Skip to content

ci(deps): bump the actions group across 1 directory with 6 updates#354

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/actions-66a40ff891
Open

ci(deps): bump the actions group across 1 directory with 6 updates#354
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/actions-66a40ff891

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 30, 2026

Bumps the actions group with 6 updates in the / directory:

Package From To
jaywcjlove/coverage-badges-cli 2.2.0 2.3.0
actions/deploy-pages 4.0.5 5.0.0
anthropics/claude-code-action 1.0.34 1.0.82
dependabot/fetch-metadata 2.5.0 3.0.0
lewagon/wait-on-check-action 1.5.0 1.6.0
actions/setup-node 6.2.0 6.3.0

Updates jaywcjlove/coverage-badges-cli from 2.2.0 to 2.3.0

Release notes

Sourced from jaywcjlove/coverage-badges-cli's releases.

v2.3.0

Buy me a coffee

Documentation v2.3.0: https://raw.githack.com/jaywcjlove/coverage-badges-cli/0031c7f/index.html
Comparing Changes: jaywcjlove/coverage-badges-cli@v2.3.0...v2.3.0

Commits

Updates actions/deploy-pages from 4.0.5 to 5.0.0

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.0

Changelog


See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits
  • cd2ce8f Merge pull request #404 from salmanmkc/node24
  • bbe2a95 Update Node.js version to 24.x
  • 854d7aa Merge pull request #374 from actions/Jcambass-patch-1
  • 306bb81 Add workflow file for publishing releases to immutable action package
  • b742728 Merge pull request #360 from actions/dependabot/npm_and_yarn/npm_and_yarn-513...
  • 7273294 Bump braces in the npm_and_yarn group across 1 directory
  • 963791f Merge pull request #361 from actions/dependabot-friendly
  • 51bb29d Make the rebuild dist workflow safer for Dependabot
  • 89f3d10 Merge pull request #358 from actions/dependabot/npm_and_yarn/non-breaking-cha...
  • bce7355 Merge branch 'main' into dependabot/npm_and_yarn/non-breaking-changes-99c12deb21
  • Additional commits viewable in compare view

Updates anthropics/claude-code-action from 1.0.34 to 1.0.82

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.82

Full Changelog: anthropics/claude-code-action@v1...v1.0.82

v1.0.81

Full Changelog: anthropics/claude-code-action@v1...v1.0.81

v1.0.80

Full Changelog: anthropics/claude-code-action@v1...v1.0.80

v1.0.79

Full Changelog: anthropics/claude-code-action@v1...v1.0.79

v1.0.78

Full Changelog: anthropics/claude-code-action@v1...v1.0.78

v1.0.77

Subprocess environment scrubbing for untrusted-input workflows

Workflows that configure allowed_non_write_users now automatically get CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1, which makes Claude Code (v2.1.79+) strip Anthropic and cloud provider credentials from the environment of subprocesses it spawns (Bash tool, hooks, MCP stdio servers). The parent Claude process keeps these vars for its own API calls — only child subprocess environments are scrubbed.

Why: Workflows that process untrusted input (issue triage, PR review from non-write users) are exposed to prompt injection. A malicious issue body could trick Claude into running a Bash command that reads $ANTHROPIC_API_KEY via shell expansion and leaks it through an observable side channel. Scrubbing the subprocess environment removes the read primitive entirely.

What's scrubbed: Anthropic auth tokens, cloud provider credentials, GitHub Actions OIDC and runtime tokens, OTEL auth headers.

What's kept: GITHUB_TOKEN / GH_TOKEN — so wrapper scripts can still call the GitHub API.

Opt out: Set CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: "0" at the job or step level if your workflow legitimately needs a subprocess to inherit these credentials.

No action required for most users — if you've configured allowed_non_write_users, scrubbing is now on automatically. If your workflow breaks because a subprocess expected inherited credentials, re-inject them explicitly (e.g., via MCP server env: config) or use the opt-out.

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.76...v1.0.77

v1.0.76

Full Changelog: anthropics/claude-code-action@v1...v1.0.76

v1.0.75

Full Changelog: anthropics/claude-code-action@v1...v1.0.75

v1.0.74

What's Changed

Full Changelog: anthropics/claude-code-action@v1...v1.0.74

v1.0.73

... (truncated)

Commits
  • 88c168b chore: bump Claude Code to 2.1.87 and Agent SDK to 0.2.87
  • e7b588b chore: bump Claude Code to 2.1.86 and Agent SDK to 0.2.86
  • 094bd24 chore: bump Claude Code to 2.1.85 and Agent SDK to 0.2.85
  • 3ac52d0 chore: bump Claude Code to 2.1.84 and Agent SDK to 0.2.84
  • 0ee1bee chore: bump Claude Code to 2.1.83 and Agent SDK to 0.2.83
  • ff9acae Auto-set subprocess env scrub when allowed_non_write_users is configured (#1093)
  • 6062f37 chore: bump Claude Code to 2.1.81 and Agent SDK to 0.2.81
  • df37d2f chore: bump Claude Code to 2.1.79 and Agent SDK to 0.2.79
  • 1ba15be Remove redundant git status/diff/log from tag mode allowlist (#1075)
  • 9ddce40 Restore .claude/ and .mcp.json from PR base branch before CLI runs (#1066)
  • Additional commits viewable in compare view

Updates dependabot/fetch-metadata from 2.5.0 to 3.0.0

Release notes

Sourced from dependabot/fetch-metadata's releases.

v3.0.0

What's Changed

New Contributors

Full Changelog: dependabot/fetch-metadata@v2...v3.0.0

Commits
  • ffa630c v3.0.0 (#686)
  • ec8fff2 Merge pull request #674 from dependabot/dependabot/npm_and_yarn/picomatch-2.3.2
  • caf48bd build(deps-dev): bump picomatch from 2.3.1 to 2.3.2
  • 13d8274 Upgrade @​actions/github to ^9.0.0 and @​octokit/request-error to ^7.1.0 (#678)
  • b603099 Upgrade @​actions/core from ^1.11.1 to ^3.0.0 (#677)
  • c5dc5b1 Enable noImplicitAny in tsconfig.json (#684)
  • a183f3c Add typecheck step to CI (#685)
  • 5e17564 Remove skipLibCheck from tsconfig.json (#683)
  • bb56eeb Switch tsconfig module resolution to bundler (#682)
  • 3632e3d Remove vestigial outDir from tsconfig.json (#681)
  • Additional commits viewable in compare view

Updates lewagon/wait-on-check-action from 1.5.0 to 1.6.0

Release notes

Sourced from lewagon/wait-on-check-action's releases.

v1.6.0

Added

  • Add checks-discovery-timeout option (#139)
Changelog

Sourced from lewagon/wait-on-check-action's changelog.

Changelog

Unreleased

v1.6.0 - 2026-03-29

Added

  • Add checks-discovery-timeout option

v1.5.0 - 2026-01-25

Added

  • Add fail-on-no-checks option

Fixed

  • Bump rexml to 3.4.2

v1.4.1 - 2025-09-21

Fixed

  • Linux ARM64 support

v1.4.0 - 2025-06-27

Added

  • Add class docs
  • Add frozen_string_literal comments

Removed

  • Remove OpenStruct instances
  • Remove Double quotes
  • Remove Double assertions
  • Remove allow_any uses

Fixed

  • Fix spelling mistakes
  • Fix CI gem caching
  • Convert config.verbose to a boolean
  • Bump rexml to 3.3.9

v1.3.4 - 2024-04-04

Commits

Updates actions/setup-node from 6.2.0 to 6.3.0

Release notes

Sourced from actions/setup-node's releases.

v6.3.0

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Update GitHub Actions across CI, release, and automation workflows to latest versions to improve reliability and align with Node 24 runtimes. Includes major bumps and small quality-of-life fixes.

  • Dependencies
    • actions/deploy-pages 4.0.5 → 5.0.0 (Node 24)
    • dependabot/fetch-metadata 2.5.0 → 3.0.0 (Node 24; esbuild tooling)
    • anthropics/claude-code-action 1.0.34 → 1.0.89 (subprocess env scrubbing when allowed_non_write_users is set)
    • lewagon/wait-on-check-action 1.5.0 → 1.6.0 (adds checks-discovery-timeout)
    • actions/setup-node 6.2.0 → 6.3.0 (supports devEngines.runtime, minor fixes)
    • jaywcjlove/coverage-badges-cli 2.2.0 → 2.3.0 (Node 24)

Written for commit 31ddbce. Summary will update on new commits.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Mar 30, 2026

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from a team as a code owner March 30, 2026 08:18
@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Mar 30, 2026

Open in StackBlitz

npm i https://pkg.pr.new/@stackone/ai@354

commit: 31ddbce

Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

Bumps the actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [jaywcjlove/coverage-badges-cli](https://github.com/jaywcjlove/coverage-badges-cli) | `2.2.0` | `2.3.0` |
| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4.0.5` | `5.0.0` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.34` | `1.0.82` |
| [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `2.5.0` | `3.0.0` |
| [lewagon/wait-on-check-action](https://github.com/lewagon/wait-on-check-action) | `1.5.0` | `1.6.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.3.0` |



Updates `jaywcjlove/coverage-badges-cli` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/jaywcjlove/coverage-badges-cli/releases)
- [Commits](jaywcjlove/coverage-badges-cli@4e8975a...998665f)

Updates `actions/deploy-pages` from 4.0.5 to 5.0.0
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@d6db901...cd2ce8f)

Updates `anthropics/claude-code-action` from 1.0.34 to 1.0.82
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@f642197...88c168b)

Updates `dependabot/fetch-metadata` from 2.5.0 to 3.0.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@21025c7...ffa630c)

Updates `lewagon/wait-on-check-action` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/lewagon/wait-on-check-action/releases)
- [Changelog](https://github.com/lewagon/wait-on-check-action/blob/master/CHANGELOG.md)
- [Commits](lewagon/wait-on-check-action@7404930...a08fbe2)

Updates `actions/setup-node` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@6044e13...53b8394)

---
updated-dependencies:
- dependency-name: jaywcjlove/coverage-badges-cli
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/deploy-pages
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: lewagon/wait-on-check-action
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings April 6, 2026 08:14
@dependabot dependabot bot force-pushed the dependabot/github_actions/actions-66a40ff891 branch from f311b15 to 31ddbce Compare April 6, 2026 08:14
@dependabot dependabot bot review requested due to automatic review settings April 6, 2026 08:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants