build(deps): bump the ci_dependencies group across 1 directory with 10 updates

[dependabot]

Bumps the ci_dependencies group with 10 updates in the / directory:

Package	From	To
actions/checkout	6.0.1	6.0.2
docker/build-push-action	6.18.0	6.19.2
docker/login-action	3.6.0	3.7.0
actions/cache	5.0.2	5.0.3
korthout/backport-action	4.0.1	4.1.0
peter-evans/create-pull-request	8.0.0	8.1.0
actions/setup-python	6.1.0	6.2.0
aws-actions/configure-aws-credentials	5.1.1	6.0.0
actions/attest-build-provenance	3.1.0	3.2.0
tj-actions/changed-files	47.0.1	47.0.2

Updates actions/checkout from 6.0.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

v4.2.0

• Add Ref and Commit outputs by @​lucacome in actions/checkout#1180
• Dependency updates by @​dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

v4.1.6

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732

... (truncated)

Commits

• de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
• 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
• See full diff in compare view

Updates docker/build-push-action from 6.18.0 to 6.19.2

Release notes

Sourced from docker/build-push-action's releases.

v6.19.2

• Preserve port in GIT_AUTH_TOKEN host by @​crazy-max in docker/build-push-action#1458

Full Changelog: docker/build-push-action@v6.19.1...v6.19.2

v6.19.1

• Derive GIT_AUTH_TOKEN host from GitHub server URL by @​crazy-max in docker/build-push-action#1456

Full Changelog: docker/build-push-action@v6.19.0...v6.19.1

v6.19.0

• Scope default git auth token to github.com by @​crazy-max in docker/build-push-action#1451
• Bump brace-expansion from 1.1.11 to 1.1.12 in docker/build-push-action#1396
• Bump form-data from 2.5.1 to 2.5.5 in docker/build-push-action#1391
• Bump js-yaml from 3.14.1 to 3.14.2 in docker/build-push-action#1429
• Bump lodash from 4.17.21 to 4.17.23 in docker/build-push-action#1446
• Bump tmp from 0.2.3 to 0.2.4 in docker/build-push-action#1398
• Bump undici from 5.28.4 to 5.29.0 in docker/build-push-action#1397

Full Changelog: docker/build-push-action@v6.18.0...v6.19.0

Commits

• 10e90e3 Merge pull request #1458 from crazy-max/git-auth-port
• 5262538 chore: update generated content
• cd130e4 preserve port in GIT_AUTH_TOKEN host
• 806c751 Merge pull request #1452 from crazy-max/update-yarn
• 601a80b Merge pull request #1456 from crazy-max/auth-token-dyn-host
• 8f7fd7c chore: update generated content
• 710e335 derive GIT_AUTH_TOKEN host from GitHub server URL
• c4ca848 update yarn to 4.9.2
• ee4ca42 Merge pull request #1398 from docker/dependabot/npm_and_yarn/tmp-0.2.4
• f1b3bb5 chore: update generated content
• Additional commits viewable in compare view

Updates docker/login-action from 3.6.0 to 3.7.0

Release notes

Sourced from docker/login-action's releases.

v3.7.0

• Add scope input to set scopes for the authentication token by @​crazy-max in docker/login-action#912
• Add support for AWS European Sovereign Cloud ECR by @​dphi in docker/login-action#914
• Ensure passwords are redacted with registry-auth input by @​crazy-max in docker/login-action#911
• build(deps): bump lodash from 4.17.21 to 4.17.23 in docker/login-action#915

Full Changelog: docker/login-action@v3.6.0...v3.7.0

Commits

• c94ce9f Merge pull request #915 from docker/dependabot/npm_and_yarn/lodash-4.17.23
• 8339c95 Merge pull request #912 from docker/scope
• c83e932 build(deps): bump lodash from 4.17.21 to 4.17.23
• b268aa5 chore: update generated content
• a603229 documentation for scope input
• 7567f92 Add scope input to set scopes for the authentication token
• 0567fa5 Merge pull request #914 from dphi/add-support-for-amazonaws.eu
• f6ef577 feat: add support for AWS European Sovereign Cloud ECR registries
• 916386b Merge pull request #911 from crazy-max/ensure-redact
• 5b3f94a chore: update generated content
• Additional commits viewable in compare view

Updates actions/cache from 5.0.2 to 5.0.3

Release notes

Sourced from actions/cache's releases.

v5.0.3

What's Changed

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

• Bump @actions/cache to v5.0.3 #1692

5.0.1

• Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

4.3.0

• Bump @actions/cache to v4.1.0

... (truncated)

Commits

• cdf6c1f Merge pull request #1695 from actions/Link-/prepare-5.0.3
• a1bee22 Add review for the @​actions/http-client license
• 4695763 Add licensed output
• dc73bb9 Upgrade dependencies and address security warnings
• 345d5c2 Add 5.0.3 builds
• See full diff in compare view

Updates korthout/backport-action from 4.0.1 to 4.1.0

Release notes

Sourced from korthout/backport-action's releases.

Backport-action v4.1.0

What's Changed

@​lenaschoenburg fixed a bug where backport-action thought that [#0](https://github.com/korthout/backport-action/issues/0) was a valid issue ref and used it in ${issue_refs}

• fix: disallow issue numbers with a leading zero by @​lenaschoenburg in korthout/backport-action#552

The project is now bundled with esbuild, uses ESM, and is minified, resulting in a much smaller github action (from ~2MB to ~550kB)

• Minify build artifact with esbuild by @​korthout in korthout/backport-action#555
• Convert project to ESM by @​korthout in korthout/backport-action#557
• Auto update licenses txt by @​korthout in korthout/backport-action#559
• Cleanup leftover sourcemap files by @​korthout in korthout/backport-action#560

Updated dependencies

• Update dependency @​actions/core to v2.0.1 by @​renovate[bot] in korthout/backport-action#526
• Update korthout/backport-action action to v4.0.1 by @​renovate[bot] in korthout/backport-action#528
• Update dependency dedent to v1.7.1 by @​renovate[bot] in korthout/backport-action#530
• Update dependency @​actions/github to v7 by @​renovate[bot] in korthout/backport-action#536
• Update dependency @​actions/core to v2.0.2 by @​renovate[bot] in korthout/backport-action#535
• ci: pin GitHub Action digests to SemVer by @​korthout in korthout/backport-action#539
• Update actions/setup-node action to v6.2.0 by @​renovate[bot] in korthout/backport-action#541
• Update jacobtomlinson/gha-find-replace action to v3.0.5 by @​renovate[bot] in korthout/backport-action#540
• Update dependency prettier to v3.8.0 by @​renovate[bot] in korthout/backport-action#538
• Update EndBug/add-and-commit action to v9.1.4 by @​renovate[bot] in korthout/backport-action#542
• Update madhead/semver-utils action to v4.3.0 by @​renovate[bot] in korthout/backport-action#543
• Update actions/checkout action to v6.0.2 by @​renovate[bot] in korthout/backport-action#544
• Update dependency prettier to v3.8.1 by @​renovate[bot] in korthout/backport-action#545
• Update dependency @​actions/core to v2.0.3 by @​renovate[bot] in korthout/backport-action#548
• Pin dependency esbuild to 0.27.3 by @​renovate[bot] in korthout/backport-action#556
• Update dependency @​actions/github to v9 by @​renovate[bot] in korthout/backport-action#549
• Update dependency @​actions/exec to v3 by @​renovate[bot] in korthout/backport-action#550
• Pin dependency @​octokit/request-error to 7.1.0 by @​renovate[bot] in korthout/backport-action#558
• Update dependency @​actions/core to v3 by @​renovate[bot] in korthout/backport-action#551

Full Changelog: korthout/backport-action@v4.0.1...v4.1.0

Commits

• 01619eb dist: release 4.1.0
• d3fdb6d Merge pull request #560 from korthout/korthout-clean-up-sourcemap-files
• 8d0f84d dist: remove leftover sourcemap files
• d7a50fb Merge pull request #559 from korthout/korthout-auto-update-licenses-txt
• 13771dc dist: build new licenses.txt
• 7a3c8b0 build: update dist/licenses.txt automatically
• 06a6b57 build: move esbuild to a separate file
• 669791a dist: build new artifacts
• 74946b7 Merge pull request #551 from korthout/renovate/actions-core-3.x
• 8b1a415 Merge pull request #558 from korthout/renovate/pin-dependencies
• Additional commits viewable in compare view

Updates peter-evans/create-pull-request from 8.0.0 to 8.1.0

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.1.0

What's Changed

• README.md: bump given GitHub actions to their latest versions by @​deining in peter-evans/create-pull-request#4265
• build(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in peter-evans/create-pull-request#4273
• build(deps-dev): bump the npm group with 2 updates by @​dependabot[bot] in peter-evans/create-pull-request#4274
• build(deps-dev): bump undici from 6.22.0 to 6.23.0 by @​dependabot[bot] in peter-evans/create-pull-request#4284
• Update distribution by @​actions-bot in peter-evans/create-pull-request#4289
• fix: Handle remote prune failures gracefully on self-hosted runners by @​peter-evans in peter-evans/create-pull-request#4295
• feat: add @​octokit/plugin-retry to handle retriable server errors by @​peter-evans in peter-evans/create-pull-request#4298

New Contributors

• @​deining made their first contribution in peter-evans/create-pull-request#4265

Full Changelog: peter-evans/create-pull-request@v8.0.0...v8.1.0

Commits

• c0f553f feat: add @​octokit/plugin-retry to handle retriable server errors (#4298)
• 7000124 fix: Handle remote prune failures gracefully (#4295)
• 34aa40e build: update distribution (#4289)
• 641099d build(deps-dev): bump undici from 6.22.0 to 6.23.0 (#4284)
• 2271f1d build(deps-dev): bump the npm group with 2 updates (#4274)
• 437c31a build(deps): bump the github-actions group with 2 updates (#4273)
• 0979079 docs: update readme
• 5b751cd README.md: bump given GitHub actions to their latest versions (#4265)
• See full diff in compare view

Updates actions/setup-python from 6.1.0 to 6.2.0

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

• Upgrade dependencies to Node 24 compatible versions by @​salmanmkc in actions/setup-python#1259
• Upgrade urllib3 from 2.5.0 to 2.6.3 in /__tests__/data by @​dependabot in actions/setup-python#1253 and actions/setup-python#1264

Full Changelog: actions/setup-python@v6...v6.2.0

Commits

• a309ff8 Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)
• bfe8cc5 Upgrade @​actions dependencies to Node 24 compatible versions (#1259)
• 4f41a90 Bump urllib3 from 2.5.0 to 2.6.0 in /tests/data (#1253)
• See full diff in compare view

Updates aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.0.0

6.0.0 (2026-02-04)

⚠ BREAKING CHANGES

• Update action to use node24 Note this requires GitHub action runner version v2.327.1 or later (#1632) (a7a2c11)

Features

• add support to define transitive tag keys (#1316) (232435c) (930ebd9)

Bug Fixes

• properly output aws-account-id and authenticated-arn when using role-chaining (#1633) (7ceaf96)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.0.0 (2026-02-04)

⚠ BREAKING CHANGES

• Update action to use node24 (#1632) (a7a2c11)

Features

• add support to define transitive tag keys (#1316) (232435c) (930ebd9)

Bug Fixes

• properly output aws-account-id and authenticated-arn when using role-chaining (#1633) (7ceaf96)

5.1.1 (2025-11-24)

Miscellaneous Chores

• release 5.1.1 (56d6a58)

5.1.0 (2025-10-06)

Features

• Add global timeout support (#1487) (1584b8b)
• add no-proxy support (#1482) (dde9b22)
• Improve debug logging in retry logic (#1485) (97ef425)

Bug Fixes

• properly expose getProxyForUrl (introduced in #1482) (#1486) (cea4298)

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

• Cleanup input handling. Changes invalid boolean input behavior (see #1445)

Features

• add skip OIDC option (#1458) (8c45f6b)

... (truncated)

Commits

• 8df5847 chore(deps): bump fast-xml-parser and @​aws-sdk/xml-builder (#1640)
• d22a0f8 chore(deps-dev): bump @​types/node from 25.0.10 to 25.2.0 (#1635)
• f7b8181 chore(main): release 6.0.0 (#1641)
• c367a6a chore: integ tests manual option (#1639)
• 7ceaf96 fix: correct outputs for role chaining (#1633)
• a7a2c11 feat!: update action to use node24 (#1632)
• 6e3375d chore: remove release-please release automation (#1631)
• 98abed7 chore: add workflow_dispatch trigger to release workflow (#1630)
• bf3adbb chore: Update dist
• db43b8b chore: re-run linter
• Additional commits viewable in compare view

Updates actions/attest-build-provenance from 3.1.0 to 3.2.0

Release notes

Sourced from actions/attest-build-provenance's releases.

v3.2.0

What's Changed

• Bump @​actions/core from 1.11.1 to 2.0.1 by @​dependabot[bot] in actions/attest-build-provenance#776
• Add more documentation on Artifact Metadata Storage Records by @​malancas in actions/attest-build-provenance#797
• Update actions/attest to latest version v3.2.0 by @​malancas in actions/attest-build-provenance#812

Full Changelog: actions/attest-build-provenance@v3.1.0...v3.2.0

Commits

• 96278af Update actions/attest to latest version v3.2.0 (#812)
• 6865550 Add more documentation on Artifact Metadata Storage Records (#797)
• 98f3aa9 Bump @​actions/core from 1.11.1 to 2.0.1 (#776)
• 63e6444 Bump github/codeql-action in the actions-minor group (#782)
• 3bc61af Bump the npm-development group with 2 updates (#795)
• 405d0ea Bump the npm-development group with 3 updates (#783)
• See full diff in compare view

Updates tj-actions/changed-files from 47.0.1 to 47.0.2

Release notes

Sourced from tj-actions/changed-files's releases.

v47.0.2

What's Changed

• chore(deps-dev): bump eslint-plugin-jest from 29.2.1 to 29.11.0 by @​dependabot[bot] in tj-actions/changed-files#2751
• chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @​dependabot[bot] in tj-actions/changed-files#2741
• chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @​dependabot[bot] in tj-actions/changed-files#2743
• chore(deps): bump @​actions/core from 2.0.0 to 2.0.2 by @​dependabot[bot] in tj-actions/changed-files#2757
• Updated README.md by @​github-actions[bot] in tj-actions/changed-files#2768
• chore: update dist by @​jackton1 in tj-actions/changed-files#2769
• chore: update matrix-example.yml by @​jackton1 in tj-actions/changed-files#2752
• feat: add support for excluding symlinks and fix bug with commit not found by @​jackton1 in tj-actions/changed-files#2770
• chore(deps): bump github/codeql-action from 4.31.7 to 4.31.10 by @​dependabot[bot] in tj-actions/changed-files#2761
• Updated README.md by @​github-actions[bot] in tj-actions/changed-files#2771
• chore(deps-dev): bump eslint-plugin-jest from 29.11.0 to 29.12.1 by @​dependabot[bot] in tj-actions/changed-files#2756
• chore(deps-dev): bump @​types/lodash from 4.17.21 to 4.17.23 by @​dependabot[bot] in tj-actions/changed-files#2759
• fix: Update test.yml by @​jackton1 in tj-actions/changed-files#2781
• chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] in tj-actions/changed-files#2777
• chore(deps): bump @​stdlib/utils-convert-path from 0.2.2 to 0.2.3 by @​dependabot[bot] in tj-actions/changed-files#2795
• chore(deps-dev): bump @​types/node from 25.0.0 to 25.2.2 by @​dependabot[bot] in tj-actions/changed-files#2793
• chore(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @​dependabot[bot] in tj-actions/changed-files#2766

Full Changelog: tj-actions/changed-files@v47.0.1...v47.0.2

Commits

• 8cba46e chore(deps): bump actions/setup-node from 6.1.0 to 6.2.0 (#2766)
• 925972f chore(deps-dev): bump @​types/node from 25.0.0 to 25.2.2 (#2793)
• a98754b chore(deps): bump @​stdlib/utils-convert-path from 0.2.2 to 0.2.3 (#2795)
• 9c13e73 chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#2777)
• caee9d9 fix: Update test.yml (#2781)
• 16d791c chore(deps-dev): bump @​types/lodash from 4.17.21 to 4.17.23 (#2759)
• 8e056de chore(deps-dev): bump eslint-plugin-jest from 29.11.0 to 29.12.1 (#2756)
• 7d5bbf4 Updated README.md (#2771)
• 078e2bc chore(deps): bump github/codeql-action from 4.31.7 to 4.31.10 (#2761)
• 8c4da28 feat: add support for excluding symlinks and fix bug with commit not found (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions