30
PSchmiedmayer merged 2 commits into
mainfrom
dependabot/weekly_dependencies-fc21458f78

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the weekly-dependencies group with 3 updates: gradle/actions, ataylorme/eslint-annotate-action and EndBug/add-and-commit.

Updates gradle/actions from 6.2.0 to 6.3.0

Release notes

Sourced from gradle/actions's releases.

v6.3.0

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

  • Cache entries failed to store at all on Windows.. Every entry failed with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of @actions/glob combined with a silently swallowed require() in the bundle, which left Windows path separators unnormalized.

  • Cache cleanup deleted instrumented jars that were in use. A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created caches/jars-9 entries as unused and remove them, so the instrumented-jars entry was never saved and every job re-instrumented its classpaths.

    Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT] Existing cache entries are invalidated by this release. The cache protocol version was bumped to v2, so the first run after upgrading will be a cache miss and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports (Entry not saved: save failed) in the Job Summary when a cache save fails, rather than reporting success (#1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it (#1025). Thanks to @​reinsch82 for the contribution.

Updated defaults

  • Injected Develocity Gradle plugin: 4.4.2 → 4.5.0
  • 36 new known-good wrapper checksums added for wrapper-validation

What's Changed

... (truncated)

Commits
  • 9c97196 Bump the github-actions group across 2 directories with 9 updates (#1024)
  • 760e4a4 Bump the npm-dependencies group across 1 directory with 2 updates (#1037)
  • 73e4c42 Update gradle-actions-caching library to v1.0.0 (#1029)
  • a9d1438 Add dependabot ignore rules for TypeScript 7.x and @​types/node 25.x/26.x
  • 68f3700 [bot] Update dist directory
  • 5971332 Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...
  • b5bc804 [bot] Update dist directory
  • dcbab4e Bump npm-dependencies group with TypeScript 6.0.3, @​types/node 24.x, and secu...
  • ca8d957 Move non-smoke restore-gradle-home tests back to the integ-test suite (#1032)
  • 4318659 [bot] Update dist directory
  • Additional commits viewable in compare view

Updates ataylorme/eslint-annotate-action from 3.0.0 to 4.0.0

Release notes

Sourced from ataylorme/eslint-annotate-action's releases.

v4.0.0

Breaking Changes

Requires Node 24

What's Changed

New Contributors

Full Changelog: ataylorme/eslint-annotate-action@3.0.0...4.0.0

v4.0.0-beta.1

First beta of the major v4 rewrite. Please test and report any issues!

Use it in your workflow:

- uses: ataylorme/eslint-annotate-action@v4.0.0-beta.1
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}
    report-json: eslint_report.json

Your workflow also needs:

permissions:
  checks: write
  pull-requests: read  # only needed with only-pr-files: true or post-comment: true

Breaking changes

  • Requires Node 24 — add actions/setup-node with node-version: '24' if your runner doesn't have it
  • github-token input is now required (explicit auth replacing @octokit/action)

Bug fixes

  • Fix crash when GITHUB_WORKSPACE is unset (#82, thanks @​thefrosty)
  • Throw a clear error when the report glob matches no files (#93, thanks @​joprice)
  • Warnings now correctly annotated at warning level instead of failure (#80, thanks @​vldslv-a)
  • Fix null ruleId crash for fatal parse errors and --report-unused-disable-directives

New inputs

Input Default Description
neutral-on-warning false Set check conclusion to neutral (not success) when only warnings exist (#89, thanks @​jessetan)
post-comment false Post/update a sticky PR comment with the ESLint summary (#90, thanks @​jessetan)

Tooling

  • Replaced @vercel/ncc with rollup for bundling
  • ESLint v9 flat config

... (truncated)

Changelog

Sourced from ataylorme/eslint-annotate-action's changelog.

4.0.0 - CONTAINS BREAKING CHANGES

  • Runs using Node 24
Commits
  • 5a8d8ab fix: align github-token input name across action.yml, constants, and tests
  • 6a1440a chore: update @​actions dependencies to latest major versions
  • 039ba93 docs: update README for v4
  • 03bec51 fix: resolve ESLint v9 config issues and auto-format all source files
  • 37d0663 fix: mock constants in getAnalyzedReport tests to fix CI SHA mismatch
  • 9438e67 feat!: v4 — Node 24, ESM, rollup, @​actions/toolkit, bug fixes, new features
  • 4ef6269 Node 24
  • 21a1ba0 Add required permission to README.md (#84)
  • See full diff in compare view

Updates EndBug/add-and-commit from 10 to 11

Release notes

Sourced from EndBug/add-and-commit's releases.

v11.0.0

What's Changed

Full Changelog: EndBug/add-and-commit@v10.0.0...v11.0.0

Commits
  • 645ecc0 11.0.0
  • 06e788f fix: neutralize bidi and control chars in action logs (#763)
  • 68ec86a ci: pin actions-tagger and restrict release workflow permissions (#762)
  • f1bb0cc fix: do not report committed=true for empty commit SHA (#757)
  • ebc24bf fix: refuse unexpected gitlinks staged by git add (#761)
  • 75038f8 fix: reject unmatched quotes in matchGitArgs to prevent flag injection (#760)
  • d07c930 fix: reject -F/--file git args that can exfiltrate runner files (#759)
  • 0971289 fix: stop logging full git config (credential leak) (#758)
  • c38a33b fix: verify committed lib/ matches source in CI (#756)
  • b4a0134 fix: prevent git option injection via new_branch (#755)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
⬆️ Bump the weekly-dependencies group with 3 updates
8706b34 
Bumps the weekly-dependencies group with 3 updates: [gradle/actions](https://github.com/gradle/actions), [ataylorme/eslint-annotate-action](https://github.com/ataylorme/eslint-annotate-action) and [EndBug/add-and-commit](https://github.com/endbug/add-and-commit).


Updates `gradle/actions` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@v6.2.0...v6.3.0)

Updates `ataylorme/eslint-annotate-action` from 3.0.0 to 4.0.0
- [Release notes](https://github.com/ataylorme/eslint-annotate-action/releases)
- [Changelog](https://github.com/ataylorme/eslint-annotate-action/blob/v4/CHANGELOG.md)
- [Commits](ataylorme/eslint-annotate-action@3.0.0...4.0.0)

Updates `EndBug/add-and-commit` from 10 to 11
- [Release notes](https://github.com/endbug/add-and-commit/releases)
- [Commits](EndBug/add-and-commit@v10...v11)

---
updated-dependencies:
- dependency-name: gradle/actions
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: weekly-dependencies
- dependency-name: ataylorme/eslint-annotate-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: weekly-dependencies
- dependency-name: EndBug/add-and-commit
  dependency-version: '11'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: weekly-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 15, 2026
@PSchmiedmayer
PSchmiedmayer merged commit 5709139 into main Aug 15, 2026
5 checks passed
@PSchmiedmayer
PSchmiedmayer deleted the dependabot/weekly_dependencies-fc21458f78 branch August 15, 2026 18:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PSchmiedmayer