⬆️ (ci) [NO-ISSUE]: Bump the actions group across 1 directory with 8 updates - #1838
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Pull request overview
This PR updates pinned GitHub Actions (and internal composite actions) used across CI workflows in this repository, primarily to keep the CI toolchain/actions up to date and benefit from upstream fixes.
Changes:
- Bump internal composite actions (
setup-with-cache-composite,setup-with-build-cache-composite,generate-sbom-composite,publish-to-jfrog-composite) to commit22f81df.... - Update third-party actions:
actions/setup-javatov6.0.0,docker/setup-buildx-actiontov4.3.0,toshimaru/auto-author-assigntov3.1.0, andsoftprops/action-gh-releasetov3.0.3. - Apply these bumps consistently across release, nightly, PR, SBOM, and mock-server workflows.
File summaries
| File | Description |
|---|---|
| .github/workflows/update_toolchain.yml | Bumps internal setup composite action used by the toolchain update workflow. |
| .github/workflows/snapshot_release.yml | Bumps internal setup + JFrog publish composite actions for snapshot releases. |
| .github/workflows/release.yml | Bumps internal setup + JFrog publish composite actions for main-branch releases. |
| .github/workflows/release_mock_server.yml | Updates docker/setup-buildx-action pin for mock server image publishing. |
| .github/workflows/pull_request.yml | Updates auto-assign action and internal setup composite action pins for PR checks. |
| .github/workflows/nightly_solana.yml | Bumps internal setup/build-cache composite actions for Solana nightly runs. |
| .github/workflows/nightly_ethereum.yml | Bumps internal setup/build-cache composite actions for Ethereum nightly runs. |
| .github/workflows/mock-server-preview.yml | Updates docker/setup-buildx-action pin for preview image builds. |
| .github/workflows/mock-server-build-prod.yml | Updates docker/setup-buildx-action pin for prod image builds. |
| .github/workflows/merge_queue.yml | Bumps internal setup composite action pin for merge-queue checks. |
| .github/workflows/generate_sbom.yml | Bumps internal setup + SBOM composite actions. |
| .github/workflows/develop-sonar.yml | Bumps internal build-cache setup composite action for Sonar baseline workflow. |
| .github/workflows/build_mobile.yml | Updates internal setup composite action and bumps actions/setup-java to v6.0.0. |
| .github/workflows/build_devtools.yml | Bumps softprops/action-gh-release pin used to update the devtools-latest release. |
Review details
- Files reviewed: 14/14 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 2, 2026 11:56
1046fab to
dc9310b
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 3, 2026 11:56
dc9310b to
72bb69a
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 4, 2026 11:55
72bb69a to
e7b4914
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 7, 2026 11:56
e7b4914 to
42e246d
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 8, 2026 11:55
42e246d to
7b00ae0
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 11, 2026 10:43
7b00ae0 to
3efcbea
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 14, 2026 11:56
3efcbea to
b551861
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 16, 2026 11:55
b551861 to
48e690c
Compare
aussedatlo
force-pushed
the
develop
branch
2 times, most recently
from
September 18, 2026 09:14
fba843e to
5ed072b
Compare
…updates Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.2` | `3.0.3` | | [LedgerHQ/device-sdk-ts/.github/actions/setup-with-cache-composite](https://github.com/ledgerhq/device-sdk-ts) | `69b58c7fd3370397e82e73047b1441667bd46386` | `5ed072befbde9ed2585811ba8e21fbe4f3e0222f` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.7.0` | `6.0.1` | | [LedgerHQ/device-sdk-ts/.github/actions/setup-with-build-cache-composite](https://github.com/ledgerhq/device-sdk-ts) | `69b58c7fd3370397e82e73047b1441667bd46386` | `5ed072befbde9ed2585811ba8e21fbe4f3e0222f` | | [LedgerHQ/device-sdk-ts/.github/actions/generate-sbom-composite](https://github.com/ledgerhq/device-sdk-ts) | `69b58c7fd3370397e82e73047b1441667bd46386` | `5ed072befbde9ed2585811ba8e21fbe4f3e0222f` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.4.0` | | [toshimaru/auto-author-assign](https://github.com/toshimaru/auto-author-assign) | `3.0.3` | `3.1.0` | | [LedgerHQ/device-sdk-ts/.github/actions/publish-to-jfrog-composite](https://github.com/ledgerhq/device-sdk-ts) | `69b58c7fd3370397e82e73047b1441667bd46386` | `5ed072befbde9ed2585811ba8e21fbe4f3e0222f` | Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@3d0d988...efb3536) Updates `LedgerHQ/device-sdk-ts/.github/actions/setup-with-cache-composite` from 69b58c7 to 5ed072b - [Release notes](https://github.com/ledgerhq/device-sdk-ts/releases) - [Commits](69b58c7...5ed072b) Updates `actions/setup-java` from 5.7.0 to 6.0.1 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b6effb0...de7274f) Updates `LedgerHQ/device-sdk-ts/.github/actions/setup-with-build-cache-composite` from 69b58c7 to 5ed072b - [Release notes](https://github.com/ledgerhq/device-sdk-ts/releases) - [Commits](69b58c7...5ed072b) Updates `LedgerHQ/device-sdk-ts/.github/actions/generate-sbom-composite` from 69b58c7 to 5ed072b - [Release notes](https://github.com/ledgerhq/device-sdk-ts/releases) - [Commits](69b58c7...5ed072b) Updates `docker/setup-buildx-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@bb05f3f...594f3bf) Updates `toshimaru/auto-author-assign` from 3.0.3 to 3.1.0 - [Release notes](https://github.com/toshimaru/auto-author-assign/releases) - [Changelog](https://github.com/toshimaru/auto-author-assign/blob/main/CHANGELOG.md) - [Commits](toshimaru/auto-author-assign@3e19bfc...a78a94b) Updates `LedgerHQ/device-sdk-ts/.github/actions/publish-to-jfrog-composite` from 69b58c7 to 5ed072b - [Release notes](https://github.com/ledgerhq/device-sdk-ts/releases) - [Commits](69b58c7...5ed072b) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: LedgerHQ/device-sdk-ts/.github/actions/generate-sbom-composite dependency-version: 22f81df dependency-type: direct:production dependency-group: actions - dependency-name: LedgerHQ/device-sdk-ts/.github/actions/publish-to-jfrog-composite dependency-version: 22f81df dependency-type: direct:production dependency-group: actions - dependency-name: LedgerHQ/device-sdk-ts/.github/actions/setup-with-build-cache-composite dependency-version: 22f81df dependency-type: direct:production dependency-group: actions - dependency-name: LedgerHQ/device-sdk-ts/.github/actions/setup-with-cache-composite dependency-version: 22f81df dependency-type: direct:production dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: toshimaru/auto-author-assign dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-230b3d02c5
branch
from
September 18, 2026 11:55
48e690c to
cd8c78f
Compare
|
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/actions-230b3d02c5
branch
September 21, 2026 11:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 8 updates in the / directory:
3.0.23.0.369b58c7fd3370397e82e73047b1441667bd463865ed072befbde9ed2585811ba8e21fbe4f3e0222f5.7.06.0.169b58c7fd3370397e82e73047b1441667bd463865ed072befbde9ed2585811ba8e21fbe4f3e0222f69b58c7fd3370397e82e73047b1441667bd463865ed072befbde9ed2585811ba8e21fbe4f3e0222f4.2.04.4.03.0.33.1.069b58c7fd3370397e82e73047b1441667bd463865ed072befbde9ed2585811ba8e21fbe4f3e0222fUpdates
softprops/action-gh-releasefrom 3.0.2 to 3.0.3Release notes
Sourced from softprops/action-gh-release's releases.
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
efb3536release 3.0.3 (#840)6441963chore(deps): bump the npm group with 2 updates (#839)e5ee6bcchore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)d1e6617chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)6403751chore(deps): bump the npm group with 2 updates (#835)7c7184bchore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)0f3f0d2chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)77fb938chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)5a6f517chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)a3c91c9chore(deps): bump the github-actions group with 2 updates (#825)Updates
LedgerHQ/device-sdk-ts/.github/actions/setup-with-cache-compositefrom 69b58c7 to 5ed072bCommits
5ed072b✨ (signer-eth) [LBD-298]: Update type for SignTransaction/TypedData factories...4177e0e✨ (signer-solana) [DSDK-1520]: Support blind-signing Solana v1 transactions (...9698f3e♻️ (manager-api) [NO-ISSUE]: Remove livecommonversion in HttpManagerApiDataSo...762139e♻️ (manager-api): Remove hardcoded livecommonversion in HttpManagerApiDataSourcebad1b8f✨ (clear-signing-tester) [DSDK-1527]: Add Tron support and TRC10/TRC20 scenar...9a36166✨ (signer-trx) [DSDK-1526]: Provide TRC10 token names when signing a transact...2e1c63c💚 (ci): Run the Tron clear-signing scenariosd0e9985✨ (clear-signing-tester): Add Tron support and TRC10/TRC20 scenarios7ea891a✨ (signer-trx): Provide TRC10 token names when signing a transaction1fe060e✨ (context-module): Add a Tron TRC10 token loaderUpdates
actions/setup-javafrom 5.7.0 to 6.0.1Release notes
Sourced from actions/setup-java's releases.
... (truncated)
Commits
de7274fAvoid macOS GPG socket overflow on long runner paths (#1266)134912aFix import-safe checks when scripts are run from a path with symlinks (#1265)0781fc6Fix alpine failures by switching default back to only warn on verification fa...4889c4aFix Temurin EA E2E signature verification (#1260)8fd3240[WIP] Fix failing GitHub Actions job for temurin 17 (#1259)2732291chore(deps-dev): update eslint and globals (#1256)1a8f22bchore: streamline Dependabot updates (#1255)85030b7docs: complete v6 release highlights (#1254)dd06d9cPrepare documentation for v6 release (#1253)59b3450chore(deps): combine open Dependabot npm updates (#1252)Updates
LedgerHQ/device-sdk-ts/.github/actions/setup-with-build-cache-compositefrom 69b58c7 to 5ed072bCommits
5ed072b✨ (signer-eth) [LBD-298]: Update type for SignTransaction/TypedData factories...4177e0e✨ (signer-solana) [DSDK-1520]: Support blind-signing Solana v1 transactions (...9698f3e♻️ (manager-api) [NO-ISSUE]: Remove livecommonversion in HttpManagerApiDataSo...762139e♻️ (manager-api): Remove hardcoded livecommonversion in HttpManagerApiDataSourcebad1b8f✨ (clear-signing-tester) [DSDK-1527]: Add Tron support and TRC10/TRC20 scenar...9a36166✨ (signer-trx) [DSDK-1526]: Provide TRC10 token names when signing a transact...2e1c63c💚 (ci): Run the Tron clear-signing scenariosd0e9985✨ (clear-signing-tester): Add Tron support and TRC10/TRC20 scenarios7ea891a✨ (signer-trx): Provide TRC10 token names when signing a transaction1fe060e✨ (context-module): Add a Tron TRC10 token loaderUpdates
LedgerHQ/device-sdk-ts/.github/actions/generate-sbom-compositefrom 69b58c7 to 5ed072bCommits
5ed072b✨ (signer-eth) [LBD-298]: Update type for SignTransaction/TypedData factories...4177e0e✨ (signer-solana) [DSDK-1520]: Support blind-signing Solana v1 transactions (...9698f3e♻️ (manager-api) [NO-ISSUE]: Remove livecommonversion in HttpManagerApiDataSo...762139e♻️ (manager-api): Remove hardcoded livecommonversion in HttpManagerApiDataSourcebad1b8f✨ (clear-signing-tester) [DSDK-1527]: Add Tron support and TRC10/TRC20 scenar...9a36166✨ (signer-trx) [DSDK-1526]: Provide TRC10 token names when signing a transact...2e1c63c💚 (ci): Run the Tron clear-signing scenariosd0e9985✨ (clear-signing-tester): Add Tron support and TRC10/TRC20 scenarios7ea891a✨ (signer-trx): Provide TRC10 token names when signing a transaction1fe060e✨ (context-module): Add a Tron TRC10 token loaderUpdates
docker/setup-buildx-actionfrom 4.2.0 to 4.4.0Release notes
Sourced from docker/setup-buildx-action's releases.
Commits
594f3bfMerge pull request #609 from crazy-max/pull-buildkit-image-before-createbd6e702chore: update generated content6268c9dpull BuildKit image before builder creatione823525Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...533ed8ebuild(deps): bump the codeql-actions group with 2 updatesbedaf13Merge pull request #620 from crazy-max/shared-error-helpersd5079fbchore: update generated content226a616use shared error helpers for Buildx and Docker commands77ce7f4Merge pull request #619 from docker/dependabot/npm_and_yarn/docker/actions-to...0dc1dc9[dependabot skip] chore: update generated contentUpdates
toshimaru/auto-author-assignfrom 3.0.3 to 3.1.0Release notes
Sourced from toshimaru/auto-author-assign's releases.
Changelog
Sourced from toshimaru/auto-author-assign's changelog.
... (truncated)
Commits
a78a94bchore(main): release 3.1.0 (#192)c323db6feat: add support to skip users (see #185 and #191)eae6cfdbuild(deps-dev): bump rollup from 4.62.3 to 4.62.4 (#189)3d6ff39build(deps): bump undici from 6.25.0 to 6.28.0 (#188)6c3a1f7docs: use consistent terminology for machine-user accounts19ec32bdocs: note that bot check does not cover machine-user accounts737b10ebuild: rebuild dist for skip-users separator fix9db2a78fix: parse skip-users as comma or newline-separated list2498de0Update README0bb3224Add skip-user inputUpdates
LedgerHQ/device-sdk-ts/.github/actions/publish-to-jfrog-compositefrom 69b58c7 to 5ed072bCommits
5ed072b✨ (signer-eth) [LBD-298]: Update type for SignTransaction/TypedData factories...4177e0e✨ (signer-solana) [DSDK-1520]: Support blind-signing Solana v1 transactions (...9698f3e♻️ (manager-api) [NO-ISSUE]: Remove livecommonversion in HttpManagerApiDataSo...762139e♻️ (manager-api): Remove hardcoded livecommonversion in HttpManagerApiDataSourcebad1b8f✨ (clear-signing-tester) [DSDK-1527]: Add Tron support and TRC10/TRC20 scenar...9a36166✨ (signer-trx) [DSDK-1526]: Provide TRC10 token names when signing a transact...2e1c63c💚 (ci): Run the Tron clear-signing scenariosd0e9985✨ (clear-signing-tester): Add Tron support and TRC10/TRC20 scenarios7ea891a✨ (signer-trx): Provide TRC10 token names when signing a transaction1fe060e✨ (context-module): Add a Tron TRC10 token loader