Skip to content

build(deps): bump the actions group across 1 directory with 4 updates - #17

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/github_actions/actions-f4e7ace273
Nov 8, 2026
Merged

build(deps): bump the actions group across 1 directory with 4 updates#17
github-actions[bot] merged 1 commit into
mainfrom
dependabot/github_actions/actions-f4e7ace273

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 4 updates in the / directory: hyperpolymath/smtp-notify-action, softprops/action-gh-release, julia-actions/setup-julia and SonarSource/sonarqube-scan-action.

Updates hyperpolymath/smtp-notify-action from 0.5.0 to 0.5.1

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.5.1

Protocol-neutral server_address metadata

server_address is the host input for both SMTP and NNTP, and remained the only input in action.yml still described as SMTP-only ('SMTP server host name'). It now reads:

description: 'Server host name (SMTP or NNTP, per protocol: `protocol`)'

The secure and diagnose folded scalar descriptions were also rewrapped to line width (Reports → reports after the colon in diagnose), and the download URL in action.yml now points to v0.5.1.

Because workflow editors, consumers, and GitHub Marketplace read action.yml from the release tag — and tags are immutable here — this ships as v0.5.1 rather than moving v0.5.0. v0.5.0 remains supported in SECURITY.md since the binary and input surface are unchanged.

For the full NNTP posting (protocol: nntp, newsgroups) and Marketplace readiness notes introduced in the 0.5 series, see v0.5.0 and CHANGELOG.adoc.

Provenance

Zero Zig or Idris2 source files changed between v0.5.0 and v0.5.1. CI rebuilt both static musl binaries from this tag and verified they hash byte-identically to the unchanged SHA-256 pins inside action.yml before publishing. SHA256SUMS is attached:

2683da8f619dd5f310c9f6884da39e825c807c2c86a6319c19aba39b27f9c5c9  smtp-notify-x86_64-linux-musl
a58138308fb9832e1ceb551a12f1b04e591dc38ba5fd336c9acfb3f263161f29  smtp-notify-aarch64-linux-musl
Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

== v0.5.1 — 2026-10-24

A metadata correction, and the release to publish the Marketplace listing from. The binary is byte-identical to v0.5.0's — the two SHA-256 pins are unchanged and re-verified by the release workflow — so v0.5.0 remains supported and correct for anyone already pinned to it. A new tag rather than an edit of the existing one because a tag is immutable here: consumers pin SHAs, and GitHub reads action.yml from the tag, which is the same property that made v0.5.0 necessary in the first place.

NOTE: The v0.5.0 heading below carries a note that the tag had to be pushed immediately after its merge. That was done, and the release published the same day; the note is left in place because it describes a property of the release process, not a pending task.

=== Fixed

  • server_address is no longer described as SMTP-only. The field is the host for both protocols, and the description said 'SMTP server host name' — the last input description that still read as if the news transport did not exist. It now reads 'Server host name (SMTP or NNTP, per protocol: protocol)'. Cosmetic, but workflow editors and consumers read action.yml from the release ref, which is why it ships as a new tag rather than a main-only edit.

=== Changed

  • The asset URL names v0.5.1. The pins do not move: the binary did not change.
  • The secure and diagnose input descriptions were rewrapped to the file's line width (and Reports lowercased after the colon in diagnose).
  • README.adoc's three pinned examples and .github/SECURITY.md's supported-versions table follow the current release.
Commits
  • e384daf fix(action): protocol-neutral server_address wording (needs tag v0.5.1) (#28)
  • See full diff in compare view

Updates softprops/action-gh-release from 3.0.3 to 3.0.4

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.4

  • maintenance release with updated dependencies
Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.4

  • maintenance release with updated dependencies
Commits
  • 8a0cd65 release 3.0.4 (#865)
  • ac01154 chore(deps): bump the npm group across 1 directory with 4 updates (#864)
  • ca4c9d5 chore(deps): bump minimatch and glob (#862)
  • e4a57ae chore(deps): bump undici from 6.29.0 to 6.29.1 (#859)
  • ee55a0e chore(deps): bump vite from 8.3.2 to 8.3.5 (#855)
  • 8d42b22 chore(deps): bump actions/setup-node (#853)
  • 6680cc0 chore(deps): bump the npm group with 3 updates (#851)
  • 4a050ba chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#850)
  • b5a645e chore(deps): bump the npm group with 4 updates (#848)
  • d99a5de chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 (#846)
  • Additional commits viewable in compare view

Updates julia-actions/setup-julia from 2.7.0 to 3.0.3

Release notes

Sourced from julia-actions/setup-julia's releases.

v3.0.3

What's Changed

  • We upgraded from NodeJS 24.13.0 to 24.14.1 (but still stayed on NodeJS v24). We don't expect this to have any breaking effect on users.
  • We updated some of our dependencies.
  • We set a 7-day dependency cooldown on our dependencies.
  • We made changes to our documentation.

New Contributors

Full Changelog

Full Changelog: julia-actions/setup-julia@v3.0.2...v3.0.3

v3.0.2

What's Changed

We fixed a bug (#389).

We also updated our documentation, and we updated a CI dependency.

New Contributors

Full Changelog

Full Changelog: julia-actions/setup-julia@v3.0.1...v3.0.2

v3.0.1

What's Changed

This is a bugfix release that fixes an error seen when using min-minor or min-patch.

Full Changelog

Full Changelog: julia-actions/setup-julia@v3.0.0...v3.0.1

v3.0.0

⚠️ Breaking Changes, and Migration Guide for v2 ⟶ v3

  1. v3 requires Node 24 (compared to v2, which required Node 20).
  2. The behavior of version: min has changed between v2 and v3.
    • In v2, version: min would resolve to the minimum major/minor/patch, e.g. 1.10.0.
    • In v3, version: min resolves to the minimum major/minor but the latest patch, e.g. 1.10.11.
    • If you specifically want the minimum major/minor/patch under v3, you should specify version: min-patch. Note: v3 also adds the alias version: min-minor, which is equivalent to version: min.
  3. v3 will throw an error if x86_64 Julia binaries are requested on Apple Silicon macOS. (Under v2, this was a warning.) Under v3, if you specifically want to run x86_64 Julia binaries on Apple Silicon (under Rosetta 2), you must now opt-in by specifying the force-arch: true input.

... (truncated)

Commits

Updates SonarSource/sonarqube-scan-action from 8.3.0 to 8.4.1

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v8.4.1

What's Changed

New Contributors

Full Changelog: SonarSource/sonarqube-scan-action@v8.4.0...v8.4.1

v8.4.0

What's Changed

New Contributors

Full Changelog: SonarSource/sonarqube-scan-action@v8.3.0...v8.4.0

Commits
  • e805d87 SQSCANGHA-191 Bump scanner-cli version to 8.3.1.16491 (#298)
  • 5e62cf2 SQSCANGHA-189 docs: remove duplicate README logo (#295)
  • afe7ea1 SQSCANGHA-184 Bump undici from 6.28.1 to 6.29.1 (#289)
  • d86a3b3 Update dependency node to v26 (#294)
  • 8a538b9 Run build and build-wrapper compatibility checks every weekday (#292)
  • 4d1dc0c Update SonarScanner CLI to 8.3.0.16463 (#293)
  • ee2d757 SQSCANGHA-185 NO-JIRA Bump madhead/semver-utils from 5.0.0 to 5.1.1 (#290)
  • a7de334 Update dependency rollup to v4.65.0 (#291)
  • 38f0382 Update dependency rollup to v4.64.12 (#288)
  • 54ae8f2 Update dependency rollup to v4.64.9 (#283)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the actions group across 1 directory with 4 updates
9d81c2e 
Bumps the actions group with 4 updates in the / directory: [hyperpolymath/smtp-notify-action](https://github.com/hyperpolymath/smtp-notify-action), [softprops/action-gh-release](https://github.com/softprops/action-gh-release), [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia) and [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action).


Updates `hyperpolymath/smtp-notify-action` from 0.5.0 to 0.5.1
- [Release notes](https://github.com/hyperpolymath/smtp-notify-action/releases)
- [Changelog](https://github.com/hyperpolymath/smtp-notify-action/blob/main/CHANGELOG.adoc)
- [Commits](hyperpolymath/smtp-notify-action@v0.5.0...v0.5.1)

Updates `softprops/action-gh-release` from 3.0.3 to 3.0.4
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v3.0.3...v3.0.4)

Updates `julia-actions/setup-julia` from 2.7.0 to 3.0.3
- [Release notes](https://github.com/julia-actions/setup-julia/releases)
- [Commits](julia-actions/setup-julia@v2.7.0...v3.0.3)

Updates `SonarSource/sonarqube-scan-action` from 8.3.0 to 8.4.1
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](SonarSource/sonarqube-scan-action@v8.3.0...v8.4.1)

---
updated-dependencies:
- dependency-name: hyperpolymath/smtp-notify-action
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: julia-actions/setup-julia
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: SonarSource/sonarqube-scan-action
  dependency-version: 8.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 8, 2026
@coderabbitai

coderabbitai Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 9d4de822-8558-45cb-9faa-6b83269759e4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

github-actions[bot]
github-actions Bot approved these changes Nov 8, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approving Dependabot security update (, version-update:semver-major). Policy: low/moderate security patches/minors only.

@github-actions
github-actions Bot merged commit e2e7be2 into main Nov 8, 2026
28 of 32 checks passed
@sonarqubecloud

sonarqubecloud Bot commented Nov 8, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants