Update CI images and actions #476
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/ci"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v7.0.0→v7.1.00.74.0→0.76.10.12.19→0.13.5123fb72→ac4d9c7ecfaec9→4edf8970.74.0→0.76.10.74.0→0.76.10.12.19-python3.14-trixie-slim→0.13.5-python3.14-trixie-slim0.12.19→0.13.544.115.10→44.176.2v4.2.0→v4.3.2Release Notes
actions/setup-node (actions/setup-node)
v7.1.0Compare Source
What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors
Full Changelog: https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0
aquasecurity/trivy (aquasecurity/trivy)
v0.76.1Compare Source
🔐 Security update: eMudhra CA incident 🛡️
Trivy v0.76.1 includes mitigations for the eMudhra intermediate CA key compromise.
We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date.
Changelog
e713f67release: v0.76.1 [release/v0.76] (#11445)6647bd6fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#11446)e0964c9fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#11443)992c360fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#11442)v0.76.0Compare Source
Features
Bug Fixes
v0.75.0Compare Source
⚠ BREAKING CHANGES
Features
Bug Fixes
Performance Improvements
astral-sh/uv (astral-sh/uv)
v0.13.5Compare Source
Released on 2026-10-21.
Following uv 0.13.4, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to python-build-standalone 20261021, including the CPython 3.15.1, 3.14.9, and 3.13.17 security patch releases. These builds include pip 26.2.2 both preinstalled in the managed interpreter and bundled with
ensurepip, which installs pip by default when you runpython -m venv. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, runuv python upgradeto install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.
Enhancements
Python
Preview features
wheel-variants(#22535, #22536, #22687, #22688)Performance
Bug fixes
Security
rustls-webpki0.103.16 (#22777)v0.13.4Compare Source
Released on 2026-10-20.
Preview features
wheel-variants(#22512)Other changes
webpki-root-certs1.0.10 (#22760)v0.13.3Compare Source
Released on 2026-10-20.
Performance
uv exportslowdowns in dependency graphs with extras (#22750)v0.13.2Compare Source
Released on 2026-10-19.
Enhancements
uv workspace metadata, including packages outside the selected resolution (#22395)pylock.toml(#22596)uv python find --scriptcannot discover an interpreter, including with-q(#22549)[build-system].requiresvalidation (#22577)Python
Preview features
wheel-variants(#22509, #22511)Performance
uv-buildbinary size, including Linux x86_64 wheels (#22539, #22573)Bug fixes
--exclude-newerwhen a newer wheel for the selected source distribution is already cached (#22685)--find-linksURLs that differ only in sensitive query values (#22630)pylock.toml(#22594)uv publish, and avoid prompting when no upload occurs (#22593)uv pip compile --python-versionvalues instead of panicking (#22727)pylock.tomloutput filenames before resolution instead of panicking (#22725)uv pip checkinvocations with-q(#22544)Rust API
unsafe-urlfeature to use rawurl::UrlAPIs inuv-pep508(#22623)Documentation
Other changes
sh.astral.*signing identifiers for macOS binaries (#22648)v0.13.1Compare Source
Released on 2026-10-14.
Enhancements
Requires-Pythonupper bounds inuv pip checkanduv pip install --strict, consistent with resolution (#22500)Python
Preview features
uv tool upgradeto upgrade installed tools whentool-install-locksis enabled (#22498)wheel-variants(#22039)Performance
Bug fixes
uv pip compileoruv exportoutput destinations (#22496)sys._base_executabledetection for environments created from symlinked interpreters (#22520)uv cache clean(#22387)uv tool upgradeleaves the tool version unchanged (#22499)Documentation
.netrcformat documentation link (#22514)Other changes
v0.13.0Compare Source
Released on 2026-10-09.
uv 0.13.0 makes Python 3.15 the default stable Python version. We've also included several breaking changes to improve correctness, performance, and compatibility, described below.
We expect most users to be able to upgrade without making changes.
While not a breaking change, this release also updates the format of many of uv's cache entries to improve performance. uv may download or rebuild dependencies after upgrading, because some cached entries from earlier versions cannot be reused. Multiple versions of uv can still safely share the same cache directory.
There are no breaking changes to the configuration of the uv build backend. If your
[build-system]table includes an upper bound onuv_build, update it to allowuv_build0.13, e.g.,uv_build>=0.13.0,<0.14.Breaking changes
Use Python 3.15 as the default stable version
The default stable Python version has changed from 3.14 to 3.15. This affects Python downloads when no version is requested or pinned, e.g., when running
uv python install.uv continues to use compatible Python installations that are already present. For example,
uv venvcan still use an installed Python 3.14. If no suitable interpreter is installed and automatic downloads are enabled, commands such asuv venvanduvx pythoncan now download Python 3.15.You can opt out of this behavior by requesting Python 3.14 explicitly, e.g.,
uv venv --python 3.14. For projects, useuv python pin 3.14to record the version in.python-version.Honor
--require-hashesin included constraints files (#22275)Previously, uv ignored
--require-hashesin constraints files included with-cfrom a requirements file. Now, uv honors the directive and requires hashes for all requirements in the installation. Installs that previously succeeded can now fail if a requirement is missing a hash.You cannot opt out while the directive is present. Add the missing hashes to your requirements, or remove the
--require-hashesdirective from the included constraints file if hash checking is not intended.Prefer native Python on Windows ARM64 (#22100)
Previously, ARM64 builds of uv preferred emulated
x86_64Python installations because native wheel support was limited. Now, uv prefers native ARM64 (aarch64) interpreters across Python versions.This follows similar changes in CPython, the official Windows Python install manager, and GitHub's actions/setup-python.
When a native interpreter is unavailable, uv continues to fall back to
x86_64, then 32-bitx86.You can opt out of this behavior by setting
UV_PYTHON_ARCH=x86_64or requesting an explicit architecture, e.g.,cpython-3.14-windows-x86_64. If you are usingsetup-uv, you can setpython-arch: x86_64instead.Reject editable requirements in included constraints files (#22282)
Previously, uv silently ignored editable (
-e) requirements in constraints files included with-cfrom a requirements file. Now, uv rejects these requirements with an error, matching pip's behavior.You cannot opt out of this behavior. Move editable requirements to a requirements file passed with
-r, or pass them directly with--editable, instead of including them in a constraints file.Omit the distutils startup patch on Python 3.10 and later (#22096)
Previously, uv installed
_virtualenv.pyand_virtualenv.pthinto every new virtual environment to prevent distutils configuration from changing installation paths. Now, likevirtualenv21.6.0, uv omits these files on Python 3.10 and later, which already ignore the affected configuration keys. This reduces Python startup overhead. Python 3.9 and earlier retain the patch.You cannot opt out of this behavior. Existing virtual environments are not modified automatically. Recreate an environment with Python 3.10 or later to remove the patch.
This stabilizes the
no-distutils-patchpreview feature.Treat requirement-file option values as single paths (#22290)
Previously, uv split values passed to
--constraint,--override,--exclude, and--build-constrainton spaces, even when quoted. Now, each value is treated as a single path, allowing file paths containing spaces.You cannot opt out of this behavior. Repeat the option to provide multiple files. For example, replace
-c "a.txt b.txt"with-c a.txt -c b.txt.Space-separated lists in
UV_CONSTRAINT,UV_OVERRIDE,UV_EXCLUDE, andUV_BUILD_CONSTRAINTremain supported.Use
tar-codecfor tar archives by default (#22094)Previously, uv used
astral-tokio-tarto extract tar archives, build source distributions withuv_build, and read their metadata foruv publish. Now, uv usestar-codec, which applies stricter validation when reading archives.uv may now reject archives containing hard links or unsupported tar extensions that previous versions accepted. Source distributions created by
uv_buildcan also have different archive bytes and hashes.You can opt out of this behavior by setting
UV_LEGACY_TAR_BACKEND=1.This stabilizes the
tar-codecpreview feature.Reject
uv build --clearoutput directories that contain a build source(#22276)
Previously,
uv build --clearcould delete a project or input source distribution when theoutput directory contained the source. Now, uv rejects these output directories, including
equivalent paths reached through symlinks, before clearing any build output.
Select an output directory that does not contain any build sources, or omit
--clear.Python
Preview features
--require-build-hashes(#21411)Performance
Bug fixes
v0.12.24Compare Source
Release Notes
Released on 2026-10-08.
Enhancements
uv cache prune(#22171)Preview features
uv auditreports, prioritizing PYSEC, GHSA, then CVE identifiers (#22292)Configuration
UV_NO_CACHE=falseto overrideno-cache = truein configuration (#22324)Performance
--find-linkspages withastral-html(#22203)uv-buildexecutable size by 7.5% by omitting unused Zstandard support (#22242)Bug fixes
--no-require-hashesorrequire-hashes = false(#22369)uv publish --trusted-publishingvalues precedence over configuration (#22279)UV_OFFLINE=falseto overrideoffline = truein configuration (#22283)UV_SYSTEM_CERTS=falseto overridesystem-certs = truein configuration (#22291)uv auth loginover IPv6 loopback addresses (#22306)#or%characters (#22281)uv versionanduv self versionwith a single--quietflag (#22280)WHEELmetadata contains multiple expandedTag:rows (#22235)--keyring-provideroption fromuv authhelp (#19520)uv toolrequirements (#22320)Documentation
required-environmentsdocumentation (#22238)Install uv 0.12.24
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
Download uv 0.12.24
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.12.23Compare Source
Release Notes
Released on 2026-10-03.
Python
Preview features
uv.lockwithout a workspace manifest usinguv sync --frozenwithfrozen-lockfile(#22018)uv.lockwithout a workspace manifest usinguv export --frozenwithfrozen-lockfile(#22007)uv.lockwithout a workspace manifest usinguv tree --frozenwithfrozen-lockfile(#22016)uv.lockwithout a workspace manifest usinguv workspace metadata --frozenwithfrozen-lockfile(#22017, #22018)Bug fixes
win_amd64wheels instead of building from source (#22099)Install uv 0.12.23
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
Download uv 0.12.23
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.12.22Compare Source
Release Notes
Released on 2026-10-01.
Python
Enhancements
--offlineoption fromuv publishhelp (#22124)Preview features
--no-default-groupsinuv audit(#22090)uv auditoruv tool auditruns offline and hide the unsupported option from help (#22114)Configuration
UV_PYTHON_ARCHto select an interpreter architecture independently of its Python version (#22098)Performance
Bug fixes
Other changes
Install uv 0.12.22
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
Download uv 0.12.22
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.12.21Compare Source
Release Notes
Released on 2026-09-29.
Python
Enhancements
[manifest]tables from lockfiles that contain only manifest subtables (#22070)Preview features
uv.lock, including those involving pre-releases, with theresolution-inputspreview feature (#22004, #22068)Bug fixes
uv python pin --rmfrom removing a global.python-versionsfile without--global(#21992)Install uv 0.12.21
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
Download uv 0.12.21
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.12.20Compare Source
Release Notes
Released on 2026-09-28.
Enhancements
Preview features
lockfile-normalizationpreview feature (#21951)pylock.toml(#22003)pylock.tomlfiles relative to the output file (#22042)tool-install-locksrequirements resolve to the same package (#22000)lock-without-metadatalockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)uv workspace metadataanduv tree --format jsonoutput (#22050)Configuration
XDG_CONFIG_DIRSafter empty entries (#21987)Performance
Bug fixes
--require-hashesand--verify-hashes(#21996)--no-build(#21988)--all-packages, including--no-install-projectand--no-emit-project(#21994)pyproject.tomlifuv upgradefails or is interrupted (#21983)--show-settings(#21989)uv python listanduv python upgradeinstead of panicking (#22033)/install(#22036)Install uv 0.12.20
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
Download uv 0.12.20
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
renovatebot/renovate (ghcr.io/renovatebot/renovate)
v44.176.2Compare Source
Bug Fixes
v44.176.1Compare Source
Miscellaneous Chores
Build System
v44.176.0Compare Source
Features
Miscellaneous Chores
v44.175.5Compare Source
Bug Fixes
onboardingConfig(#47269) (b4ee9aa), closes #47266v44.175.4Compare Source
Bug Fixes
v44.175.3Compare Source
Bug Fixes
vprefix (#47155) (b91f928)Documentation
forkProcessingandonboardingNoDeps(#47246) (bd4ba3b)Build System
v44.175.2Compare Source
Bug Fixes
v44.175.1Compare Source
Bug Fixes
allowedValues(#43833) (e6cdac8)allowedValuesfor arrays (#39076) (e5ae141)customDatasourcesgenerically (#47195) (b4de4ca)customDatasources[].formats (#47204) (a19c6bc)Miscellaneous Chores
Code Refactoring
Tests
Build System
v44.175.0Compare Source
Features
Bug Fixes
customDatasourcesvalues (#47184) (b7feac6)enabledManagersandschedule(#47193) (ba23989)hostRules[].headersto be an object (#47185) (a01e305)lockfileUpdateinmatchUpdateTypes(#47182) (d2d9f17)Miscellaneous Chores
Tests
v44.174.0Compare Source
Features
Miscellaneous Chores
v44.173.1Compare Source
Bug Fixes
v44.173.0Compare Source
Features
v44.172.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.172.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.172.0Compare Source
Features
v44.171.9Compare Source
Bug Fixes
Miscellaneous Chores
v44.171.8Compare Source
Bug Fixes
Build System
v44.171.7Compare Source
Bug Fixes
v44.171.6Compare Source
Build System
v44.171.5Compare Source
Bug Fixes
Miscellaneous Chores
v44.171.4Compare Source
Bug Fixes
Miscellaneous Chores
v44.171.3Compare Source
Miscellaneous Chores
Build System
v44.171.2Compare Source
Bug Fixes
v44.171.1Compare Source
Build System
v44.171.0Compare Source
Features
Bug Fixes
enabledManagers(#46717) (ab776b8)Miscellaneous Chores
Code Refactoring
suggestedValueshint (#46959) (2599cfa)v44.170.0Compare Source
Features
releaseTimestamps (#46885) (15fb543), closes #46806HelmChartdepType on Helm charts (#47174) (7678a47)Miscellaneous Chores
v44.169.0Compare Source
Features
Bug Fixes
packageRulescan be used (#46705) (c103f2b), closes #43020v44.168.4Compare Source
Bug Fixes
registryAliasescan be set (#46956) (8338c58), closes #43020updateInternalDepscan be set (#46955) (c08e301)Documentation
updateInternalDepsis for thenpmmanager (#46954) (8d8e430)v44.168.3Compare Source
Bug Fixes
azureWorkItemType(#47158) (aaf9d8e)v44.168.2Compare Source
Build System
v44.168.1Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v44.168.0Compare Source
Features
Miscellaneous Chores
v44.167.7Compare Source
Bug Fixes
Tests
Continuous Integration
v44.167.6Compare Source
Bug Fixes
Documentation
12d187a(main) (#47148) (8654b52)v44.167.5Compare Source
Bug Fixes
Miscellaneous Chores
v44.167.4Compare Source
Build System
v44.167.3Compare Source
Build System
v44.167.2Compare Source
Build System
v44.167.1Compare Source
Documentation
Build System
v44.167.0Compare Source
Features
Miscellaneous Chores
v44.166.0Compare Source
Features
v44.165.3Compare Source
Code Refactoring
Build System
v44.165.2Compare Source
Bug Fixes
v44.165.1Compare Source
Bug Fixes
Miscellaneous Chores
Build System
v44.165.0Compare Source
Features
Miscellaneous Chores
Code Refactoring
v44.164.10Compare Source
Bug Fixes
Miscellaneous Chores
v44.164.9Compare Source
Bug Fixes
v44.164.8Compare Source
Bug Fixes
v44.164.7Compare Source
Bug Fixes
Miscellaneous Chores
v44.164.6Compare Source
Build System
v44.164.5Compare Source
Bug Fixes
constraintscorrectly when applyingpostUpgradeTasks(#47069) (08cb221), closes #47068 #43633v44.164.4Compare Source
Bug Fixes
v44.164.3Compare Source
Bug Fixes
Miscellaneous Chores
v44.164.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.164.1Compare Source
Bug Fixes
x-access-tokenfor personal access tokens in clone URLs (#47073) (6cc8898)v44.164.0Compare Source
Features
go-importmodproxy (#47044) (0876273)v44.163.0Compare Source
Features
v44.162.0Compare Source
Features
gohost rules forgo-proxyrequests (#47043) (1dce2f8)v44.161.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.161.1Compare Source
Bug Fixes
v44.161.0Compare Source
Features
Miscellaneous Chores
v44.160.1Compare Source
Miscellaneous Chores
Build System
v44.160.0Compare Source
Features
v44.159.0Compare Source
Features
v44.158.3Compare Source
Bug Fixes
v44.158.2Compare Source
Miscellaneous Chores
Tests
gh actions-lockvia Renovate (#46987) (fc4719b)Build System
v44.158.1Compare Source
Miscellaneous Chores
Build System
v44.158.0Compare Source
Features
v44.157.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.157.0Compare Source
Features
Tests
Build System
v44.156.3Compare Source
Bug Fixes
gohost rule credentials as private (#47031) (28ed2ee)v44.156.2Compare Source
Bug Fixes
modecan be used (#46697) (9ccdc69), closes #43020Tests
v44.156.1Compare Source
Bug Fixes
v44.156.0Compare Source
Features
Miscellaneous Chores
v44.155.9Compare Source
Bug Fixes
v44.155.8Compare Source
Build System
v44.155.7Compare Source
Miscellaneous Chores
Build System
v44.155.6Compare Source
Bug Fixes
v44.155.5Compare Source
Bug Fixes
v44.155.4Compare Source
Build System
v44.155.3Compare Source
Bug Fixes
Documentation
v44.155.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.155.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.155.0Compare Source
Features
v44.154.1Compare Source
Bug Fixes
renovate-image(#46970) (bbe08af), closes #46969v44.154.0Compare Source
Features
Bug Fixes
hostRulesandinternalHostAccesswhen resolvingglobalExtends(#46666) (cf46a67)v44.153.1Compare Source
Bug Fixes
v44.153.0Compare Source
Features
v44.152.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
enabledandmanagerFilePatterns(#46683) (2a300e8), closes #43020Tests
v44.151.5Compare Source
Bug Fixes
Code Refactoring
scopes(#46675) (92ef4c7), closes #43020v44.151.4Compare Source
Bug Fixes
additionalPropertiesfor maps of values (#46681) (df8fe3d)v44.151.3Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v44.151.2Compare Source
Bug Fixes
Build System
v44.151.1Compare Source
Bug Fixes
Documentation
b9767f5(main) (#46927) (f9f131c)v44.151.0Compare Source
Features
Miscellaneous Chores
v44.150.1Compare Source
Bug Fixes
v44.150.0Compare Source
Features
Miscellaneous Chores
v44.149.3Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v44.149.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.149.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.149.0Compare Source
Features
Documentation
v44.148.6Compare Source
Bug Fixes
Miscellaneous Chores
Build System
v44.148.5Compare Source
Bug Fixes
Miscellaneous Chores
v44.148.4Compare Source
Bug Fixes
Miscellaneous Chores
v44.148.3Compare Source
Bug Fixes
v44.148.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.148.1Compare Source
Miscellaneous Chores
Build System
v44.148.0Compare Source
Features
Miscellaneous Chores
v44.147.0Compare Source
Features
v44.146.3Compare Source
Bug Fixes
Miscellaneous Chores
Code Refactoring
buildSchemafunction (#46679) (c72bd25)Tests
v44.146.2Compare Source
Bug Fixes
v44.146.1Compare Source
Bug Fixes
v44.146.0Compare Source
Features
Miscellaneous Chores
v44.145.3Compare Source
Bug Fixes
v44.145.2Compare Source
Miscellaneous Chores
Build System
v44.145.1Compare Source
Bug Fixes
v44.145.0Compare Source
Features
Miscellaneous Chores
v44.144.1Compare Source
Bug Fixes
v44.144.0Compare Source
Features
Bug Fixes
Code Refactoring
indexMarkdownfunction (#46693) (baea689)Tests
Build System
v44.143.0Compare Source
Features
slsa-framework/actions/*'withs (#46792) (4ca515b)Bug Fixes
java-maventool (#46587) (4a0935d), closes #41849Miscellaneous Chores
Code Refactoring
Build System
v44.142.1Compare Source
Bug Fixes
depNamewhen it matches repo name (#46789) (9284b7e), closes #46787Code Refactoring
v44.142.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
v44.141.0Compare Source
Features
Miscellaneous Chores
v44.140.0Compare Source
Features
Miscellaneous Chores
v44.139.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
v44.138.1Compare Source
Miscellaneous Chores
Build System
v44.138.0Compare Source
Features
Miscellaneous Chores
v44.137.0Compare Source
Features
v44.136.0Compare Source
Features
v44.135.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
v44.134.3Compare Source
Bug Fixes
v44.134.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.134.1Compare Source
Bug Fixes
Documentation
5046790(main) (#46743) (b5ac326)Miscellaneous Chores
v44.134.0Compare Source
Features
Bug Fixes
v44.133.1Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
Tests
v44.133.0Compare Source
Features
v44.132.6Compare Source
Bug Fixes
Miscellaneous Chores
v44.132.5Compare Source
Bug Fixes
Miscellaneous Chores
Build System
v44.132.4Compare Source
Bug Fixes
v44.132.3Compare Source
Bug Fixes
Miscellaneous Chores
v44.132.2Compare Source
Bug Fixes
v44.132.1Compare Source
Bug Fixes
v44.132.0Compare Source
Features
v44.131.4Compare Source
Bug Fixes
Miscellaneous Chores
v44.131.3Compare Source
Bug Fixes
v44.131.2Compare Source
Bug Fixes
v44.131.1Compare Source
Build System
v44.131.0Compare Source
Features
Miscellaneous Chores
Code Refactoring
v44.130.0Compare Source
Features
Miscellaneous Chores
v44.129.0Compare Source
Features
Code Refactoring
v44.128.3Compare Source
Bug Fixes
v44.128.2Compare Source
Bug Fixes
Miscellaneous Chores
Continuous Integration
v44.128.1Compare Source
Build System
v44.128.0Compare Source
Features
v44.127.2Compare Source
Bug Fixes
v44.127.1Compare Source
Bug Fixes
v44.127.0Compare Source
Features
Miscellaneous Chores
v44.126.1Compare Source
Build System
v44.126.0Compare Source
Features
v44.125.2Compare Source
Bug Fixes
firstas the default registry strategy (#46104) (fc57966), closes #40497Miscellaneous Chores
Code Refactoring
postprocessReleasean optional method (#46105) (7c85eeb)getFilteredFileList(#46603) (a35adea)getMatchingFiles(#46604) (f52629a)mergeChildConfig(#46601) (e5b3520)v44.125.1Compare Source
Bug Fixes
v44.125.0Compare Source
Features
Miscellaneous Chores
Tests
hostRulesafter each test (#46582) (a2704ed)hostRules.clear()calls (#46584) (8b3a066)Continuous Integration
v44.124.2Compare Source
Bug Fixes
@yarnpkg/cli-dist(#46525) (0dc8d8b)v44.124.1Compare Source
Bug Fixes
v44.124.0Compare Source
Features
v44.123.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.123.0Compare Source
Features
voidzero-dev/setup-vpinputs (#46495) (0dd6088)v44.122.1Compare Source
Build System
v44.122.0Compare Source
Features
v44.121.4Compare Source
Bug Fixes
Miscellaneous Chores
v44.121.3Compare Source
Build System
v44.121.2Compare Source
Build System
v44.121.1Compare Source
Build System
v44.121.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
Build System
v44.120.0Compare Source
Features
v44.119.1Compare Source
Bug Fixes
Documentation
v44.119.0Compare Source
Features
allowedHeaders(#45654) (af055eb)Bug Fixes
Miscellaneous Chores
v44.118.2Compare Source
Bug Fixes
v44.118.1Compare Source
Bug Fixes
internalHostAccessduring platform init (#46542) (c11053a), closes #45848v44.118.0Compare Source
Features
allowCustomCrateGitRegistriesand relax sparse registries cloning (#45632) (c5d1b43)Code Refactoring
v44.117.2Compare Source
Bug Fixes
Miscellaneous Chores
v44.117.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.117.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
v44.116.1Compare Source
Bug Fixes
Miscellaneous Chores
v44.116.0Compare Source
Features
gomodversioning (#46392) (6b7c7e1)Bug Fixes
Documentation
Miscellaneous Chores
Code Refactoring
Continuous Integration
v44.115.13Compare Source
Bug Fixes
Miscellaneous Chores
v44.115.12Compare Source
Bug Fixes
v44.115.11Compare Source
Bug Fixes
Miscellaneous Chores
RijksICTGilde/zad-actions (https://github.com/RijksICTGilde/zad-actions)
v4.3.2Compare Source
Fixed
deploy,cleanupandscheduled-cleanup: pin uv to 0.12.17 in thesetup-uvstep. Without a version, setup-uv resolves "latest" through the GitHub API whenever the caller's workspace root has nouv.tomlorpyproject.toml; on a Forgejo runnergithub.tokenis not valid there, so the lookup ran anonymously and failed intermittently on the rate limitdeploy,cleanupandscheduled-cleanup: turn off the setup-uv cache. uv only installs zad-cli here, so the cache had nothing to hold and every run warned that its dependency glob matched no filesInternal
deploy/,cleanup/andscheduled-cleanup/. With only/it read.github/workflowsand a rootaction.yml, so the actions the composite actions pull in (such asastral-sh/setup-uv) never got an update--strictfrom a shared.yamllint.yaml, in pre-commit and CI alike; CI now lints every YAML file instead of a hand-picked list that missedscheduled-cleanup..editorconfigsets the same 150-column limit for YAML.pre-commit-config.yaml: pre-commit.ci only reads theci:key there, so.pre-commit-ci.yamlwas ignoredskip-bot-prs: 'false'to every action call. On its default the actions skip themselves when the PR author is a bot, so every assertion read an empty output and the suite went red on a Dependabot PR while testing nothing. Now that Dependabot scans the composite actions, that is every bump it opens. Abot-checkjob holds the skip logic itself, against the step's own script: a PR author cannot be faked in a workflow event, so it is extracted the waydeploy-logextracts the deploy stepWhat's Changed
Full Changelog: https://github.com/RijksICTGilde/zad-actions/compare/v4.3.1...v4.3.2
v4.3.1Compare Source
Changed
.plugin/plugin.jsonhad stood at 1.2.0 since February while the actions moved through four minors to 4.3.0, so the marketplace installed a plugin that claimed a version from before seven commits and 597 lines of skill changes. The plugin version is now the tag version, which makes the marketplace follow a release of either without anyone remembering a second numbermodel: sonnet. A pinned model overrides the choice of whoever runs the skill, which is wrong for reference content: these skills describe ZAD deployment, linting and releases, they are not an agent loop with a cost or latency profile worth constraining. Nothing measured that sonnet was sufficient here, and a hardcoded model name is five places to edit when the naming changes, with nothing to signal that it went stale. The six plugins in the developer.overheid.nl marketplace dropped theirs for the same reasonInternal
scripts/bump_version.pysets the version in.plugin/plugin.jsonand regenerates the two platform manifests, so the three cannot drift apart by hand.plugin/plugin.json, and names the helper in the error. A forgotten bump now fails the release before it publishes, instead of shipping a plugin that claims an older version — which is how the 1.2.0 gap went unnoticed for six months. The check runs before the release is created, so the existing rollback step takes the tag back downWhat's Changed
Full Changelog: https://github.com/RijksICTGilde/zad-actions/compare/v4.3.0...v4.3.1
v4.3.0Compare Source
Upgrading
A
deploystep can now fail where it used to pass, in two cases, both of which were a green step over a rollout that had not happened:failedorcancelled. Previously the hand-over was invisible and the step reported success over addresses that nothing answered on; it now fails and names the task.zad project refresh, rather than publishing addresses the project file asks for.Nothing is renamed or removed, and a deploy that is not superseded takes exactly the path it did before.
Fixed
deploy: a superseded deployment task is treated as the hand-over it is. A newer task whose deployment scope covers this one's, a second deploy of the same deployment or a project-wide change, takes the remaining ArgoCD wait over; the waiting task ends as completed withresult.status: superseded, and zad-cli exits 0 on that. Deploys of different deployments have disjoint scopes and never supersede each other. The action now followssuperseded_by.task_idwithzad task waituntil a task finishes the work, and names the hand-over in the log as a notice. A taking-over task that endsfailedorcancelledfails the step and names the task; a chain that never ends stops on a cap of 10 hand-oversdeploy: a deploy whose hand-over ends with changes that are saved but not rolled out fails the step with the count andzad project refresh, instead of reporting success over addresses that the project file asks for and nothing answers on yetdeploy:Deployment successfulis printed once the URLs are in hand instead of on the create's exit code, so it can no longer precede an error in the log. The line that follows the create now saysDeployment task accepted, which is what is true at that pointInternal
statuslives in one place,task_statusinscripts/zad-common.sh, instead of once there and once verbatim indeploy/action.yml. Two definitions of "what counts as superseded" could drift apart, and the way they would is silent: the deploy step's own copy stops recognising a hand-over that the helper still follows, which turns "saved but not rolled out" back into a green deploydeploy: both readings of the waiting count guard the nested index and not only the document around it.type == "object"answers for the task result, not for itspending_rollout, andjq emptyaccepts an array or a bare string as aproject pendinganswer, so a count of another shape made.counta jq error — which, in a bare assignment underset -eo pipefail, failed the step with no annotation at all: on the fallback over the one count that branch exists to treat as best effort, and on the task result immediately after the hand-over had been reported as finished. The same suppression is on the two readings ofsuperseded_byinresolve_task_handover, where a result of the wrong shape already ended in the message it should but leaked jq's own error lines into the log firstdeploysmoke job covers the hand-over branches that had no case of their own: the waiting count read off the final task result rather than asked for again, the scoping of that check to a hand-over so somebody else's saved change cannot fail a plain deploy, acancelledsuccessor, a superseded result that names no successor, a task id that could forge an annotation, a count that cannot be read at all, and a count that comes back as something other than an object — on theproject pendinganswer and on the final task result alike.tests/stubs/zadgainedZAD_STUB_PENDING_EXIT, which makes a failingproject pendingtestablezad-commonsmoke job callsresolve_task_handoverdirectly, with its stderr captured. The promises the hand-over makes are about what it says — that it reads as a notice and not a warning, that a failure names the task that took over, that the cap ends with a message — and none of that is readable from thedeployjob, because a step cannot read the job log it is running inside. The job also covers the branches the deploy path cannot reach: a result that is not JSON passing through untouched, both spellings ofcancelled, a hostiletask_type, a wait that exits 0 with a half-written document, asuperseded_bythat is not an object at all — which must end in the message that names nobody, without jq's own error line beside it — and the readingstask_statusgives for a bare string, an array and no input at all.tests/stubs/zadgainedZAD_STUB_TASK_WAIT_RAWfor the half-written document, whichprettyrefuses to produce on purposedeploysmoke job also pins apending_rollout.countof0on the final task as an answer rather than a missing one: it is read off the result, and the project is not asked a second timedeploy-logsmoke job runs the deploy step's own script with its output captured, because the lines it is judged on are annotations in the job log and no later step can read the log it is running inside. It pins what the waiting count makes the step say and not only what it makes the step do: the count itself andzad project refreshin the failure, the cause of a count that could not be read in the warning, and a count that is not a number failing nothing rather than being reported as that many changes waiting. The step's script is extracted fromdeploy/action.ymlby name, and the extraction is checked against anchors from its head, middle and tail so it cannot silently come back empty or halfdeploy: when the waiting count cannot be read at all, the warning names the cause. The CLI's diagnosis is the document on stdout and its stderr is dropped on that call, so the bare warning left a reader unable to tell a one-off incident from an API key that structurally lacks the right to list pending changes — and in that second case this check is dead in that project, which makes "saved but not rolled out" a green deploy againdebug-deployskill answers the hand-over failures: a successor that endedfailedorcancelled, changes saved but not rolled out, the hop cap, a hand-over that names no successor, and the warning over a waiting count that could not be read. The skill is where a reader takes an::error::line from a deploy log, and these lines had no entry.deploy/README.mdalso says that each wait is bounded bytask-timeouton its own, so a chain of hand-overs can outlast a single task's timeoutgrep ^description:and any tool that reads the first line saw>-and an empty value, which is how a review of the descriptions across the marketplace plugins concluded these skills had none.generate-workflowalso lost the trigger'hoe gebruik ik zad-actions', which'setup zad'and'integratie'already cover, bringing every description under 200 charactersWhat's Changed
Full Changelog: https://github.com/RijksICTGilde/zad-actions/compare/v4.2.0...v4.3.0
Configuration
📅 Schedule: (in timezone Europe/Amsterdam)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
678ac4ea8626a3b578ec26a3b578ec960e09639f960e09639fa00a59300ca00a59300ca7244915b9a7244915b9f3e077731bf3e077731b1c12673bc71c12673bc7241930db45241930db45c797f02401c797f024011fba0656501fba0656505e34eca4c85e34eca4c8c2fe00238cView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.