Skip to content

Bump the github-actions group with 2 updates#1085

Merged
shivammathur merged 1 commit into
developfrom
dependabot/github_actions/develop/github-actions-cebeafbf6f
May 30, 2026
Merged

Bump the github-actions group with 2 updates#1085
shivammathur merged 1 commit into
developfrom
dependabot/github_actions/develop/github-actions-cebeafbf6f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates: github/codeql-action and codecov/codecov-action.

Updates github/codeql-action from 4.35.5 to 4.36.0

Release notes

Sourced from github/codeql-action's releases.

v4.36.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926
Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.0 - 22 May 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

  • Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
  • Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
  • Update default CodeQL bundle version to 2.25.2. #3823

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

... (truncated)

Commits
  • 7211b7c Merge pull request #3927 from github/update-v4.36.0-ebc2d9e2b
  • 7740f2f Update changelog for v4.36.0
  • ebc2d9e Merge pull request #3926 from github/update-bundle/codeql-bundle-v2.25.5
  • d1f74b7 Add changelog note
  • 2dc40ce Update default bundle to codeql-bundle-v2.25.5
  • 8449852 Merge pull request #3910 from github/henrymercer/repo-size-diff-check
  • 72ac23c Update excluded required check list
  • c5297a2 Merge pull request #3919 from github/henrymercer/workflow-concurrency
  • 8ffeae7 CI: Automatically cancel non-generated workflows
  • f3f52bf Revert getErrorMessage import
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 6.0.0 to 6.0.1

Release notes

Sourced from codecov/codecov-action's releases.

v6.0.1

What's Changed

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [codecov/codecov-action](https://github.com/codecov/codecov-action).


Updates `github/codeql-action` from 4.35.5 to 4.36.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@9e0d7b8...7211b7c)

Updates `codecov/codecov-action` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@57e3a13...e79a696)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 30, 2026
@dependabot
dependabot Bot requested a review from shivammathur as a code owner May 30, 2026 10:44
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 30, 2026
@codecov

codecov Bot commented May 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a919ff5) to head (0fba7f9).

Additional details and impacted files
@@            Coverage Diff            @@
##           develop     #1085   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            8         8           
  Lines          906       906           
  Branches       318       318           
=========================================
  Hits           906       906           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@shivammathur
shivammathur merged commit 083d523 into develop May 30, 2026
70 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/develop/github-actions-cebeafbf6f branch May 30, 2026 11:05
jmendes-alto added a commit to AltoIRA/setup-php that referenced this pull request Jun 8, 2026
* Use Markdown highlighting in README for notes

* Update ioncube support till PHP 8.4

* Add support for blackfire on PHP 8.4

* Improving locking process in get

* Add fallback url for phpunit tools

* Add fallback for launchpad API

* README: update list of PHP versions

PHP 8.2 is no longer in active support and only receives security fixes, see
announcement at <https://news-web.php.net/php.internals/126138>.

* Change openswoole priority

* Move `ubuntu-latest` to 24.04

* switch to launchpadcontent shivammathur#927 close

* Update dependencies

* Improve support for phalcon5 and zephir_parser

* Fix pdo_oci

* feat: allow tools path directory to be set

also add a .node-version file

* feat: set this via an environment variable instead

* Bump version to 2.33.0

* Fix relay support on macOS

* Fix phalcon and zephir_parser support on Windows

* Drop support for ubuntu-20.04 [skip ci]

* Update os_releases

* Make sure tap directories on macOS exist

* Add missing self_hosted_helper in darwin.sh

* Change TOOLS_DIR to SETUP_PHP_TOOLS_DIR to prevent regression

* Add support for pie in tools

* Remove copying extension dependencies

* Improve self-hosted detection

* Bump undici in the npm_and_yarn group across 1 directory

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).


Updates `undici` from 5.28.5 to 5.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.28.5...v5.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 5.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>

* fail fast in source.sh

* Add fallback for the manifest URL

* Lock Phive version for PHP 7.3/7.4

Latest Phive (0.16.0) claims to require PHP 8.0 or later[1].  While I
have not found any issues running it under PHP 7.4, it might be better
to stick with Phive 0.15.3 for PHP 7.3/7.4.

[1] <https://github.com/phar-io/phive/releases/tag/0.16.0>

* Bump version to 2.34.0

Bump Node.js dependencies

* Add support for COMPOSER_ALLOW_PLUGINS

* Pin hiredis version to 1.1 for relay [skip ci]

* Fix locking permissions in get function

* Update ppa filename to match apt-add-repository

* Cleanup up PPA fallback mirror

* Fix tool-cache directory on self-hosted runners

* Fix pipe in get_sha256

* Update node.js dependencies

* Bump version to 2.34.1

* Upgrade to Jest 30

* Update docs

As version 2 is the standard right now, make it clear by setting the v1 manually.

* README: fix broken link

* Update branch references to main

* Update dependencies

* Use ppa.setup-php.com [skip ci]

* Do not fallback extension to default version on fail-fast

* Add support for github-token input

* Minor fix in README

* Update sponsors section

* Initial plan

* Add support for shipmonk/name-collision-detector tool

Co-authored-by: shivammathur <[email protected]>

* Add name-collision-detector to README tools section

Co-authored-by: shivammathur <[email protected]>

* Add link for name-collision-detector tool in README

Co-authored-by: shivammathur <[email protected]>

* Initial plan

* Add roave/backward-compatibility-check tool support

Co-authored-by: shivammathur <[email protected]>

* Add support for roave/backward-compatibility-check tool

Co-authored-by: shivammathur <[email protected]>

* Address review feedback: revert src/tools.ts, remove run.sh, rename tool to backward-compatibility-check

Co-authored-by: shivammathur <[email protected]>

* Sort tools.json [skip ci]

* Initial plan

* Add mago tool support as custom package

Co-authored-by: shivammathur <[email protected]>

* Address PR review feedback - simplify validation and remove license display

Co-authored-by: shivammathur <[email protected]>

* Update test and README for mago tool - remove 'latest' from test and add to README

Co-authored-by: shivammathur <[email protected]>

* Fix mago extraction paths for binary location in subdirectories

Co-authored-by: shivammathur <[email protected]>

* Add -Force to Move-Item in mago.ps1 to handle workflow reruns

Co-authored-by: shivammathur <[email protected]>

* Remove ondrej/pkg-gearman ppa [skip ci]

* Fix mirror setup in ppa.sh

* Cleanup in cubrid.sh

* Filter shared extensions to enable on Windows

* Add patch for gearman [skip ci]

* Revert hiredis patch

* Bump node.js dependencies

* Update geos patch [skip ci]

* Use auth.json for composer authentication

* Fix shellcheck in add_tools.sh [skip ci]

* Bump version to 2.35.1

* Fix race condition

* Bump version to 2.35.2

* Override GITHUB_TOKEN if COMPOSER_TOKEN is set

* Check github-token on enterprise

On GitHub enterprise we may get a Personal Access token or a default token generated by GitHub that maybe not have the permissions required to access public GitHub, so we check and add it only if it can authenticate with the public GitHub API

* GH Actions: don't run cron jobs on forks

While workflows are disabled by default in forks, it is quite common for contributors to enable them to verify CI will pass before submitting a pull request.

When enabling workflow runs in forks, it's "all or nothing".
This means that:
* All workflows which are only intended to be run on the canonical repo will also be enabled.
    These workflows will also often need access to repo-specific secrets and will typically fail when run from a fork.
* Workflows which contain cron jobs will also be enabled.
    Depending on the type of account the contributor has, this can burn through their "CI minutes".

This commit is based on a review of workflows containing cron jobs and disables running the jobs when a cron job is triggered in a fork.

* Fix relay for PHP 7.4 [skip ci]

* Bump version to 2.35.3

Bump Node.js dependencies

* Bump actions/download-artifact from 4 to 5

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v5)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump actions/checkout from 4 to 5

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Move to main branch for brew

* Move to main branch for protoc

* Bump version to 2.35.4

Update Node.js dependencies

* Use seperate releases for shivammathur/icu-intl

* Add fallback to github api for adding intl

* Fix using new github-input for tools.ts

* Provide better error in tools' setup

* Fix warning on chmod on failure in get

* Add fallback url for composer

* Add fallback cache for keys in ppa.sh

* Bump actions/setup-node from 4 to 5

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 5.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump version to 2.35.5

Update Node.js dependencies

* Fix jit config on arm

* Mark macOS 26 as supported [skip ci]

* Update macos-latest in README [skip ci]

* Fix sorting in tools.getSemverVersion

* Improve sorting in tools.getSemverVersion

* Add support for PHP 8.6.0-dev

* Improve workflows

* fix: directly download linux archive from symfony-cli releases

* ci: use direct link instead of api call

* Update actions in examples

* Update sponsors [skip ci]

* Bump github/codeql-action from 3 to 4

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Update SECURITY.md [skip ci]

* Improve symfony-cli support

Fingers crossed symfony-cli keeps the artifact format in their releases

* Fix symfony-cli config [skip ci]

* remove php 7.4 lock to relay 0.7.0

* remove more 0.7.0 logic

* switch to latest stable when it's available

* print version number

* Fix warning in getting relay version

* Add support to show error on add_extension_log

* Mark macOS x86_64 not supported for relay [skip ci]

* Improve installing php on macOS

* Add support for nightly version of relay

* Add support for relay-nightly in extensions.ts

* Bump actions/setup-node from 5 to 6

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Improve support for deb822 source files

* Bump actions/upload-artifact from 4 to 5

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v5)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump actions/download-artifact from 5 to 6

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5 to 6.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v5...v6)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Fix pecl support for extensions with uppercase packages

* Update flex link to the GitHub repository

* Fix redis formula in brew_extensions

* Improve and refactor ppa.sh

* Bump dependencies

* Fix getcomposer fallback url for specific versions

* Mark PHP 8.5 as stable

* Fallback to upgrading macos formula

* Update common patches

* Improve library support when building from source

* Bump actions/checkout from 5 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Fix typo in geos patch [skip ci]

* Add support for ibm extensions [skip ci]

* Fix phpize patch on arm64 macos [skip ci]

* Fix fallback to latest version in tools.ts

* Add 8.5 for backfire in extensions.ts

* Fix gearman versions

* Improve macos php setup

Run dependency install as a seperate command.

Remove chown command as it is not required anymore it seems

Fix add_brew_tap call

* Update actions/checkout to v6

* Fix build pdo_oci on macos for PHP 7.0

Minor shellcheck fix

* Bump version to 2.36.0

Update Node.js dependencies

* Fix linking

* Fix shellcheck in darwin.sh

* Update README

* Revert to using php-builder for PHP 8.3 and above for self-hosted

* Fix check_lists in ppa.sh

* Rename nightly_versions -> php_builder_versions

* Bump actions/download-artifact from 6 to 7

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v6...v7)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump actions/cache from 4 to 5

Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump actions/upload-artifact from 5 to 6

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v5...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Fix support to parse master in php-version input

* Override undici version

* Update to Node 24

Update fetch.ts to use native fetch() API

Use immutable sort in tools.ts

* Update Node version in node workflow

* Refactor to use ES2024+ features for Node 24

Use Set for O(1) redirect status code lookup in fetch.ts

Use at(-1) and Object.hasOwn() in tools.ts

Use for...of with entries() in utils.ts

* Reduce bundle size

Replace @actions/core with local functions

@actions/core is unmaintained and poorly designed for projects that just need basic functions

* Fix eslint config for imports

* Remove unused @actions/io

* Replace generic record interfaces with specific ones

* Fix linking tools

* Improve cache for tools

* Fix paths for bin tools and scoped tools [skip ci]

* Update brew extensions

* Update dependencies

* Switch to brew formula for pdo_firebird on macos [skip ci]

* Update PHP version and OS support in README [skip ci]

* Bump dependencies

* Add retry and timeout for stuck brew calls

* Update sqlsrv and pdo_sqlsrv versions [skip ci]

* Fix npm audit

* fix: use latest in URL when version is empty

When version is not specified (empty string), the getUrl function
was generating invalid URLs like /releases/download/cs2pr without
any version, which returned 404.

This fix ensures that when version is empty or 'latest', the URL
includes '/latest/' which GitHub handles correctly with a redirect
to the actual latest release.

Fixes shivammathur#1063

* Revert to old brew linking behaviour

* Add macos-26-intel to the README [skip ci]

* Bump actions/download-artifact from 7 to 8

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v7...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump actions/upload-artifact from 6 to 7

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Improve switch_version on Linux

* Fix caching couchbase on macOS [skip ci]

* Fix support for pecl_http on Windows [skip ci]

* Switch to downloads.php.net in Get-ICUUrl [skip ci]

* Add support for zephir parser for PHP 8.5 [skip ci]

* Add support for ionCube for PHP 8.5 [skip ci]

* Update actions in examples [skip ci]

* Fix regression in pecl_http support [skip ci]

* Improve tool cache to not cache persistent urls

* Update dependencies

* Fix permission for OIDC tokens in publish.yml for trusted publishing [skip ci]

* Update examples

* Bump flatted in the npm_and_yarn group across 1 directory

Bumps the npm_and_yarn group with 1 update in the / directory: [flatted](https://github.com/WebReflection/flatted).


Updates `flatted` from 3.4.1 to 3.4.2
- [Commits](WebReflection/flatted@v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>

* Add workflow examples for Drupal and WordPress plugins

* Bump picomatch in the npm_and_yarn group across 1 directory

Bumps the npm_and_yarn group with 1 update in the / directory: [picomatch](https://github.com/micromatch/picomatch).


Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>

* Strip backslash line continuation from extension inputs

* Update dependencies

* Bump codecov/codecov-action from 5 to 6

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 6.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5...v6)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Update os_releases.csv [skip ci]

* Fix fallback in Install-PSPackage on Windows

* Improve enabling gearman [skip ci]

* Fix composer v2 version in README

* GHSA-f9f8-rm49-7jv2: Fix GitHub auth handling for composer in affected versions

* Fix mutable tool cache restore

* Fix phalcon version for PHP 8.0 [skip ci]

* Fix phalcon5 support on Windows

* GHSA-pqwm-q9pv-ph8r - Fix CWE-78 [skip ci]

* Bump version to 2.37.1

Update Node.js dependencies

* Update PHP versions in SECURITY.md

* Add CODEOWNERS

* Harden environment lookup

* Harden GitHub Actions workflows

* Update FUNDING.yml

* Bump the github-actions group with 2 updates (shivammathur#1085)

Bumps the github-actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [codecov/codecov-action](https://github.com/codecov/codecov-action).


Updates `github/codeql-action` from 4.35.5 to 4.36.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@9e0d7b8...7211b7c)

Updates `codecov/codecov-action` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@57e3a13...e79a696)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Shivam Mathur <[email protected]>
Co-authored-by: DanielEScherzer <[email protected]>
Co-authored-by: Roman Andreev <[email protected]>
Co-authored-by: hms5232 <[email protected]>
Co-authored-by: Jan Gantzert <[email protected]>
Co-authored-by: Sn0wCrack <[email protected]>
Co-authored-by: JMoodyFWD <[email protected]>
Co-authored-by: Andreas Braun <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christoph M. Becker <[email protected]>
Co-authored-by: Oskar Stark <[email protected]>
Co-authored-by: jrfnl <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: shivammathur <[email protected]>
Co-authored-by: Soner Sayakci <[email protected]>
Co-authored-by: Till Krüss <[email protected]>
Co-authored-by: Nicolas Grekas <[email protected]>
Co-authored-by: theluckystrike <[email protected]>
Co-authored-by: Pedro Cunha <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant