Skip to content

fix(deps): update all non-major dependencies#172

Open
we-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#172
we-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@we-renovate

@we-renovate we-renovate Bot commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change OpenSSF
actions/setup-java action minor v5.2.0 → v5.3.0 OpenSSF Scorecard
gradle/actions action minor v6.1.0 → v6.2.0 OpenSSF Scorecard
jdx/mise-action action minor v4.1.0 → v4.2.0 OpenSSF Scorecard
mikepenz/action-junit-report action patch v6.4.1 → v6.4.2 OpenSSF Scorecard
semantic-release patch 25.0.3 → 25.0.5 OpenSSF Scorecard

Release Notes

actions/setup-java (actions/setup-java)

v5.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/setup-java@v5...v5.3.0

gradle/actions (gradle/actions)

v6.2.0

Compare Source

Highlights

This release brings significant behaviour improvements to Enhanced caching, improvements to the generated Job Summary, and a number of correctness and security fixes.

  1. Improved cache-cleanup mechanism. Cleanup of stale files from the Gradle User Home is now faster, and no longer depends on Gradle or a JVM. It works by inspecting the local file state directly, removing the Gradle invocation from the post-build step.
  2. More granular, more stable caching. The local build cache is stored as a separate cache entry, so it can be restored and invalidated independently of the main Gradle User Home entry. Transient Gradle housekeeping files are excluded from the cache, reducing its size and improving stability.
  3. Hide obsolete Job summaries in PR commments: When a new Job summary comment is added to a PR, previous outdated Job summaries are now hidden.
  4. Improved caching report in the job summary. The cache report now uses a single, consistent layout across all cache states and providers. Provider information is integrated directly into the report, and per-entry details are available in an expandable section. (#​985)
  5. Correctness and security fixes. A unique cache key is now used per run attempt, so re-runs no longer collide; the job summary shows the cache key string rather than an internal id; and bundled dependencies have been updated, including a ReDoS fix and a fast-xml CVE fix.
What's Changed
New Contributors

Full Changelog: gradle/actions@v6.1.1...v6.2.0

v6.1.1

Compare Source

This release updates various dependency versions, resolving several reported security vulnerabilities.
No functional changes are included

What's Changed

Full Changelog: gradle/actions@v6.1.0...v6.1.1

jdx/mise-action (jdx/mise-action)

v4.2.0: : Bootstrap mode & wget fallback

Compare Source

This release adds an opt-in bootstrap mode for projects that use mise bootstrap, and makes the action work on runner images that ship wget but not curl.

Added
Bootstrap mode (#​522) by @​jdx

Three new inputs let the action drive mise bootstrap instead of mise install:

- uses: jdx/mise-action@v4
  with:
    bootstrap: true
    bootstrap_skip: "tools,task"   # comma-separated parts to skip
    bootstrap_args: "--yes"        # extra args forwarded to mise bootstrap
  • When bootstrap: true, the action runs mise bootstrap under the existing install gate and sets MISE_EXPERIMENTAL=1 automatically.
  • If a repo mise lock file is present, it runs mise --locked bootstrap, matching the auto-lock behavior introduced for mise install in v4.1.0.
  • install_args cannot be combined with bootstrap: true — the action fails fast and tells you to use bootstrap_skip / bootstrap_args instead, because full bootstrap doesn't support partial tool install args.
  • A new {{bootstrap_hash}} template variable is included in the default cache key (and available in custom cache_key templates) so bootstrap and non-bootstrap configurations don't share caches.

bootstrap_skip relies on mise bootstrap --skip from jdx/mise#10497, so make sure you're on a recent mise version if you use it.

Fixed
  • Fall back to wget when curl is unavailable (#​521) by @​risu729 — The action used to hard-code curl for fetching the mise binary, tar/zip archives, and the latest VERSION lookup, which broke on minimal runner images that only ship wget. It now prefers curl and transparently falls back to wget, preserving the streaming download | tar fast path for .tar.gz and .tar.zst installs on Linux/macOS. Proxy support is unchanged — both tools honor HTTP_PROXY/HTTPS_PROXY. Addresses jdx/mise#10488.
Documentation

Full Changelog: jdx/mise-action@v4.1.0...v4.2.0

mikepenz/action-junit-report (mikepenz/action-junit-report)

v6.4.2

Compare Source

📦 Dependencies
  • chore(deps): lock file maintenance
  • chore(deps): update dependency brace-expansion to v5.0.6
  • chore(deps): update node devdependency non-major updates
  • chore(deps): lock file maintenance
  • chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to dc1a0af
  • chore(deps): update dependency vite to v8.0.14
  • chore(deps): lock file maintenance
  • chore(deps): update node devdependency non-major updates
  • chore(deps): update dependency vite to v8.0.16
  • chore(deps): update node devdependency non-major updates
  • chore(deps): lock file maintenance
Contributors:
semantic-release/semantic-release (semantic-release)

v25.0.5

Compare Source

Bug Fixes

v25.0.4

Compare Source

Bug Fixes
  • code-quality: add missing comma in context object for consistency (493d6cd)

@we-renovate we-renovate Bot force-pushed the renovate/all-minor-patch branch from 716f491 to 0576126 Compare June 21, 2026 00:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate/minor renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants