chore(deps): Bump the github-actions group across 1 directory with 8 updates

[dependabot]

Bumps the github-actions group with 8 updates in the / directory:

Package	From	To
actions/upload-artifact	7.0.0	7.0.1
taiki-e/install-action	2.70.2	2.75.7
streetsidesoftware/cspell-action	8.3.0	8.4.0
docker/login-action	4.0.0	4.1.0
docker/build-push-action	7.0.0	7.1.0
pypa/cibuildwheel	3.4.0	3.4.1
pypa/gh-action-pypi-publish	1.13.0	1.14.0
softprops/action-gh-release	2.6.1	3.0.0

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

• Update the readme with direct upload details by @​danwkennedy in actions/upload-artifact#795
• Readme: bump all the example versions to v7 by @​danwkennedy in actions/upload-artifact#796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• See full diff in compare view

Updates taiki-e/install-action from 2.70.2 to 2.75.7

Release notes

Sourced from taiki-e/install-action's releases.

2.75.7

• Update covgate@latest to 0.1.4.

• Update wasm-bindgen@latest to 0.2.118.

2.75.6

• Update mise@latest to 2026.4.8.

• Update cargo-deny@latest to 0.19.1.

2.75.5

• Update biome@latest to 2.4.11.

• Update wasmtime@latest to 43.0.1.

• Update uv@latest to 0.11.6.

• Update mise@latest to 2026.4.7.

• Update gungraun-runner@latest to 0.18.0.

2.75.4

• Enhance security when cargo-binstall fallback is enabled. (08a38582, ba626b4d)

• Update martin@latest to 1.5.0.

• Update uv@latest to 0.11.5.

• Update syft@latest to 1.42.4.

• Update dprint@latest to 0.54.0.

2.75.3

• Enhance security when cargo-binstall fallback is disabled. (77557fa3)

• Update rclone@latest to 1.73.4.

2.75.2

• Update uv@latest to 0.11.4.

• Update tombi@latest to 0.9.16.

• Update mise@latest to 2026.4.6.

2.75.1

• Update shfmt@latest to 3.13.1.

• Update cosign@latest to 3.0.6.

2.75.0

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

• Update cargo-binstall@latest to 1.18.0.

• Update vacuum@latest to 0.25.6.

• Update gungraun-runner@latest to 0.18.1.

[2.75.7] - 2026-04-11

• Update covgate@latest to 0.1.4.

• Update wasm-bindgen@latest to 0.2.118.

[2.75.6] - 2026-04-11

• Update mise@latest to 2026.4.8.

• Update cargo-deny@latest to 0.19.1.

[2.75.5] - 2026-04-10

• Update biome@latest to 2.4.11.

• Update wasmtime@latest to 43.0.1.

• Update uv@latest to 0.11.6.

• Update mise@latest to 2026.4.7.

• Update gungraun-runner@latest to 0.18.0.

[2.75.4] - 2026-04-10

• Enhance security when cargo-binstall fallback is enabled. (08a38582, ba626b4d)

• Update martin@latest to 1.5.0.

• Update uv@latest to 0.11.5.

... (truncated)

Commits

• 0abfcd5 Release 2.75.7
• cf81fe3 Update covgate@latest to 0.1.4
• e8aec85 Update wasm-bindgen@latest to 0.2.118
• d053c7f Release 2.75.6
• 9019f2e Update mise@latest to 2026.4.8
• 1b07fb7 Update cargo-deny@latest to 0.19.1
• be1e8a8 Update vacuum manifest
• 1cc7501 Update gungraun-runner manifest
• 44afe62 Update covgate manifest
• 7a4939c Release 2.75.5
• Additional commits viewable in compare view

Updates streetsidesoftware/cspell-action from 8.3.0 to 8.4.0

Release notes

Sourced from streetsidesoftware/cspell-action's releases.

v8.4.0

8.4.0 (2026-04-05)

Features

• Update CSpell version (9.8.0) (#2674) (fdcf3ba)

Updates and Bug Fixes

• Update Dictionaries and Dependencies (#2628) (356d6ad)
• Update Dictionaries and Dependencies (#2634) (4d2f4fd)
• Update Dictionaries and Dependencies (#2642) (21dee0c)
• Update Dictionaries and Dependencies (#2657) (3f8d667)
• Update Dictionaries and Dependencies (#2661) (e15595b)
• Update Dictionaries and Dependencies (#2668) (d58ab56)
• Workflow Bot -- Update ALL Dependencies (main) (#2633) (8adf80d)
• Workflow Bot -- Update ALL Dependencies (main) (#2637) (6fe080d)
• Workflow Bot -- Update ALL Dependencies (main) (#2650) (164c120)
• Workflow Bot -- Update ALL Dependencies (main) (#2652) (dca5a81)
• Workflow Bot -- Update ALL Dependencies (main) (#2656) (1afd36f)
• Workflow Bot -- Update ALL Dependencies (main) (#2663) (a327cce)

Changelog

Sourced from streetsidesoftware/cspell-action's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

8.4.0 (2026-04-05)

Features

• Update CSpell version (9.8.0) (#2674) (fdcf3ba)

Updates and Bug Fixes

• Update Dictionaries and Dependencies (#2628) (356d6ad)
• Update Dictionaries and Dependencies (#2634) (4d2f4fd)
• Update Dictionaries and Dependencies (#2642) (21dee0c)
• Update Dictionaries and Dependencies (#2657) (3f8d667)
• Update Dictionaries and Dependencies (#2661) (e15595b)
• Update Dictionaries and Dependencies (#2668) (d58ab56)
• Workflow Bot -- Update ALL Dependencies (main) (#2633) (8adf80d)
• Workflow Bot -- Update ALL Dependencies (main) (#2637) (6fe080d)
• Workflow Bot -- Update ALL Dependencies (main) (#2650) (164c120)
• Workflow Bot -- Update ALL Dependencies (main) (#2652) (dca5a81)
• Workflow Bot -- Update ALL Dependencies (main) (#2656) (1afd36f)
• Workflow Bot -- Update ALL Dependencies (main) (#2663) (a327cce)

8.3.0 (2026-02-23)

Features

• Update CSpell version (9.7.0) (#2623) (c133e41)

Updates and Bug Fixes

• drop dependency upon @actions/github to get the context. (#2594) (8e0bc6f)
• remove direct dependency upon @​actions/core (#2590) (f599087)
• Switch action to ESM using tsdown (#2595) (382af06)
• Update CSpell version (9.6.4) (#2598) (c7a5b0d)
• Update Dictionaries and Dependencies (#2610) (0b7f004)
• Update Dictionaries and Dependencies (#2613) (b8b230a)
• Update Dictionaries and Dependencies (#2624) (445d7c5)
• Workflow Bot -- Update ALL Dependencies (main) (#2597) (405b6ec)

8.2.0 (2026-01-27)

Features

... (truncated)

Commits

• de2a73e chore(main): release 8.4.0 (#2629)
• 8ea2799 ci: Workflow Bot -- Update ALL Dependencies (main) (#2673)
• fdcf3ba feat: Update CSpell version (9.8.0) (#2674)
• a327cce fix: Workflow Bot -- Update ALL Dependencies (main) (#2663)
• d58ab56 fix: Update Dictionaries and Dependencies (#2668)
• 8ce4ad0 chore(deps): bump codecov/codecov-action from 5.5.3 to 6.0.0 (#2666)
• 0e6f8c5 ci: Workflow Bot -- Update ALL Dependencies (main) (#2660)
• e15595b fix: Update Dictionaries and Dependencies (#2661)
• b52d252 chore: Update PNPM (#2635)
• 1afd36f fix: Workflow Bot -- Update ALL Dependencies (main) (#2656)
• Additional commits viewable in compare view

Updates docker/login-action from 4.0.0 to 4.1.0

Release notes

Sourced from docker/login-action's releases.

v4.1.0

• Fix scoped Docker Hub cleanup path when registry is omitted by @​crazy-max in docker/login-action#945
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1020.0 in docker/login-action#930
• Bump @​docker/actions-toolkit from 0.77.0 to 0.86.0 in docker/login-action#932 docker/login-action#936
• Bump brace-expansion from 1.1.12 to 1.1.13 in docker/login-action#952
• Bump fast-xml-parser from 5.3.4 to 5.3.6 in docker/login-action#942
• Bump flatted from 3.3.3 to 3.4.2 in docker/login-action#944
• Bump glob from 10.3.12 to 10.5.0 in docker/login-action#940
• Bump handlebars from 4.7.8 to 4.7.9 in docker/login-action#949
• Bump http-proxy-agent and https-proxy-agent to 8.0.0 in docker/login-action#937
• Bump lodash from 4.17.23 to 4.18.1 in docker/login-action#958
• Bump minimatch from 3.1.2 to 3.1.5 in docker/login-action#941
• Bump picomatch from 4.0.3 to 4.0.4 in docker/login-action#948
• Bump undici from 6.23.0 to 6.24.1 in docker/login-action#938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

Commits

• 4907a6d Merge pull request #930 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
• 1e233e6 chore: update generated content
• 6c24ead build(deps): bump the aws-sdk-dependencies group with 2 updates
• ee034d7 Merge pull request #958 from docker/dependabot/npm_and_yarn/lodash-4.18.1
• 1527209 Merge pull request #937 from docker/dependabot/npm_and_yarn/proxy-agent-depen...
• d39362a build(deps): bump lodash from 4.17.23 to 4.18.1
• a6f092b chore: update generated content
• 60953f0 build(deps): bump the proxy-agent-dependencies group with 2 updates
• 62c6885 Merge pull request #936 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 102c0e6 chore: update generated content
• Additional commits viewable in compare view

Updates docker/build-push-action from 7.0.0 to 7.1.0

Release notes

Sourced from docker/build-push-action's releases.

v7.1.0

• Git context query format support by @​crazy-max in docker/build-push-action#1505
• Bump @​docker/actions-toolkit from 0.79.0 to 0.87.0 by @​crazy-max in docker/build-push-action#1505
• Bump brace-expansion from 1.1.12 to 1.1.13 in docker/build-push-action#1500
• Bump fast-xml-parser from 5.4.2 to 5.5.7 in docker/build-push-action#1489
• Bump flatted from 3.3.3 to 3.4.2 in docker/build-push-action#1491
• Bump glob from 10.3.12 to 10.5.0 in docker/build-push-action#1490
• Bump handlebars from 4.7.8 to 4.7.9 in docker/build-push-action#1497
• Bump lodash from 4.17.23 to 4.18.1 in docker/build-push-action#1510
• Bump picomatch from 4.0.3 to 4.0.4 in docker/build-push-action#1496
• Bump undici from 6.23.0 to 6.24.1 in docker/build-push-action#1486
• Bump vite from 7.3.1 to 7.3.2 in docker/build-push-action#1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

Commits

• bcafcac Merge pull request #1509 from docker/dependabot/npm_and_yarn/vite-7.3.2
• 18e62f1 Merge pull request #1510 from docker/dependabot/npm_and_yarn/lodash-4.18.1
• 46580d2 chore: update generated content
• 3f80b25 chore(deps): Bump lodash from 4.17.23 to 4.18.1
• efeec95 Merge pull request #1505 from crazy-max/refactor-git-context
• ddf04b0 Merge pull request #1511 from docker/dependabot/github_actions/crazy-max-dot-...
• db08d97 chore(deps): Bump the crazy-max-dot-github group with 2 updates
• ef1fb96 Merge pull request #1508 from docker/dependabot/github_actions/docker/login-a...
• 2d8f2a1 chore: update generated content
• 919ac7b fix test since secrets are not written to temp path anymore
• Additional commits viewable in compare view

Updates pypa/cibuildwheel from 3.4.0 to 3.4.1

Release notes

Sourced from pypa/cibuildwheel's releases.

v3.4.1

• ⚠️ Building for the experimental CPython 3.13 free-threading variant is now deprecated. That functionality will be removed in the next minor release. The enable option cpython-freethreading is therefore also deprecated. Builds specifying enable = "all" no longer select cpython-freethreading. CPython 3.14 free-threading support remains available without the enable flag. (#2787)
• 🐛 iOS builds will no longer skip repair-wheel-command if it's defined in config (#2761)
• 🐛 Fix bug causing uv to fail when environments define PYTHON_VERSION or UV_PYTHON, conflicting with our venvs (#2795)
• ✨ cibuildwheel prints the selected build identifiers at the start of the build. (#2785)
• 🔐 The GitHub Action now references other actions with a full SHA (#2744)

Changelog

Sourced from pypa/cibuildwheel's changelog.

---

title: Changelog

Changelog

v3.4.1

2 April 2026

• ⚠️ Building for the experimental CPython 3.13 free-threading variant is now deprecated. That functionality will be removed in the next minor release. The enable option cpython-freethreading is therefore also deprecated. Builds specifying enable = "all" no longer select cpython-freethreading. CPython 3.14 free-threading support remains available without the enable flag. (#2787)
• 🐛 iOS builds will no longer skip repair-wheel-command if it's defined in config (#2761)
• 🐛 Fix bug causing uv to fail when environments define PYTHON_VERSION or UV_PYTHON, conflicting with our venvs (#2795)
• ✨ cibuildwheel prints the selected build identifiers at the start of the build. (#2785)
• 🔐 The GitHub Action now references other actions with a full SHA (#2744)

v3.4.0

5 March 2026

• 🌟 You can now build wheels using uv as a build frontend. This should improve performance, especially if your project has lots of build dependencies. To use, set build-frontend to uv. (#2322)
• ⚠️ We no longer support running on Travis CI. It may continue working but we don't run tests there anymore so we can't be sure. (#2682)
• ✨ Improvements to building rust wheels on Android (#2650)
• 🛠 Update Pyodide to 0.29.3 (#2719, #2733)
• 🐛 Fix bug with the GitHub Action on Windows, where PATH was getting unnecessarily changed, causing issues with meson builds. (#2723)
• ✨ Add support for quiet setting on build and uv from the cibuildwheel build-verbosity setting. (#2737)
• 📚 Docs updates, including guidance on using Meson on Windows (#2718)

v3.3.1

5 January 2026

• 🛠 Update dependencies and container pins, including updating to CPython 3.14.2. (#2708)

v3.3.0

12 November 2025

• 🐛 Fix an incompatibility with Docker v29 (#2660)
• ✨ Adds test-runtime option, to customise how tests on simulated/emulated environments are run (#2636)
• ✨ Adds support for new manylinux_2_35 images on 32-bit ARM armv7l, offering better C++20 compatibility (#2656)
• ✨ build[uv] is now supported on Android (#2587)
• ✨ You can now install extras (such as uv) with a simple option on the GitHub Action (#2630)
• ✨ {project} and {package} placeholders are now supported in repair-wheel-command (#2589)
• 🛠 The versions set with dependency-versions no longer constrain packages specified by your build-system.requires. Previously, on platforms other than Linux, the constraints in this option would remain in the environment during the build. This has been tidied up make behaviour more consistent between platforms, and to prevent version conflicts. (#2583)
• 🛠 Improve the handling of test-command on Android, enabling more options to be passed (#2590)
• 📚 Docs improvements (#2618)

v3.2.1

... (truncated)

Commits

• 8d2b08b Bump version: v3.4.1
• 54b8a01 deprecation: cp313t (#2787)
• 097806b tests: fully type the test suite (#2794)
• 643b30c fix: avoid PYTHON_VERSION breaking uv if set (#2795)
• fffe2ca chore(deps): bump j178/prek-action from 1.1.1 to 2.0.0 in the actions group (...
• 6111948 fix: zizmor "code injection via template expansion" (#2784)
• e478767 chore: remove some string types (#2798)
• caf433b [Bot] Update dependencies (#2789)
• a257a3f chore: remove remaining future annotations (#2799)
• 6df84da chore: some cleanup and checks (#2792)
• Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.0

✨ What's Changed

The main change in this release is that verbose and print-hash inputs are now on by default. This was contributed by @​whitequark💰 in #397.

📝 Docs

@​woodruffw💰 updated the mentions of PEP 740 to stop implying that it might be experimental (it hasn't been for quite a while!) in #388 and @​him2him2💰 brushed up some grammar in the README and SECURITY docs via #395.

🛠️ Internal Updates

@​woodruffw💰 bumped sigstore and pypi-attestations in the lock file (#391) and @​webknjaz💰 added infra for using type annotations in the project (#381).

💪 New Contributors

• @​him2him2 made their first contribution in #395
• @​whitequark made their first contribution in #397

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.13.0...v1.14.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​facutuesca💰 and @​woodruffw💰 for helping maintain this project when I can't!

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• cef2210 Merge pull request #397 from whitequark/patch-1
• b4595e2 Enable verbose and print-hash by default.
• e2bab26 Merge pull request #395 from him2him2/docs/fix-typos-and-grammar
• 7495c38 docs: fix typos and grammar in README and SECURITY
• 03f86fe Merge pull request #388 from woodruffw-forks/ww/rm-experimental
• 4c78f1c Merge branch 'unstable/v1' into ww/rm-experimental
• b5a6e8b deps: bump sigstore and pypi-attestations
• a48a03e remove another experimental mention
• 8087a88 action: remove a lingering mention of PEP 740 being experimental
• 3317ede 🧪 Integrate actionlint via pre-commit framework
• Additional commits viewable in compare view

Updates softprops/action-gh-release from 2.6.1 to 3.0.0

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

• Move the action runtime and bundle target to Node 24
• Update @types/node to the Node 24 line and allow future Dependabot updates
• Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

• chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @​dependabot[bot] in softprops/action-gh-release#775
• chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by @​dependabot[bot] in softprops/action-gh-release#777
• chore(deps): bump vite from 8.0.0 to 8.0.5 by @​dependabot[bot] in softprops/action-gh-release#781

Full Changelog: softprops/action-gh-release@v2...v2.6.2

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

• Move the action runtime and bundle target to Node 24
• Update @types/node to the Node 24 line and allow future Dependabot updates
• Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

2.6.2

What's Changed

Other Changes 🔄

• chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @​dependabot[bot] in softprops/action-gh-release#775
• chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by @​dependabot[bot] in softprops/action-gh-release#777
• chore(deps): bump vite from 8.0.0 to 8.0.5 by @​dependabot[bot] in softprops/action-gh-release#781

2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

• fix: preserve discussion category on publish by @​chenrui333 in softprops/action-gh-release#765

2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Commits

• b430933 release: cut v3.0.0 for Node 24 upgrade (#670)
• c2e35e0 chore(deps): bump the npm group across 1 directory with 7 updates (#783)
• 3bb1273 release 2.6.2
• c34030f chore: bump node to 24.14.1
• 8975bd0 chore(deps): bump vite from 8.0.0 to 8.0.5 (#781)
• f71937f chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 (#777)
• 3f0d239 chore(deps): bump picomatch from 4.0.3 to 4.0.4 (#775)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions