trim only ascii whitespace for branch by aiqiaoy · Pull Request #2521 · actions/checkout

aiqiaoy · 2026-07-15T18:43:06Z

Fixes https://github.com/github/c2c-actions/issues/10325

Copilot

Pull request overview

This PR addresses a potential safety issue where @actions/core’s default whitespace trimming can strip certain Unicode characters (e.g., BOM/NBSP) from the ref input, causing an unintended reclassification of a ref-like value as a commit SHA and impacting the unsafe fork PR checkout guard.

Changes:

Add ASCII-only trimming logic for ref to avoid Unicode character stripping when determining whether the value is a raw SHA.
Extend unit tests to cover BOM-prefixed SHA-like refs and ASCII-whitespace-surrounded SHAs.
Regenerate dist/index.js to include the updated behavior.

Show a summary per file

File	Description
`src/input-helper.ts`	Introduces ASCII-only trimming for SHA detection on `ref` to avoid Unicode-trim surprises.
`__test__/input-helper.test.ts`	Updates `getInput` mocking and adds regression tests for BOM + SHA-like inputs.
`dist/index.js`	Bundled output reflecting the source change.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/3 changed files
Comments generated: 2
Review effort level: Low

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v6.0.3...v7.0.0) - Bump github/codeql-action from 3 to 4 by [@dependabot](https://github.com/dependabot)\[bot] in [#2475](actions/checkout#2475) - Bump actions/setup-node from 4 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#2477](actions/checkout#2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2478](actions/checkout#2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2479](actions/checkout#2479) - Bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2488](actions/checkout#2488) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2476](actions/checkout#2476) - eslint 9 by [@dependabot](https://github.com/dependabot)\[bot] in [#2474](actions/checkout#2474) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2499](actions/checkout#2499) - skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Chicago) - Branch creation - "on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.berry.house/kyleberry/sensorpush_local/pulls/10

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v6.0.3...v7.0.0) - Bump github/codeql-action from 3 to 4 by [@dependabot](https://github.com/dependabot)\[bot] in [#2475](actions/checkout#2475) - Bump actions/setup-node from 4 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#2477](actions/checkout#2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2478](actions/checkout#2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2479](actions/checkout#2479) - Bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2488](actions/checkout#2488) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2476](actions/checkout#2476) - eslint 9 by [@dependabot](https://github.com/dependabot)\[bot] in [#2474](actions/checkout#2474) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2499](actions/checkout#2499) - skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v6...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v5.0.1...v6) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v5...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) ### [`v5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v4.3.1...v5) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Los_Angeles) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Co-authored-by: Renovate Bot <renovate-bot@geekfarm.org> Reviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/9

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v6.0.3...v7.0.0) - Bump github/codeql-action from 3 to 4 by [@dependabot](https://github.com/dependabot)\[bot] in [#2475](actions/checkout#2475) - Bump actions/setup-node from 4 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#2477](actions/checkout#2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2478](actions/checkout#2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2479](actions/checkout#2479) - Bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2488](actions/checkout#2488) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2476](actions/checkout#2476) - eslint 9 by [@dependabot](https://github.com/dependabot)\[bot] in [#2474](actions/checkout#2474) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2499](actions/checkout#2499) - skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.fossy.my.id/bagas/tunnel-please/pulls/159 Co-authored-by: Renovate-Clanker <renovate-bot@fossy.my.id> Co-committed-by: Renovate-Clanker <renovate-bot@fossy.my.id>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | | [actions/checkout](https://github.com/actions/checkout) | action | major | `v6` → `v7` | | [aes-gcm](https://github.com/RustCrypto/AEADs) | dependencies | minor | `0.10` → `0.11` | | debian | stage | patch | `trixie-20260610` → `13` | | debian | final | patch | `trixie-20260610` → `13` | | [elixir](https://elixir-lang.org/) ([source](https://github.com/elixir-lang/elixir)) | | patch | `1.20.1` → `1.20.2` | | [erlang](https://github.com/erlang/otp) | | patch | `29.0.2` → `29.0.3` | | [goreleaser/nfpm](https://github.com/goreleaser/nfpm) | | minor | `v2.46.3` → `v2.47.0` | | [ra](https://hex.pm/packages/ra) ([source](https://github.com/rabbitmq/ra)) | prod | patch | `3.1.8` → `3.1.9` | | registry.k8s.io/sig-storage/csi-resizer | | patch | `v2.2.0` → `v2.2.1` | | [req](https://hex.pm/packages/req) ([source](https://github.com/wojtekmach/req)) | dev | patch | `0.6.2` → `0.6.3` | | [req](https://hex.pm/packages/req) ([source](https://github.com/wojtekmach/req)) | dev | patch | `~> 0.5` → `~> 0.6` | | [rust](https://github.com/rust-lang/rust) | | minor | `1.96.0` → `1.97.1` | | [serde](https://serde.rs) ([source](https://github.com/serde-rs/serde)) | dependencies | patch | `1.0.228` → `1.0.229` | | [stream_data](https://hex.pm/packages/stream_data) ([source](https://github.com/whatyouhide/stream_data)) | dev | minor | `1.3.0` → `1.4.0` | | [stream_data](https://hex.pm/packages/stream_data) ([source](https://github.com/whatyouhide/stream_data)) | prod | minor | `1.3.0` → `1.4.0` | | [thiserror](https://github.com/dtolnay/thiserror) | dependencies | patch | `2.0.18` → `2.0.19` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) ##### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) ##### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v6.0.3...v7.0.0) - Bump github/codeql-action from 3 to 4 by [@dependabot](https://github.com/dependabot)\[bot] in [#2475](actions/checkout#2475) - Bump actions/setup-node from 4 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#2477](actions/checkout#2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2478](actions/checkout#2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2479](actions/checkout#2479) - Bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2488](actions/checkout#2488) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2476](actions/checkout#2476) - eslint 9 by [@dependabot](https://github.com/dependabot)\[bot] in [#2474](actions/checkout#2474) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2499](actions/checkout#2499) - skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) </details> <details> <summary>RustCrypto/AEADs (aes-gcm)</summary> ### [`v0.11.0`](RustCrypto/AEADs@aes-gcm-v0.10.3...aes-gcm-v0.11.0) [Compare Source](RustCrypto/AEADs@aes-gcm-v0.10.3...aes-gcm-v0.11.0) </details> <details> <summary>elixir-lang/elixir (elixir)</summary> ### [`v1.20.2`](https://github.com/elixir-lang/elixir/releases/tag/v1.20.2) [Compare Source](elixir-lang/elixir@v1.20.1...v1.20.2) ##### 1. Enhancements ##### Elixir - \[Kernel.ParallelCompiler] Include per-module type checking times when compiler profiling is enabled with `profile: :time` ##### 2. Bug fixes ##### Elixir - \[Kernel] Fix binary comprehensions with sizes when options such as `:uniq` or `:into` are used - \[Kernel] Improve compiler error messages when `quote` with `unquote` is used inside a pattern or guard - \[Kernel] Restore the compiler optimization of `Kernel.put_elem/3` to emit `:erlang.setelement/3` - \[Module] Fix type checking when applying an empty function type - \[Module] Fix type checking of bitstring patterns that reuse variables - \[Module] Fix type information for `__info__(:struct)` to include the `:required` key - \[Module] Fix type operations on map and optional keys during difference/intersection, including open keys and empty intersections - \[Module] Fix typing of list types involving dynamic or empty lists - \[Module] Include bitstrings as a possible domain key in the type system - \[Module] Preserve file metadata from each clause in type system warnings - \[Module] Fix type warnings for protocol implementations whose protocol module defines additional callbacks - \[Module] Raise clearer type checking errors when an expected struct is removed or redefined during compilation ##### Mix - \[mix compile] Avoid unnecessary umbrella recompilation when a path dependency's manifest is newer but unchanged - \[mix deps.compile] Recompile fetched dependencies when their compile-time environment changes </details> <details> <summary>erlang/otp (erlang)</summary> ### [`v29.0.3`](https://github.com/erlang/otp/releases/tag/OTP-29.0.3): OTP 29.0.3 [Compare Source](erlang/otp@OTP-29.0.2...OTP-29.0.3) ``` Patch Package: OTP 29.0.3 Git Tag: OTP-29.0.3 Date: 2026-07-02 Trouble Report Id: OTP-20173, OTP-20183, OTP-20185, OTP-20186, OTP-20190, OTP-20191, OTP-20194, OTP-20196, OTP-20197, OTP-20198, OTP-20199, OTP-20200, OTP-20201, OTP-20206, OTP-20207, OTP-20208, OTP-20215, OTP-20216, OTP-20217, OTP-20220, OTP-20222, OTP-20226, OTP-20227, OTP-20230, OTP-20231, OTP-20232, OTP-20233 Seq num: CVE-2026-53422, CVE-2026-54886, CVE-2026-54887, CVE-2026-54891, CVE-2026-55950, CVE-2026-55952, ERIERL-1333, GH-SA-7wp4-pc27-2vj9, GH-SA-h9pw-h5w4-h976, PR-11209, PR-11215, PR-11219, PR-11230, PR-11239, PR-11244, PR-11247, PR-11250, PR-11259, PR-11268, PR-11269, PR-11270, PR-11271, PR-11281, PR-11282, PR-11283, PR-11289, PR-11294, PR-11295, PR-11299, PR-11302, PR-11306, PR-11307, PR-11309, PR-11311 System: OTP Release: 29 Application: common_test-1.31.1, compiler-10.0.2, crypto-5.9.1, dialyzer-6.0.2, erts-17.0.3, kernel-11.0.3, public_key-1.21.3, ssh-6.0.2, ssl-11.7.3, stdlib-8.0.2 Predecessor: OTP 29.0.2 ``` Check out the git tag OTP-29.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp\_patch\_apply' tool. For information on install requirements, see descriptions for each application version below. ### common\_test-1.31.1 The common\_test-1.31.1 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - Fixed a crash in ct\_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation. Own Id: OTP-20191\ Related Id(s): ERIERL-1333, [PR-11230] > #### Full runtime dependencies of common\_test-1.31.1 > > compiler-10.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-11.0, observer-2.1, runtime\_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-8.0, syntax\_tools-1.7, tools-3.2, xmerl-1.3.8 ### compiler-10.0.2 The compiler-10.0.2 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed. Own Id: OTP-20222\ Related Id(s): [PR-11219] > #### Full runtime dependencies of compiler-10.0.2 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0 ### crypto-5.9.1 The crypto-5.9.1 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - `crypto:compute_key/4` for `eddh` and `crypto:generate_key/2,3` for `eddh`/`eddsa` now raise an `error:{notsup, Info, Description}` exception instead of returning the atom `notsup` when the underlying cryptolib lacks support. Own Id: OTP-20215\ Related Id(s): [PR-11302] > #### Full runtime dependencies of crypto-5.9.1 > > erts-9.0, kernel-6.0, stdlib-3.9 ### dialyzer-6.0.2 The dialyzer-6.0.2 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - Fix a bug with native record sets in `erl_types.erl` Own Id: OTP-20201 > #### Full runtime dependencies of dialyzer-6.0.2 > > compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax\_tools-2.0 ### erts-17.0.3 The erts-17.0.3 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - Fixed an undefined behavior in the internal `erts_qsort()` function, which could have been the cause of a beam crash seen when updating large maps. Own Id: OTP-20185\ Related Id(s): [PR-11215] - Calculating `bxor` of the largest supported positive integer (`erlang:system_info(max_integer)`) and `-1` would return `[]` instead of a raising a `system_limit` exception. Own Id: OTP-20208\ Related Id(s): [PR-11269] - Fix possible race between `ets:delete/1` and terminating process with a fixation on the same table. Own Id: OTP-20217\ Related Id(s): [PR-11283] - A few code generation issues for the JIT on AArch64 (ARM64) have been fixed. For all platforms, the loader will reject some invalid BEAM files earlier. Own Id: OTP-20226\ Related Id(s): [PR-11299] - On 32-bit computers, the `md5` BIFs would return an incorrect MD5 checksum for data of size 4GiB or more. Own Id: OTP-20227\ Related Id(s): [PR-11289] > #### Full runtime dependencies of erts-17.0.3 > > kernel-9.0, sasl-3.3, stdlib-4.1 ### kernel-11.0.3 The kernel-11.0.3 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - inet:info/1 could crash when calling for a closing (port) socket. Own Id: OTP-20173 - Handling of the truncation bit in `inet_res` has been fixed so it properly falls back to querying over TCP after a truncated UDP reply. This fixes a bug introduced in OTP-28.4.2 - kernel-10.6.2 making a truncated UDP answer fail to parse and never execute the fallback, instead the name resolve operation fails. Own Id: OTP-20199\ Related Id(s): [PR-11247] > #### Full runtime dependencies of kernel-11.0.3 > > crypto-5.8, erts-17.0, sasl-3.0, stdlib-8.0 ### public\_key-1.21.3 The public\_key-1.21.3 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - Hardened OCSP response verification by using constant-time hash comparisons and rejecting responses exceeding 100 KB before ASN.1 decoding. Own Id: OTP-20197\ Related Id(s): [PR-11239] > #### Full runtime dependencies of public\_key-1.21.3 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 ### ssh-6.0.2 The ssh-6.0.2 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - Fixed a path-existence oracle in the SFTP server where `SSH_FXP_REALPATH` requests with `..` components could bypass the configured root directory isolation, allowing an authenticated client to determine whether arbitrary paths exist on the host filesystem. Own Id: OTP-20183\ Related Id(s): [GH-SA-h9pw-h5w4-h976], [PR-11294], [CVE-2026-53422] - Fixed an infinite loop in the SFTP server triggered when receiving `SSH_MSG_CHANNEL_EXTENDED_DATA` on an SFTP channel, which caused the channel process to spin indefinitely on CPU without consuming its message queue. Own Id: OTP-20186\ Related Id(s): [GH-SA-7wp4-pc27-2vj9], [PR-11295], [CVE-2026-54886] - Fixed mlkem768x25519 hybrid key exchange failing intermittently with "incorrect signature" when the X25519 shared secret had a leading zero byte. The shared secret is now encoded as a fixed-width 32-byte string per the specification. Own Id: OTP-20196\ Related Id(s): [PR-11209] - Fixed a race condition where SSH keepalive responses could be matched to unrelated pending requests due to incorrect request queue ordering. Requests are now matched in the order they were sent. Own Id: OTP-20198\ Related Id(s): [PR-11244] - The SFTP server now caps the read length in `SSH_FXP_READ` requests to 255 KiB (matching OpenSSH's `SFTP_MAX_READ_LENGTH`), preventing excessive memory allocation when clients request large reads. Own Id: OTP-20200\ Related Id(s): [PR-11259] - Removed a server-side workaround (OTP-14827, introduced in OTP 20) that accepted SHA-1 user-auth signatures from clients identifying as OpenSSH 7.x when rsa-sha2-\* was negotiated. The workaround addressed a distro-specific build issue in 2017 that no longer exists. Clients affected by this removal (extremely unlikely — requires a 10-year-old unpatched OpenSSH build) will see authentication failures and must upgrade. Own Id: OTP-20206\ Related Id(s): [PR-11268] > #### Full runtime dependencies of ssh-6.0.2 > > crypto-5.7, erts-14.0, kernel-10.3, public\_key-1.6.1, runtime\_tools-1.15.1, stdlib-8.0 ### ssl-11.7.3 Note! The ssl-11.7.3 application *cannot* be applied independently of other applications on an arbitrary OTP 29 installation. ``` On a full OTP 29 installation, also the following runtime dependency has to be satisfied: -- public_key-1.21.1 (first satisfied in OTP 29.0.1) ``` #### Fixed Bugs and Malfunctions - Correct small behavior bugs that occasionally could cause DTLS connection errors, unwanted behavior for legacy DHE\_DSS, hiding of a distribution config error, and possible unorderly process tree shutdown. Own Id: OTP-20190\ Related Id(s): [PR-11250] - Initialize DTLS cookie to random value to avoid DoS attack with forged cookie during startup window. Own Id: OTP-20194\ Related Id(s): [PR-11271], [CVE-2026-54887] - Guard TLS client for MITM injection of application data during "plain-text-window" during handshake. Own Id: OTP-20207\ Related Id(s): [PR-11270], [CVE-2026-54891] - Improve error handling of TLS PSK sending ILLIGAL\_PARMETER alert if binders and PSK-identities are not matched. Also mend recovery mechanism of ticket and session stores to be as resilient as possible to intermediate bugs. Own Id: OTP-20216\ Related Id(s): [PR-11282], [CVE-2026-55952] - Fix race condition that could be used to DoS attack DTLS servers. Own Id: OTP-20220\ Related Id(s): [PR-11306], [CVE-2026-55950] - A TLS-1.3 stateless session ticket with obfuscated\_ticket\_age set to zero was incorrectly accepted without checking the server-side ticket lifetime or the RFC 8446 Section 8.3 freshness window. The server now always validates ticket age using its own timestamp regardless of the client-reported age value. Own Id: OTP-20230\ Related Id(s): [PR-11307] - TLS-1.3 client rejects a second HelloRetryRequest as requiered in RFC 8446 Section 4.1.4 Own Id: OTP-20231\ Related Id(s): [PR-11309] - A busy client node could self-trigger a ticket store crash if unlucky with scheduling if auto mode is used. Own Id: OTP-20232\ Related Id(s): [PR-11311] - Correct spec for CRL API Own Id: OTP-20233\ Related Id(s): [PR-11281] > #### Full runtime dependencies of ssl-11.7.3 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public\_key-1.21.1, runtime\_tools-1.15.1, stdlib-7.0 ### stdlib-8.0.2 The stdlib-8.0.2 application can be applied independently of other applications on a full OTP 29 installation. #### Fixed Bugs and Malfunctions - Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed. Own Id: OTP-20222\ Related Id(s): [PR-11219] > #### Full runtime dependencies of stdlib-8.0.2 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, syntax\_tools-3.2.1 ### Thanks to Cole Christensen, Nick Krichevsky, Stefan Grundmann [cve-2026-53422]: https://nvd.nist.gov/vuln/detail/CVE-2026-53422 [cve-2026-54886]: https://nvd.nist.gov/vuln/detail/CVE-2026-54886 [cve-2026-54887]: https://nvd.nist.gov/vuln/detail/CVE-2026-54887 [cve-2026-54891]: https://nvd.nist.gov/vuln/detail/CVE-2026-54891 [cve-2026-55950]: https://nvd.nist.gov/vuln/detail/CVE-2026-55950 [cve-2026-55952]: https://nvd.nist.gov/vuln/detail/CVE-2026-55952 [gh-sa-7wp4-pc27-2vj9]: https://github.com/erlang/otp/issues/SA-7wp4-pc27-2vj9 [gh-sa-h9pw-h5w4-h976]: https://github.com/erlang/otp/issues/SA-h9pw-h5w4-h976 [pr-11209]: erlang/otp#11209 [pr-11215]: erlang/otp#11215 [pr-11219]: erlang/otp#11219 [pr-11230]: erlang/otp#11230 [pr-11239]: erlang/otp#11239 [pr-11244]: erlang/otp#11244 [pr-11247]: erlang/otp#11247 [pr-11250]: erlang/otp#11250 [pr-11259]: erlang/otp#11259 [pr-11268]: erlang/otp#11268 [pr-11269]: erlang/otp#11269 [pr-11270]: erlang/otp#11270 [pr-11271]: erlang/otp#11271 [pr-11281]: erlang/otp#11281 [pr-11282]: erlang/otp#11282 [pr-11283]: erlang/otp#11283 [pr-11289]: erlang/otp#11289 [pr-11294]: erlang/otp#11294 [pr-11295]: erlang/otp#11295 [pr-11299]: erlang/otp#11299 [pr-11302]: erlang/otp#11302 [pr-11306]: erlang/otp#11306 [pr-11307]: erlang/otp#11307 [pr-11309]: erlang/otp#11309 [pr-11311]: erlang/otp#11311 </details> <details> <summary>goreleaser/nfpm (goreleaser/nfpm)</summary> ### [`v2.47.0`](https://github.com/goreleaser/nfpm/releases/tag/v2.47.0) [Compare Source](goreleaser/nfpm@v2.46.3...v2.47.0) ##### Changelog ##### New Features - [`5c2f7ca`](goreleaser/nfpm@5c2f7ca): feat: RiscV64 support ([#1091](goreleaser/nfpm#1091)) ([@ahqsoftwares](https://github.com/ahqsoftwares)) - [`64b788a`](goreleaser/nfpm@64b788a): feat: add Requires(Post) for RPMS ([#1085](goreleaser/nfpm#1085)) ([@teddelin](https://github.com/teddelin)) - [`dc96073`](goreleaser/nfpm@dc96073): feat: add fang support for styled CLI output ([#1068](goreleaser/nfpm#1068)) ([@caarlos0](https://github.com/caarlos0)) ##### Security updates - [`060af04`](goreleaser/nfpm@060af04): sec(deps): update golang.org/x/crypto ([@caarlos0](https://github.com/caarlos0)) - [`f769631`](goreleaser/nfpm@f769631): sec(deps): update golang.org/x/net ([@caarlos0](https://github.com/caarlos0)) ##### Bug fixes - [`3118ec1`](goreleaser/nfpm@3118ec1): fix: tolerate empty overrides packager clause ([#1080](goreleaser/nfpm#1080)) ([@dleske](https://github.com/dleske)) ##### Dependency updates - [`a2d9ce5`](goreleaser/nfpm@a2d9ce5): feat(deps): go1.26.4 ([@caarlos0](https://github.com/caarlos0)) - [`9b16218`](goreleaser/nfpm@9b16218): fix(deps): bump alpine from 3.23.3 to 3.23.4 ([#1075](goreleaser/nfpm#1075)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`e3102b3`](goreleaser/nfpm@e3102b3): fix(deps): bump alpine from 3.23.3 to 3.23.4 in /testdata/acceptance ([#1076](goreleaser/nfpm#1076)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`62c555e`](goreleaser/nfpm@62c555e): fix(deps): bump alpine from 3.23.4 to 3.24.0 ([#1098](goreleaser/nfpm#1098)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`071ae18`](goreleaser/nfpm@071ae18): fix(deps): bump alpine from 3.23.4 to 3.24.0 in /testdata/acceptance ([#1099](goreleaser/nfpm#1099)) ([@dependabot](https://github.com/dependabot)\[bot]) ##### Build process updates - [`4c62d34`](goreleaser/nfpm@4c62d34): ci(deps): bump github/codeql-action in the actions group ([#1083](goreleaser/nfpm#1083)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`38a05de`](goreleaser/nfpm@38a05de): ci(deps): bump the actions group across 1 directory with 3 updates ([#1096](goreleaser/nfpm#1096)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`6fe4da4`](goreleaser/nfpm@6fe4da4): ci(deps): bump the actions group across 1 directory with 7 updates ([#1095](goreleaser/nfpm#1095)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`cd95f9f`](goreleaser/nfpm@cd95f9f): ci(deps): bump the actions group with 2 updates ([#1078](goreleaser/nfpm#1078)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`8f9cbef`](goreleaser/nfpm@8f9cbef): ci(deps): bump the actions group with 3 updates ([#1090](goreleaser/nfpm#1090)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`9ff0e2f`](goreleaser/nfpm@9ff0e2f): ci(deps): bump the actions group with 4 updates ([#1086](goreleaser/nfpm#1086)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`2ce1832`](goreleaser/nfpm@2ce1832): ci(deps): bump the actions group with 5 updates ([#1074](goreleaser/nfpm#1074)) ([@dependabot](https://github.com/dependabot)\[bot]) - [`1bd2fed`](goreleaser/nfpm@1bd2fed): ci: fix docs build test ([@caarlos0](https://github.com/caarlos0)) - [`4695cdc`](goreleaser/nfpm@4695cdc): ci: fix license check ([@caarlos0](https://github.com/caarlos0)) - [`a40b461`](goreleaser/nfpm@a40b461): ci: update build ([@caarlos0](https://github.com/caarlos0)) ##### Other work - [`d16d75f`](goreleaser/nfpm@d16d75f): docs(deps): update hextra ([@caarlos0](https://github.com/caarlos0)) - [`c6a6a27`](goreleaser/nfpm@c6a6a27): docs: update cmd docs ([@caarlos0](https://github.com/caarlos0)) **Full Changelog**: <goreleaser/nfpm@v2.46.3...v2.47.0> ##### Helping out This release is only possible thanks to **all** the support of **awesome people**! Want to be one of them? You can [sponsor](https://goreleaser.com/sponsors/) or [contribute with code](https://goreleaser.com/contributing). ##### Where to go next? - nFPM is a satellite project from GoReleaser. [Check it out](https://goreleaser.com)! - Find examples and commented usage of all options in our [website](https://nfpm.goreleaser.com/). - Reach out on [Discord](https://discord.gg/RGEBtg8vQ6) and [Twitter](https://twitter.com/goreleaser)! <a href="https://goreleaser.com"><img src="https://raw.githubusercontent.com/goreleaser/artwork/master/opencollective-header.png" with="100%" alt="GoReleaser logo"></a> </details> <details> <summary>rabbitmq/ra (ra)</summary> ### [`v3.1.9`](https://github.com/rabbitmq/ra/releases/tag/v3.1.9) [Compare Source](rabbitmq/ra@v3.1.8...v3.1.9) #### What's Changed - ci: temporary fix for windows-latest changed by [@lshir](https://github.com/lshir) in [#639](rabbitmq/ra#639) - Forward follower's append\_entries\_reply when it already has the snapshot by [@kjnilsson](https://github.com/kjnilsson) in [#641](rabbitmq/ra#641) - Fix stale `last_written`/`pending` state after log truncation, and a snapshot-send regression by [@kjnilsson](https://github.com/kjnilsson) in [#644](rabbitmq/ra#644) - Fix `force_shrink_members_to_current_member/1` typespec by [@visciang](https://github.com/visciang) in [#640](rabbitmq/ra#640) **Full Changelog**: <rabbitmq/ra@v3.1.8...v3.1.9> </details> <details> <summary>wojtekmach/req (req)</summary> ### [`v0.6.3`](https://github.com/wojtekmach/req/blob/HEAD/CHANGELOG.md#v063-2026-07-16) [Compare Source](wojtekmach/req@v0.6.2...v0.6.3) - \[`Req.Test`]: Fix race condition </details> <details> <summary>rust-lang/rust (rust)</summary> ### [`v1.97.1`](https://github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1971-2026-07-16) [Compare Source](rust-lang/rust@1.97.0...1.97.1) \========================== <a id="1.97.1"></a> - [rustc: Fix miscompilation in LLVM optimization](rust-lang/rust#159035) This backports an LLVM submodule bump to include the LLVM-side fix and a revert of the rustc change that is one known trigger for the bug. The rustc side revert should not be strictly necessary but is done out of abundance of caution. ### [`v1.97.0`](https://github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1970-2026-07-09) [Compare Source](rust-lang/rust@1.96.1...1.97.0) \========================== <a id="1.97.0-Language"></a> ## Language - [Consider `Result<T, Uninhabited>` and `ControlFlow<Uninhabited, T>` to be equivalent to `T` for must use lint](rust-lang/rust#148214) - [Add allow-by-default `dead_code_pub_in_binary` lint for unused pub items in binary crates](rust-lang/rust#149509) - [Stabilize the `div32`, `lam-bh`, `lamcas`, `ld-seq-sa` and `scq` target features](rust-lang/rust#154510) - [Stabilize `cfg(target_has_atomic_primitive_alignment)`](rust-lang/rust#155006) - [Allow trailing `self` in imports in more cases](rust-lang/rust#155137) <a id="1.97.0-Platform-Support"></a> ## Platform Support - [nvptx64-nvidia-cuda: drop support for old architectures and old ISAs](rust-lang/rust#152443) Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support. [platform-support-doc]: https://doc.rust-lang.org/rustc/platform-support.html <a id="1.97.0-Stabilized-APIs"></a> ## Stabilized APIs - [`Default for RepeatN`](https://doc.rust-lang.org/stable/std/iter/struct.RepeatN.html#impl-Default-for-RepeatN%3CA%3E) - [`Copy for ffi::FromBytesUntilNulError`](https://doc.rust-lang.org/stable/std/ffi/struct.FromBytesUntilNulError.html#impl-Copy-for-FromBytesUntilNulError) - [`Send for std::fs::File` on UEFI](rust-lang/rust#154003) - [`<{integer}>::isolate_highest_one`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.isolate_highest_one) - [`<{integer}>::isolate_lowest_one`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.isolate_lowest_one) - [`<{integer}>::highest_one`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.highest_one) - [`<{integer}>::lowest_one`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.lowest_one) - [`<{integer}>::bit_width`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.bit_width) - [`NonZero<{integer}>::isolate_highest_one`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.isolate_highest_one) - [`NonZero<{integer}>::isolate_lowest_one`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.isolate_lowest_one) - [`NonZero<{integer}>::highest_one`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.highest_one) - [`NonZero<{integer}>::lowest_one`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.lowest_one) - [`NonZero<{integer}>::bit_width`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.bit_width) These previously stable APIs are now stable in const contexts: - [`char::is_control`](https://doc.rust-lang.org/stable/std/primitive.char.html#method.is_control) <a id="1.97.0-Cargo"></a> ## Cargo - [Stabilize `build.warnings` config.](rust-lang/cargo#16796) This controls how lint warnings from local packages are treated. Useful for enforcing a warning-free build in CI, replacing `-Dwarnings`. [docs](https://doc.rust-lang.org/nightly/cargo/reference/config.html#buildwarnings) - [Stabilize `resolver.lockfile-path` config.](rust-lang/cargo#16694) This allows specifying the path to the lockfile to use when resolving dependencies. Useful when working with read-only source directories. [docs](https://doc.rust-lang.org/nightly/cargo/reference/config.html#resolverlockfile-path) - [cargo-clean: Error when `--target-dir` doesn't look like a Cargo target directory.](rust-lang/cargo#16712) This prevents accidental deletion of non-target directories. - [Add `-m` shorthand for `--manifest-path`](rust-lang/cargo#16858) - [Remove `curl` dependency from `crates-io` crate](rust-lang/cargo#16936) <a id="1.97.0-Rustdoc"></a> ## Rustdoc - [Stabilize `--emit` flag](rust-lang/rust#146220) - [Stabilize `--remap-path-prefix`](rust-lang/rust#155307) <a id="1.97.0-Compatibility-Notes"></a> ## Compatibility Notes - [Emit a future-compatibility warning when relying on `f32: From<{float}>` to constrain `{float}`](rust-lang/rust#139087) - [Rust will use the v0 symbol mangling scheme by default.](rust-lang/rust#151994) This may cause some tools (such as debuggers or profilers, especially with old versions) to fail to demangle symbols emitted by Rust. It may also cause the formatting of text in backtraces to change. - [Prevent deref coercions in `pin!`, in order to prevent unsoundness.](rust-lang/rust#153457) The most likely case where this might impact users is: writing `pin!(x)` where `x` has type `&mut T` will now always correctly produce a value of type `Pin<&mut &mut T>`, instead of sometimes allowing a coercion that produces a value of type `Pin<&mut T>`. This coercion was previously incorrectly allowed since Rust 1.88.0. - [Deprecate `std::char` constants and functions](rust-lang/rust#153873) - [Warn on linker output by default](rust-lang/rust#153968) - [Remove hidden `f64` methods which have been deprecated since 1.0](rust-lang/rust#153975) - [report the `varargs_without_pattern` lint in deps](rust-lang/rust#154599) - [Forbid passing generic arguments to module path segments even if the module reexports a generic enum variant](rust-lang/rust#154971) - [Error on invalid macho `link_section` specifier](rust-lang/rust#155065) - The encoding of certain `enum`s [have changed](rust-lang/rust#155473). This is not a breaking change, as it only applies to `enum`s without layout guarantees, but is noted here as we've seen people impacted from having made assumptions about the layout algorithm. - [Error on `#[export_name = "..."]` where the name is empty](rust-lang/rust#155515) - [Syntactically reject tuple index shorthands in struct patterns](rust-lang/rust#155698) - [validate `#[link_name = "..."]` & `#[link(name = "...")]` parameters](rust-lang/rust#155817) - On Windows, after calling `shutdown` on a socket to shut down the write side, attempting to write to the socket will now produce a `BrokenPipe` error rather than `Other`. [Map `WSAESHUTDOWN` to `io::ErrorKind::BrokenPipe`](rust-lang/rust#156063) ### [`v1.96.1`](https://github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1961-2026-06-30) [Compare Source](rust-lang/rust@1.96.0...1.96.1) \=========================== <a id="1.96.1"></a> - [Cargo: fix timeout/retry behavior](rust-lang/cargo#17131) - [Cargo: apply patches for CVE-2025-15661, CVE-2026-55199, and CVE-2026-55200 to libssh2](rust-lang/cargo#17140) - [rustc: fix miscompilation in MIR optimization](rust-lang/rust#158214) </details> <details> <summary>serde-rs/serde (serde)</summary> ### [`v1.0.229`](https://github.com/serde-rs/serde/releases/tag/v1.0.229) [Compare Source](serde-rs/serde@v1.0.228...v1.0.229) - Update to syn 3 </details> <details> <summary>whatyouhide/stream_data (stream_data)</summary> ### [`v1.4.0`](https://github.com/whatyouhide/stream_data/blob/HEAD/CHANGELOG.md#v140) [Compare Source](whatyouhide/stream_data@v1.3.0...v1.4.0) - Require Elixir 1.14+. - Fix `StreamData.float/1` when min and max are too far apart. - Support choosing between graphemes and codepoints in `StreamData.string/2`. - Shrink `StreamData.one_of/1` towards earlier elements first (instead of smaller values for later elements). </details> <details> <summary>dtolnay/thiserror (thiserror)</summary> ### [`v2.0.19`](https://github.com/dtolnay/thiserror/releases/tag/2.0.19) [Compare Source](dtolnay/thiserror@2.0.18...2.0.19) - Update to syn 3 </details> --- ### Configuration 📅 **Schedule**: (in timezone Pacific/Auckland) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Co-authored-by: James Harton <james@harton.dev> Reviewed-on: https://harton.dev/project-neon/neonfs/pulls/1568

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4.3.1` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v6.0.3...v7.0.0) - Bump github/codeql-action from 3 to 4 by [@dependabot](https://github.com/dependabot)\[bot] in [#2475](actions/checkout#2475) - Bump actions/setup-node from 4 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#2477](actions/checkout#2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2478](actions/checkout#2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2479](actions/checkout#2479) - Bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2488](actions/checkout#2488) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#2476](actions/checkout#2476) - eslint 9 by [@dependabot](https://github.com/dependabot)\[bot] in [#2474](actions/checkout#2474) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2499](actions/checkout#2499) - skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](actions/checkout@v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](actions/checkout#2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](actions/checkout@v6...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](actions/checkout#2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](actions/checkout#2248) ### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](actions/checkout@v5.0.1...v6) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](actions/checkout#2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](actions/checkout#2414) ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](actions/checkout@v5...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) ### [`v5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](actions/checkout@v4.3.1...v5) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/6 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/schemas/pulls/13

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v6.0.3` → `v7.0.1` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7.0.0...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](actions/checkout@v6.1.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](actions/checkout#2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2458](actions/checkout#2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#2460](actions/checkout#2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2461](actions/checkout#2461) - Bump [@actions/core](https://github.com/actions/core) and [@actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://github.com/dependabot)\[bot] in [#2459](actions/checkout#2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://github.com/aiqiaoy) in [#2463](actions/checkout#2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2462](actions/checkout#2462) ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](actions/checkout@v6.0.3...v6.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](actions/checkout#2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](actions/checkout#2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <actions/checkout@v6.0.3...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 12:59 AM, only on Monday ( * 0 * * 1 ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: crowci-bot <admin@crowci.dev> Reviewed-on: https://codefloe.com/crowci/terraform-provider-crowci/pulls/8

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/14 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

@aiqiaoy

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/esphome-config/pulls/4

…(v7.0.0 ➔ v7.0.1) (#117) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/actions/checkout](https://github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | --- ### Release Notes <details> <summary>actions/checkout (https://github.com/actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/117

…#116) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information. --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](actions/checkout@v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](actions/checkout#2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](actions/checkout#2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](actions/checkout#2530) - Various dependency updates </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/116

## Release notes Sourced from actions/checkout's releases. v7.0.1 What's Changed skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates Full Changelog: actions/checkout@v7...v7.0.1 ## Changelog Sourced from actions/checkout's changelog. Changelog v7.0.1 Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 Escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates v7.0.0 Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454 Various dependency updates v6.0.3 Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439 fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414 v6.0.2 Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356 v6.0.1 Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327 v6.0.0 Persist creds to a separate file by @ericsciple in actions/checkout#2286 Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248 v5.0.1 Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301 v5.0.0 Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226 v4.3.1 Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305 v4.3.0 docs: update README.md by @motss in actions/checkout#1971 Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977 Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043 Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044 Update README.md by @nebuk89 in actions/checkout#2194 Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224 Update package dependencies by @salmanmkc in actions/checkout#2236 v4.2.2 url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941 Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946 v4.2.1 Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924 ... (truncated) ## Commits 3d3c42e prep v7.0.1 release (#2531) 2880268 escape values passed to --unset (#2530) 12cd223 trim only ascii whitespace for branch (#2521) 62661c4 skip running unsafe pr check if input is default (#2518) e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499) 631c942 eslint 9 (#2474) 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476) ba09753 Bump actions/checkout from 6 to 7 (#2488) b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479) e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478) Additional commits viewable in compare view ![Dependabot compatibility score](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] <support@github.com> Change-Id: I914f4ea8e4095c49fcb14eace514acdd6ade5864 GitHub-PR: #25 GitHub-Hash: dc980e7da22f9725 Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>

Bumps the github-actions-updates group with 2 updates in the / directory: actions/checkout and lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml. Updates `actions/checkout` from 7.0.0 to 7.0.1 ## Release notes Sourced from actions/checkout's releases. v7.0.1 What's Changed skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates Full Changelog: actions/checkout@v7...v7.0.1 ## Changelog Sourced from actions/checkout's changelog. Changelog v7.0.1 Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 Escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates v7.0.0 Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454 Various dependency updates v6.0.3 Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439 fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414 v6.0.2 Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356 v6.0.1 Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327 v6.0.0 Persist creds to a separate file by @ericsciple in actions/checkout#2286 Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248 v5.0.1 Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301 v5.0.0 Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226 v4.3.1 Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305 v4.3.0 docs: update README.md by @motss in actions/checkout#1971 Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977 Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043 Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044 Update README.md by @nebuk89 in actions/checkout#2194 Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224 Update package dependencies by @salmanmkc in actions/checkout#2236 v4.2.2 url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941 Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946 v4.2.1 Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924 ... (truncated) ## Commits 3d3c42e prep v7.0.1 release (#2531) 2880268 escape values passed to --unset (#2530) 12cd223 trim only ascii whitespace for branch (#2521) 62661c4 skip running unsafe pr check if input is default (#2518) e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499) 631c942 eslint 9 (#2474) 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476) ba09753 Bump actions/checkout from 6 to 7 (#2488) b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479) e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478) Additional commits viewable in compare view Updates `lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml` from 0.7.4 to 0.9.0 ## Release notes Sourced from lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml's releases. v0.9.0 ✨ New Features ✨ Feat: Add build stage to Sonatype Lifecycle scan @ModeSevenIndustrialSolutions (#809) Feat: Add PARALLEL input to rtdv3 verify workflow @ModeSevenIndustrialSolutions (#811) 🔧 Maintenance 🔧 Chore: Bump release-drafter/release-drafter from 7.5.1 to 7.6.0 @dependabot[bot] (#793) Chore: Bump actions/setup-java from 5.5.0 to 5.6.0 @dependabot[bot] (#796) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-jjb-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#794) Chore: Bump lfreleng-actions/zizmor-scan-action from 0.4.0 to 0.5.0 @dependabot[bot] (#795) Chore: Bump github/codeql-action/analyze from 4.37.0 to 4.37.1 @dependabot[bot] (#798) Chore: Bump release-drafter/release-drafter/autolabeler from 7.5.1 to 7.6.0 @dependabot[bot] (#799) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#797) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/gerrit-compose-required-tox-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#801) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-verify-github-actions.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#800) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-sonatype-lifecycle.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#802) Chore: Bump actions/checkout from 7.0.0 to 7.0.1 @dependabot[bot] (#803) Chore: Bump actions/setup-go from 6.5.0 to 7.0.0 @dependabot[bot] (#804) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-packer-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#805) Chore: Bump github/codeql-action/init from 4.37.0 to 4.37.1 @dependabot[bot] (#806) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#807) Chore: pre-commit linting updates @pre-commit-ci[bot] (#808) Links Submit bugs/feature requests v0.8.1 🔧 Maintenance 🔧 Chore: Bump egress allow-list pin to v0.6.0 @ModeSevenIndustrialSolutions (#792) Links Submit bugs/feature requests v0.8.0 ✨ New Features ✨ Feat: Add Gerrit-aware Go SonarQube workflow @ModeSevenIndustrialSolutions (#791) 🔧 Maintenance 🔧 Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml from 0.7.3 to 0.7.4 @dependabot[bot] (#782) ... (truncated) ## Commits eb97ae4 Merge pull request #811 from modeseven-lfit/docs-parallel-toggle a7985cf Feat: Add PARALLEL input to rtdv3 verify workflow 05bf980 Merge pull request #809 from modeseven-lfit/feat/sonatype-lifecycle-build-stage fb765b8 Merge pull request #808 from lfit/pre-commit-ci-update-config bbc6947 Merge pull request #807 from lfit/dependabot/github_actions/lfit/releng-reusa a46b638 Merge pull request #806 from lfit/dependabot/github_actions/github/codeql-act d642a61 Merge pull request #805 from lfit/dependabot/github_actions/lfit/releng-reusa 8a255ea Merge pull request #804 from lfit/dependabot/github_actions/actions/setup-go- dae7013 Merge pull request #803 from lfit/dependabot/github_actions/actions/checkout- b948b21 Merge pull request #802 from lfit/dependabot/github_actions/lfit/releng-reusa Additional commits viewable in compare view Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] <support@github.com> Change-Id: Id728f23904f8374b4a050bab43b96f893cebf5c0 GitHub-PR: #25 GitHub-Hash: 2b42a52dec15688a Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>

Bumps the github-actions-updates group with 2 updates in the / directory: actions/checkout and lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml. Updates `actions/checkout` from 7.0.0 to 7.0.1 ## Release notes Sourced from actions/checkout's releases. v7.0.1 What's Changed skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates Full Changelog: actions/checkout@v7...v7.0.1 ## Changelog Sourced from actions/checkout's changelog. Changelog v7.0.1 Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 Escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates v7.0.0 Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454 Various dependency updates v6.0.3 Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439 fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414 v6.0.2 Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356 v6.0.1 Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327 v6.0.0 Persist creds to a separate file by @ericsciple in actions/checkout#2286 Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248 v5.0.1 Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301 v5.0.0 Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226 v4.3.1 Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305 v4.3.0 docs: update README.md by @motss in actions/checkout#1971 Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977 Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043 Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044 Update README.md by @nebuk89 in actions/checkout#2194 Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224 Update package dependencies by @salmanmkc in actions/checkout#2236 v4.2.2 url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941 Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946 v4.2.1 Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924 ... (truncated) ## Commits 3d3c42e prep v7.0.1 release (#2531) 2880268 escape values passed to --unset (#2530) 12cd223 trim only ascii whitespace for branch (#2521) 62661c4 skip running unsafe pr check if input is default (#2518) e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499) 631c942 eslint 9 (#2474) 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476) ba09753 Bump actions/checkout from 6 to 7 (#2488) b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479) e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478) Additional commits viewable in compare view Updates `lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml` from 0.7.4 to 0.9.1 ## Release notes Sourced from lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml's releases. v0.9.1 🔧 Maintenance 🔧 Chore: Bump sonarqube-cloud-scan-action to v1.2.1 @ModeSevenIndustrialSolutions (#810) Links Submit bugs/feature requests v0.9.0 ✨ New Features ✨ Feat: Add build stage to Sonatype Lifecycle scan @ModeSevenIndustrialSolutions (#809) Feat: Add PARALLEL input to rtdv3 verify workflow @ModeSevenIndustrialSolutions (#811) 🔧 Maintenance 🔧 Chore: Bump release-drafter/release-drafter from 7.5.1 to 7.6.0 @dependabot[bot] (#793) Chore: Bump actions/setup-java from 5.5.0 to 5.6.0 @dependabot[bot] (#796) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-jjb-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#794) Chore: Bump lfreleng-actions/zizmor-scan-action from 0.4.0 to 0.5.0 @dependabot[bot] (#795) Chore: Bump github/codeql-action/analyze from 4.37.0 to 4.37.1 @dependabot[bot] (#798) Chore: Bump release-drafter/release-drafter/autolabeler from 7.5.1 to 7.6.0 @dependabot[bot] (#799) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#797) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/gerrit-compose-required-tox-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#801) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-verify-github-actions.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#800) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-sonatype-lifecycle.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#802) Chore: Bump actions/checkout from 7.0.0 to 7.0.1 @dependabot[bot] (#803) Chore: Bump actions/setup-go from 6.5.0 to 7.0.0 @dependabot[bot] (#804) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-packer-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#805) Chore: Bump github/codeql-action/init from 4.37.0 to 4.37.1 @dependabot[bot] (#806) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#807) Chore: pre-commit linting updates @pre-commit-ci[bot] (#808) Links Submit bugs/feature requests v0.8.1 🔧 Maintenance 🔧 Chore: Bump egress allow-list pin to v0.6.0 @ModeSevenIndustrialSolutions (#792) Links Submit bugs/feature requests ... (truncated) ## Commits 973bba8 Merge pull request #810 from modeseven-lfit/chore/bump-sonarqube-scan-v1.2.1 eb97ae4 Merge pull request #811 from modeseven-lfit/docs-parallel-toggle a7985cf Feat: Add PARALLEL input to rtdv3 verify workflow 05bf980 Merge pull request #809 from modeseven-lfit/feat/sonatype-lifecycle-build-stage fb765b8 Merge pull request #808 from lfit/pre-commit-ci-update-config bbc6947 Merge pull request #807 from lfit/dependabot/github_actions/lfit/releng-reusa a46b638 Merge pull request #806 from lfit/dependabot/github_actions/github/codeql-act d642a61 Merge pull request #805 from lfit/dependabot/github_actions/lfit/releng-reusa 8a255ea Merge pull request #804 from lfit/dependabot/github_actions/actions/setup-go- dae7013 Merge pull request #803 from lfit/dependabot/github_actions/actions/checkout- Additional commits viewable in compare view Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] <support@github.com> Change-Id: I8bf6cbe49e36ef0e394c47401694bf49209ce669 GitHub-PR: #24 GitHub-Hash: 1446dca6b080d969 Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>

Bumps the github-actions-updates group with 2 updates in the / directory: actions/checkout and lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml. Updates `actions/checkout` from 7.0.0 to 7.0.1 ## Release notes Sourced from actions/checkout's releases. v7.0.1 What's Changed skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates Full Changelog: actions/checkout@v7...v7.0.1 ## Commits See full diff in compare view Updates `lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml` from 0.7.4 to 0.9.1 ## Release notes Sourced from lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml's releases. v0.9.1 🔧 Maintenance 🔧 Chore: Bump sonarqube-cloud-scan-action to v1.2.1 @ModeSevenIndustrialSolutions (#810) Links Submit bugs/feature requests v0.9.0 ✨ New Features ✨ Feat: Add build stage to Sonatype Lifecycle scan @ModeSevenIndustrialSolutions (#809) Feat: Add PARALLEL input to rtdv3 verify workflow @ModeSevenIndustrialSolutions (#811) 🔧 Maintenance 🔧 Chore: Bump release-drafter/release-drafter from 7.5.1 to 7.6.0 @dependabot[bot] (#793) Chore: Bump actions/setup-java from 5.5.0 to 5.6.0 @dependabot[bot] (#796) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-jjb-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#794) Chore: Bump lfreleng-actions/zizmor-scan-action from 0.4.0 to 0.5.0 @dependabot[bot] (#795) Chore: Bump github/codeql-action/analyze from 4.37.0 to 4.37.1 @dependabot[bot] (#798) Chore: Bump release-drafter/release-drafter/autolabeler from 7.5.1 to 7.6.0 @dependabot[bot] (#799) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#797) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/gerrit-compose-required-tox-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#801) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-verify-github-actions.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#800) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-sonatype-lifecycle.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#802) Chore: Bump actions/checkout from 7.0.0 to 7.0.1 @dependabot[bot] (#803) Chore: Bump actions/setup-go from 6.5.0 to 7.0.0 @dependabot[bot] (#804) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-packer-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#805) Chore: Bump github/codeql-action/init from 4.37.0 to 4.37.1 @dependabot[bot] (#806) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#807) Chore: pre-commit linting updates @pre-commit-ci[bot] (#808) Links Submit bugs/feature requests v0.8.1 🔧 Maintenance 🔧 Chore: Bump egress allow-list pin to v0.6.0 @ModeSevenIndustrialSolutions (#792) Links Submit bugs/feature requests ... (truncated) ## Commits 973bba8 Merge pull request #810 from modeseven-lfit/chore/bump-sonarqube-scan-v1.2.1 eb97ae4 Merge pull request #811 from modeseven-lfit/docs-parallel-toggle a7985cf Feat: Add PARALLEL input to rtdv3 verify workflow 05bf980 Merge pull request #809 from modeseven-lfit/feat/sonatype-lifecycle-build-stage fb765b8 Merge pull request #808 from lfit/pre-commit-ci-update-config bbc6947 Merge pull request #807 from lfit/dependabot/github_actions/lfit/releng-reusa a46b638 Merge pull request #806 from lfit/dependabot/github_actions/github/codeql-act d642a61 Merge pull request #805 from lfit/dependabot/github_actions/lfit/releng-reusa 8a255ea Merge pull request #804 from lfit/dependabot/github_actions/actions/setup-go- dae7013 Merge pull request #803 from lfit/dependabot/github_actions/actions/checkout- Additional commits viewable in compare view Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] <support@github.com> Change-Id: I5ff4f65ca15c798ecbf416cdc4efd99b0584a83a GitHub-PR: #44 GitHub-Hash: 411bc1659a0efec3 Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>

Bumps the github-actions-updates group with 2 updates in the / directory: actions/checkout and lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml. Updates `actions/checkout` from 7.0.0 to 7.0.1 ## Release notes Sourced from actions/checkout's releases. v7.0.1 What's Changed skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates Full Changelog: actions/checkout@v7...v7.0.1 ## Changelog Sourced from actions/checkout's changelog. Changelog v7.0.1 Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 Escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates v7.0.0 Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454 Various dependency updates v6.0.3 Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439 fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414 v6.0.2 Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356 v6.0.1 Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327 v6.0.0 Persist creds to a separate file by @ericsciple in actions/checkout#2286 Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248 v5.0.1 Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301 v5.0.0 Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226 v4.3.1 Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305 v4.3.0 docs: update README.md by @motss in actions/checkout#1971 Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977 Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043 Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044 Update README.md by @nebuk89 in actions/checkout#2194 Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224 Update package dependencies by @salmanmkc in actions/checkout#2236 v4.2.2 url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941 Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946 v4.2.1 Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924 ... (truncated) ## Commits 3d3c42e prep v7.0.1 release (#2531) 2880268 escape values passed to --unset (#2530) 12cd223 trim only ascii whitespace for branch (#2521) 62661c4 skip running unsafe pr check if input is default (#2518) e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499) 631c942 eslint 9 (#2474) 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476) ba09753 Bump actions/checkout from 6 to 7 (#2488) b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479) e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478) Additional commits viewable in compare view Updates `lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml` from 0.7.4 to 0.9.1 ## Release notes Sourced from lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml's releases. v0.9.1 🔧 Maintenance 🔧 Chore: Bump sonarqube-cloud-scan-action to v1.2.1 @ModeSevenIndustrialSolutions (#810) Links Submit bugs/feature requests v0.9.0 ✨ New Features ✨ Feat: Add build stage to Sonatype Lifecycle scan @ModeSevenIndustrialSolutions (#809) Feat: Add PARALLEL input to rtdv3 verify workflow @ModeSevenIndustrialSolutions (#811) 🔧 Maintenance 🔧 Chore: Bump release-drafter/release-drafter from 7.5.1 to 7.6.0 @dependabot[bot] (#793) Chore: Bump actions/setup-java from 5.5.0 to 5.6.0 @dependabot[bot] (#796) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-jjb-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#794) Chore: Bump lfreleng-actions/zizmor-scan-action from 0.4.0 to 0.5.0 @dependabot[bot] (#795) Chore: Bump github/codeql-action/analyze from 4.37.0 to 4.37.1 @dependabot[bot] (#798) Chore: Bump release-drafter/release-drafter/autolabeler from 7.5.1 to 7.6.0 @dependabot[bot] (#799) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#797) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/gerrit-compose-required-tox-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#801) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-verify-github-actions.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#800) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-sonatype-lifecycle.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#802) Chore: Bump actions/checkout from 7.0.0 to 7.0.1 @dependabot[bot] (#803) Chore: Bump actions/setup-go from 6.5.0 to 7.0.0 @dependabot[bot] (#804) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-packer-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#805) Chore: Bump github/codeql-action/init from 4.37.0 to 4.37.1 @dependabot[bot] (#806) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#807) Chore: pre-commit linting updates @pre-commit-ci[bot] (#808) Links Submit bugs/feature requests v0.8.1 🔧 Maintenance 🔧 Chore: Bump egress allow-list pin to v0.6.0 @ModeSevenIndustrialSolutions (#792) Links Submit bugs/feature requests ... (truncated) ## Commits 973bba8 Merge pull request #810 from modeseven-lfit/chore/bump-sonarqube-scan-v1.2.1 eb97ae4 Merge pull request #811 from modeseven-lfit/docs-parallel-toggle a7985cf Feat: Add PARALLEL input to rtdv3 verify workflow 05bf980 Merge pull request #809 from modeseven-lfit/feat/sonatype-lifecycle-build-stage fb765b8 Merge pull request #808 from lfit/pre-commit-ci-update-config bbc6947 Merge pull request #807 from lfit/dependabot/github_actions/lfit/releng-reusa a46b638 Merge pull request #806 from lfit/dependabot/github_actions/github/codeql-act d642a61 Merge pull request #805 from lfit/dependabot/github_actions/lfit/releng-reusa 8a255ea Merge pull request #804 from lfit/dependabot/github_actions/actions/setup-go- dae7013 Merge pull request #803 from lfit/dependabot/github_actions/actions/checkout- Additional commits viewable in compare view Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] <support@github.com> Change-Id: Iab813dc3a9432e165fc1436a830c4c74c2cecd06 GitHub-PR: #30 GitHub-Hash: 6b693f1e5dace0e5 Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>

Bumps the github-actions-updates group with 2 updates: actions/checkout and lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml. Updates `actions/checkout` from 7.0.0 to 7.0.1 ## Release notes Sourced from actions/checkout's releases. v7.0.1 What's Changed skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518 trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521 escape values passed to --unset by @aiqiaoy in actions/checkout#2530 Various dependency updates Full Changelog: actions/checkout@v7...v7.0.1 ## Commits See full diff in compare view Updates `lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml` from 0.7.4 to 0.9.1 ## Release notes Sourced from lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml's releases. v0.9.1 🔧 Maintenance 🔧 Chore: Bump sonarqube-cloud-scan-action to v1.2.1 @ModeSevenIndustrialSolutions (#810) Links Submit bugs/feature requests v0.9.0 ✨ New Features ✨ Feat: Add build stage to Sonatype Lifecycle scan @ModeSevenIndustrialSolutions (#809) Feat: Add PARALLEL input to rtdv3 verify workflow @ModeSevenIndustrialSolutions (#811) 🔧 Maintenance 🔧 Chore: Bump release-drafter/release-drafter from 7.5.1 to 7.6.0 @dependabot[bot] (#793) Chore: Bump actions/setup-java from 5.5.0 to 5.6.0 @dependabot[bot] (#796) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-jjb-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#794) Chore: Bump lfreleng-actions/zizmor-scan-action from 0.4.0 to 0.5.0 @dependabot[bot] (#795) Chore: Bump github/codeql-action/analyze from 4.37.0 to 4.37.1 @dependabot[bot] (#798) Chore: Bump release-drafter/release-drafter/autolabeler from 7.5.1 to 7.6.0 @dependabot[bot] (#799) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#797) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/gerrit-compose-required-tox-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#801) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-verify-github-actions.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#800) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-sonatype-lifecycle.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#802) Chore: Bump actions/checkout from 7.0.0 to 7.0.1 @dependabot[bot] (#803) Chore: Bump actions/setup-go from 6.5.0 to 7.0.0 @dependabot[bot] (#804) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-packer-verify.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#805) Chore: Bump github/codeql-action/init from 4.37.0 to 4.37.1 @dependabot[bot] (#806) Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml from 0.7.4 to 0.8.1 @dependabot[bot] (#807) Chore: pre-commit linting updates @pre-commit-ci[bot] (#808) Links Submit bugs/feature requests v0.8.1 🔧 Maintenance 🔧 Chore: Bump egress allow-list pin to v0.6.0 @ModeSevenIndustrialSolutions (#792) Links Submit bugs/feature requests ... (truncated) ## Commits 973bba8 Merge pull request #810 from modeseven-lfit/chore/bump-sonarqube-scan-v1.2.1 eb97ae4 Merge pull request #811 from modeseven-lfit/docs-parallel-toggle a7985cf Feat: Add PARALLEL input to rtdv3 verify workflow 05bf980 Merge pull request #809 from modeseven-lfit/feat/sonatype-lifecycle-build-stage fb765b8 Merge pull request #808 from lfit/pre-commit-ci-update-config bbc6947 Merge pull request #807 from lfit/dependabot/github_actions/lfit/releng-reusa a46b638 Merge pull request #806 from lfit/dependabot/github_actions/github/codeql-act d642a61 Merge pull request #805 from lfit/dependabot/github_actions/lfit/releng-reusa 8a255ea Merge pull request #804 from lfit/dependabot/github_actions/actions/setup-go- dae7013 Merge pull request #803 from lfit/dependabot/github_actions/actions/checkout- Additional commits viewable in compare view Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] <support@github.com> Change-Id: Ie099926a3fd171c33e6b4f42ad99ee737162ac61 GitHub-PR: #29 GitHub-Hash: 5902be5c6ccd883d Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>

trim only ascii whitespace for branch

3e2a278

Copilot AI review requested due to automatic review settings July 15, 2026 18:43

Copilot started reviewing on behalf of aiqiaoy July 15, 2026 18:43 View session

rebuild

11d1522

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Comment thread src/input-helper.ts

Comment thread __test__/input-helper.test.ts

rentziass approved these changes Jul 15, 2026

View reviewed changes

aiqiaoy merged commit 12cd223 into main Jul 15, 2026
12 checks passed

aiqiaoy deleted the aiqiaoy/unicode-branch branch July 15, 2026 19:05

This was referenced Jul 16, 2026

backport fixes to releases-v5 #2523

Merged

backport fixes to releases-v4 #2524

Merged

backport fixes to releases-v3 #2525

Merged

backport fixes to releases-v2 #2526

Merged

backport fixes to releases-v6 #2527

Merged

clanker-claude Bot mentioned this pull request Jul 20, 2026

ci(github-action): update action actions/checkout ( 9c091bb ➔ 3d3c42e ) mrdynamo/home-ops#2381

Merged

1 task

github-actions Bot mentioned this pull request Jul 20, 2026

Update actions/checkout action to v7.0.1 claytono/go-unifi-mcp#153

Open

1 task

github-actions Bot mentioned this pull request Jul 20, 2026

chore(deps): update actions/checkout digest to 3d3c42e MikaelElkiaer/nvim-config#174

Merged

1 task

github-actions Bot mentioned this pull request Jul 22, 2026

chore(deps): update actions/checkout action to v7.0.1 tailor-platform/sdk#1838

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

trim only ascii whitespace for branch#2521

trim only ascii whitespace for branch#2521
aiqiaoy merged 2 commits into
mainfrom
aiqiaoy/unicode-branch

aiqiaoy commented Jul 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

aiqiaoy commented Jul 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants