Skip to content

Bump the github-actions group with 2 updates - #644

Merged
Changyong Gong (chagong) merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-783b37b52c
Oct 24, 2026
Merged

Changyong Gong (chagong) merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-783b37b52c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates: actions/setup-java and actions/create-github-app-token.

Updates actions/setup-java from 6.0.1 to 6.1.0

Release notes

Sourced from actions/setup-java's releases.

v6.1.0

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

Commits
  • b843ebf Support Maven plugin repositories in generated settings.xml (#1286)
  • 2a69be2 feat: support Maven server credential origins (#1282)
  • d0e6e4d chore(deps): bump the monthly-npm-updates group with 13 updates (#1276)
  • b24925b chore(deps): bump undici from 6.28.0 to 6.29.0 (#1274)
  • 47b3648 Support Temurin JEP 322 patch versions like 26.0.2.1+1 (#1270) (#1279)
  • 74920aa Prefer Zulu 4-segment hotfix builds when resolving version ranges (#1278)
  • a78ec39 Stop GPG agent before removing signature-verification home (#1273)
  • 97c5a5e Support Temurin on Linux RISC-V (#1269)
  • 1aa87b6 Preserve compound Liberica build versions from .sdkmanrc (#1268)
  • See full diff in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)
Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 2 updates: [actions/setup-java](https://github.com/actions/setup-java) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `actions/setup-java` from 6.0.1 to 6.1.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@de7274f...b843ebf)

Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Oct 23, 2026
@chagong
Changyong Gong (chagong) merged commit 733899f into main Oct 24, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-783b37b52c branch October 24, 2026 07:13
@chagong

Copy link
Copy Markdown
Contributor

Decision: MERGED

Dependabot PR Manager result

Repository: microsoft/java-debug
Pull request: microsoft/java-debug#644 — Bump the github-actions group with 2 updates
Update: Grouped minor updates: actions/setup-java 6.0.1 -> 6.1.0; actions/create-github-app-token 3.2.0 -> 3.3.0.
Safety assessment: One Dependabot-authored commit; GitHub Actions-only reference gate passed. Both immutable SHAs match release tags; used inputs and Node 24 requirements remain compatible. Actions remain needed for JDK installation and coordinator-token creation. Low risk; post-merge-only token workflow was not exercised by PR CI.
Final state: MERGED at 2026-10-24T07:13:16Z; head 25f1d54; merge state UNKNOWN after merge; review APPROVED; 4/4 required checks successful (Linux, Windows, macOS, license/cla), 0 failed, 0 pending. Failure causality: not applicable.
Actions taken: Audited complete diff, commit provenance, release changes, workflow usage, reviews and current-head CI. Confirmed base ancestry (behind_by=0); no branch recovery, rerun, remediation, commit or push needed. Classic protection read returned HTTP 403; active rules and required-check results were available. Approved as chagong, refreshed gates (CLEAN/APPROVED), and squash-merged with expected head; verified mergedAt and merge commit 733899f.
Reason: None
Next action: None

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant