Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the github-actions group across 1 directory with 6 updates

Open
Number: #161
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: None
Comments: 0
Created: May 26, 2025 at 10:51 PM UTC
(about 1 year ago)
Updated: May 26, 2025 at 10:51 PM UTC
(about 1 year ago)
Labels:
dependencies github_actions
Description:

Bumps the github-actions group with 6 updates in the / directory:

Package From To
shivammathur/setup-php 2.32.0 2.33.0
actions/setup-node 4.3.0 4.4.0
ramsey/composer-install 3.1.0 3.1.1
actions/download-artifact 4.2.1 4.3.0
codecov/codecov-action 5.4.0 5.4.3
slackapi/slack-github-action 2.0.0 2.1.0

Updates shivammathur/setup-php from 2.32.0 to 2.33.0

Release notes

Sourced from shivammathur/setup-php's releases.

2.33.0

Changelog

  • Added support for Arm Ubuntu runners ubuntu-24.04-arm and ubuntu-22.04-arm. (#848)
jobs:
  run:
    runs-on: ubuntu-24.04-arm # or ubuntu-22.04-arm
    steps:
    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: '8.4'

  • Dropped support for Ubuntu 20.04 (ubuntu-20.04) for both GitHub hosted and self-hosted runners. Please migrate your workflows to ubuntu-22.04 or ubuntu-24.04. (#939) Ref: https://github.com/shivammathur/setup-php#github-hosted-runners

  • Improved support for installing PHPUnit around new releases. Now setup-php will fallback to the previous release till new release is available on the phpunit.de website after it is tagged. (#913, #938)

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.4'
    tools: phpunit

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.4'
  env:
    TOOLS_DIR: '/tmp/tools'

- name: Setup PHP
</tr></table>

... (truncated)

Commits
  • cf4cade Drop support for ubuntu-20.04 [skip ci]
  • 316da6e Fix phalcon and zephir_parser support on Windows
  • 34061fa Fix relay support on macOS
  • b7bd9e4 Bump version to 2.33.0
  • 78e1c95 feat: set this via an environment variable instead
  • 310e481 feat: allow tools path directory to be set
  • 42a9487 Fix pdo_oci
  • f5d98d1 Improve support for phalcon5 and zephir_parser
  • 1a94db5 Update dependencies
  • 1489f57 Merge pull request #928 from jg-development/main
  • Additional commits viewable in compare view

Updates actions/setup-node from 4.3.0 to 4.4.0

Release notes

Sourced from actions/setup-node's releases.

v4.4.0

What's Changed

Bug fixes:

Enhancement:

Dependency update:

New Contributors

Full Changelog: https://github.com/actions/setup-node/compare/v4...v4.4.0

Commits

Updates ramsey/composer-install from 3.1.0 to 3.1.1

Release notes

Sourced from ramsey/composer-install's releases.

3.1.1

What's Changed

Full Changelog: https://github.com/ramsey/composer-install/compare/3.1.0...3.1.1

Commits
  • 3cf229d Update branch for codecov badge
  • 8c24b23 Update branch for build badge
  • d7e1308 Protect against unbound variables
  • 3561d3d Use the value of COMPOSER env var, if it exists
  • 705380e Use a .shellcheckrc file
  • 0211e1b Use latest PHP when running composer normalize
  • e527794 docs: fix misspelled parameter name in README
  • See full diff in compare view

Updates actions/download-artifact from 4.2.1 to 4.3.0

Release notes

Sourced from actions/download-artifact's releases.

v4.3.0

What's Changed

New Contributors

Full Changelog: https://github.com/actions/download-artifact/compare/v4.2.1...v4.3.0

Commits
  • d3f86a1 Merge pull request #404 from actions/robherley/v4.3.0
  • fc02353 prep for v4.3.0 release
  • 7745437 Merge pull request #402 from actions/joshmgross/download-by-id-example
  • 84fc7a0 Remove path filters from Check dist workflow
  • 67f2bc3 Fix workflow example for downloading by artifact ID
  • 8ea3c2c Merge pull request #401 from actions/download-by-id
  • d219c63 add supporting unit tests for artifact downloads with ids
  • 54124fb revert getArtifact() changes - for now we have to list and filter by artifa...
  • b83057b bundle
  • 171183c use the same artifactClient.getArtifact structure as seen above in `isSingl...
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 5.4.0 to 5.4.3

Release notes

Sourced from codecov/codecov-action's releases.

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2...v5.4.3

v5.4.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1...v5.4.2

v5.4.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0...v5.4.1

v5.4.1-beta

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0...v5.4.1-beta

Changelog

Sourced from codecov/codecov-action's changelog.

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2

v5.4.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0..v5.4.1

v5.4.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0

... (truncated)

Commits

Updates slackapi/slack-github-action from 2.0.0 to 2.1.0

Release notes

Sourced from slackapi/slack-github-action's releases.

Slack Send v2.1.0

What's changed

This release improves error messages from odd payload parsings. An api option is now also available in inputs to change the destination of data with the method technique.

Read more on the new site for documentation: https://tools.slack.dev/slack-github-action/

👾 Enhancements

🐛 Bug fixes

📚 Documentation

🤖 Dependencies

... (truncated)

Commits
  • b0fa283 Release
  • 47b1876 chore(release): tag version 2.1.0 (#438)
  • ab965e5 fix: include cause of parsing errors in action output logs (#431)
  • c7dafcf fix: require a custom 'api' url to send to instead of absolute urls as a 'met...
  • 4fc20be build(deps): bump codecov/codecov-action from 5.4.0 to 5.4.2 (#437)
  • 54c2553 build(deps): bump actions/create-github-app-token from 1 to 2 (#436)
  • 9472fc6 build(deps): bump axios from 1.8.4 to 1.9.0 (#435)
  • c34c4e8 build(deps-dev): bump typescript from 5.8.2 to 5.8.3 (#434)
  • f473c97 build(deps-dev): bump @​types/node from 22.13.14 to 22.15.3 (#433)
  • aef4dbb docs: update casing of Github to GitHub (#430)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Pull Request Statistics
Commits:
1
Files Changed:
20
Additions:
+33
Deletions:
-33
Package Dependencies
Package:
actions/setup-node
Ecosystem:
actions
Version Change:
4.3.0 → 4.4.0
Update Type:
Minor
Package:
actions/download-artifact
Ecosystem:
actions
Version Change:
4.2.1 → 4.3.0
Update Type:
Minor
Package:
codecov/codecov-action
Ecosystem:
actions
Version Change:
5.4.0 → 5.4.3
Update Type:
Patch
Package:
slackapi/slack-github-action
Ecosystem:
actions
Version Change:
2.0.0 → 2.1.0
Update Type:
Minor
Package:
shivammathur/setup-php
Ecosystem:
actions
Version Change:
2.32.0 → 2.33.0
Update Type:
Minor
Package:
ramsey/composer-install
Ecosystem:
actions
Version Change:
3.1.0 → 3.1.1
Update Type:
Patch
Security Advisories
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
GHSA-jr5f-v2jv-69x6 CVE-2025-27152 HIGH
### Summary A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463 A similar problem tha...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 670618
UUID: 2544922530
Node ID: PR_kwDOFjUyGc6XsG-i
Host: GitHub
Repository: costdev/wordpress-develop
Merge State: Unknown