Skip to content

Bump actions/cache from 4 to 6#270

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/cache-6
Closed

Bump actions/cache from 4 to 6#270
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/cache-6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 29, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/cache from 4 to 6.

Release notes

Sourced from actions/cache's releases.

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump actions/cache from 4 to 6
65e39e6 
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4...v6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 29, 2026
vgmello added a commit that referenced this pull request Jul 15, 2026
@vgmello @claude
Apply safe minor/patch dependency bumps from pending Dependabot PRs
b6292f1 
Supersedes Dependabot #280, #279 (partial), #278, #273, #271, #276 (partial),
#281 (Refit only), #263, #264:

- Aspire 13.4.3 -> 13.4.6
- Microsoft.Orleans* 10.1.0 -> 10.2.1 (+ VersionOverride for
  Microsoft.Orleans.Analyzers in AppDomain.Api/AppDomain, matching how
  the source-generator reference is pinned independently of the main
  Orleans package group)
- Google.Protobuf 3.35.0 -> 3.35.1, Grpc.Tools 2.80.0 -> 2.82.0
- OpenTelemetry.Instrumentation.AspNetCore 1.15.2 -> 1.16.0,
  OpenTelemetry.Instrumentation.GrpcCore beta.11 -> beta.13
- Scalar.AspNetCore 2.16.3 -> 2.16.11
- Testcontainers/.Kafka/.PostgreSql 4.12.0 -> 4.13.0
- Refit and Refit.HttpClientFactory 11.0.1 -> 13.1.0 (bumped together;
  HttpClientFactory 13.1.0 has an exact floor on Refit 13.1.0)
- MessagePack 2.5.301 -> 2.5.302 (Aspire 13.4.6's StreamJsonRpc raised
  its own floor)
- @types/node 25.x -> ^26.0.0 in both docs sites, lockfiles regenerated

Intentionally NOT applied, each broke the build in isolation:
- Microsoft.CodeAnalysis.Analyzers/CSharp/Common 5.0.0 -> 5.6.0 (PR #279,
  partial): JasperFx.RuntimeCompiler 4.5.0, pulled in by WolverineFx
  5.39.2, hard-pins Microsoft.CodeAnalysis(.CSharp/.Scripting) to exactly
  5.0.0. This bump is only safe alongside the WolverineFx major upgrade
  (PRs #282/#277), which is being deferred separately.
- NSubstitute 5.3.0 -> 6.0.0 (PR #276, partial): 6.0.0 added proper
  nullable annotations to its public API (e.g. the CallInfo indexer),
  which surfaces CS8600 in ~38 existing call sites across the unit test
  suite that cast `x[0]` and read members into non-nullable properties.
  Needs a real test-code pass, not a drop-in version bump.
- Refitter.MSBuild 2.0.0 -> 2.1.0 (PR #281, partial): fails code
  generation at build time with `MissingMethodException:
  System.Text.ValueStringBuilder.AsSpan()`. Unrelated to the Refit
  runtime library bump above, which is unaffected and kept.

CentralPackageTransitivePinningEnabled (enabled in the prior commit)
caught two additional floor violations these bumps triggered
transitively, both fixed here: MessagePack needed 2.5.302 for Aspire
13.4.6's StreamJsonRpc, matching the earlier fix for a similar Refit
floor issue.

Verified: AppDomain.slnx and libs/Momentum/Momentum.slnx both build with
0 errors. Full test run: 175 passed / 34 failed (all Integration tests
failing solely on missing local Docker, same pre-existing baseline as
before this change) + 604 passed / 0 failed across all libs test
projects.

GitHub Actions bumps (#270 actions/cache, #262 actions/checkout) are
gated behind a PreToolUse hook requiring separate confirmation before
editing .github/workflows/*, not yet applied.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DqMbT47Qhz4ZjjccAEQL6B
vgmello added a commit that referenced this pull request Jul 15, 2026
@vgmello @claude
Bump actions/checkout to v7 and actions/cache to v6
8387e07 
Supersedes Dependabot #262 (actions/checkout v5 -> v7) and
#270 (actions/cache v4 -> v6).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DqMbT47Qhz4ZjjccAEQL6B
@vgmello

vgmello commented Jul 15, 2026

Copy link
Copy Markdown
Owner

Superseded by #284 (actions/cache v4 -> v6 applied as-is).

@vgmello vgmello closed this Jul 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/github_actions/actions/cache-6 branch July 15, 2026 01:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vgmello