chore(deps): bump the actions group across 1 directory with 12 updates by dependabot[bot] · Pull Request #1140 · huggingface/optimum-neuron

dependabot · 2026-10-14T01:22:04Z

Bumps the actions group with 12 updates in the / directory:

Package	From	To
actions/checkout	`6.0.3`	`7.0.1`
hashicorp/setup-packer	`3.3.0`	`3.4.0`
aws-actions/configure-aws-credentials	`6.2.0`	`6.3.0`
slackapi/slack-github-action	`3.0.3`	`4.0.0`
docker/setup-buildx-action	`4.1.0`	`4.4.1`
docker/login-action	`4.2.0`	`4.6.0`
docker/build-push-action	`7.2.0`	`7.4.0`
actions/setup-node	`6.5.0`	`7.1.0`
actions/upload-artifact	`7.0.1`	`7.0.2`
huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml	`9fc8a41d7729c424fdb2192f2f85ff63102ec9a3`	`90ddd199e07144a13408c523680c76987343c95f`
trufflesecurity/trufflehog	`3.95.5`	`3.99.0`
actions/stale	`10.4.0`	`11.0.0`

Updates actions/checkout from 6.0.3 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates hashicorp/setup-packer from 3.3.0 to 3.4.0

Release notes

Sourced from hashicorp/setup-packer's releases.

v3.4.0

What's Changed

chore: [Compliance] - PR Template Changes Required by @compliance-pr-automation-bot[bot] in hashicorp/setup-packer#149

fix: Bump form-data from 4.0.5 to 4.0.6 in the npm_and_yarn group across 1 directory by @dependabot[bot] in hashicorp/setup-packer#182

chore: prep release v3.4.0 by @eshan-tripathi in hashicorp/setup-packer#183

New Contributors

@compliance-pr-automation-bot[bot] made their first contribution in hashicorp/setup-packer#149

Full Changelog: hashicorp/setup-packer@v3.3.0...v3.4.0

Commits

ce93c3c prep release v3.4.0 (#183)
b6e01b0 Bump form-data in the npm_and_yarn group across 1 directory (#182)
ba7e395 [Compliance] - PR Template Changes Required (#149)
See full diff in compare view

Updates aws-actions/configure-aws-credentials from 6.2.0 to 6.3.0

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.3.0

6.3.0 (2026-09-11)

Features

add translate-env-variables option (#1961) (57b8365)

v6.2.4

6.2.4 (2026-08-31)

Bug Fixes

account-ids handling, mask proxy as secret in logs (#1943) (aa65264)

skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

v6.2.3

6.2.3 (2026-07-22)

Bug Fixes

attach git credentials before Tag Major Version push (#1877) (9ae780b)

PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

v6.2.2

6.2.2 (2026-07-07)

Miscellaneous Chores

release 6.2.2 (d01d678)

v6.2.1

6.2.1 (2026-06-26)

Bug Fixes

enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.3.0 (2026-09-11)

Features

add translate-env-variables option (#1961) (57b8365)

6.2.4 (2026-08-31)

Bug Fixes

account-ids handling, mask proxy as secret in logs (#1943) (aa65264)

skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

6.2.3 (2026-07-22)

Bug Fixes

attach git credentials before Tag Major Version push (#1877) (9ae780b)

PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

6.2.2 (2026-07-07)

Miscellaneous Chores

release 6.2.2 (d01d678)

6.2.1 (2026-06-26)

Bug Fixes

enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

add additional session tags by default (#1775) (e0ba768)

add more retry logic and better logging (#1764) (540d0c1)

add regex validation to role-session-name (#1765) (e354499)

Allow custom session tags to be passed when assuming a role (#1759) (61f50f6)

expose run id in STS client user-agent (#1774) (29d1be3)

... (truncated)

Commits

e125382 chore(main): release 6.3.0 (#1963)
438100a chore: add link to GH security docs (#1962)
e92ebcc chore: Update dist
57b8365 feat: add translate-env-variables option (#1961)
cc49fa7 chore(docs): README main branch guidance (#1960)
866cb16 chore(deps-dev): bump smol-toml from 1.7.0 to 1.7.2 (#1958)
6782cb1 chore(deps-dev): bump generate-license-file from 4.2.4 to 4.2.5 (#1951)
c20509a chore: Update dist
7a41fc6 chore(deps): bump @aws-sdk/client-sts from 3.1121.0 to 3.1127.0 (#1954)
726b713 chore(deps-dev): bump @biomejs/biome from 2.5.11 to 2.5.12 (#1957)
Additional commits viewable in compare view

Updates slackapi/slack-github-action from 3.0.3 to 4.0.0

Release notes

Sourced from slackapi/slack-github-action's releases.

Slack GitHub Action v4.0.0

Major Changes
b1974f0: build: parse yaml with more strict multiline indentation rules

Internal dependencies of js-yaml@v5 make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.

See the YAML line prefixes spec for the expected indentation rule:
  channel: "C0123"
  text: "first line

second line"


second line"
Patch Changes

654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages

Slack GitHub Action v3.0.5

Patch Changes

96fddbe: fix: revert multiline yaml parsing indentation change

Slack GitHub Action v3.0.4

Patch Changes

fa03fe4: refactor: send webhooks with the @slack/webhook package

Changelog

Sourced from slackapi/slack-github-action's changelog.

slack-github-action

4.0.0

Major Changes
b1974f0: build: parse yaml with more strict multiline indentation rules

Internal dependencies of js-yaml@v5 make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.

See the YAML line prefixes spec for the expected indentation rule:
  channel: "C0123"
  text: "first line

second line"


second line"
Patch Changes

654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages

3.0.5

Patch Changes

96fddbe: fix: revert multiline yaml parsing indentation change

3.0.4

Patch Changes

fa03fe4: refactor: send webhooks with the @slack/webhook package

3.0.3

Patch Changes

66834e4: feat: add instrumentation to address error rates

3.0.2

Patch Changes

79529d7: fix: resolve url.parse deprecation warning for webhook techniques

Commits

dcb1066 chore: release
53861e0 chore: release (#645)
b1974f0 build!: parse yaml with more strict multiline indentation rules (#640)
947ed06 build(deps): bump undici from 7.28.0 to 8.7.0 (#653)
03922a9 chore: track undici-types to the resolved undici version (#652)
31d473e build(deps-dev): bump typescript from 6.0.3 to 7.0.2 (#651)
3ca6997 build(deps-dev): bump sinon and @types/sinon (#649)
26a5ad3 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#647)
5092efb build(deps-dev): bump @biomejs/biome from 2.5.3 to 2.5.4 (#650)
3548c3e build(deps): bump slackapi/slack-github-action from 3.0.3 to 3.0.5 (#646)
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 4.1.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

Skip BuildKit image pre-pulls for explicit endpoints by @crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

Use official Buildx releases for cloud driver by @crazy-max in docker/setup-buildx-action#606

Pull BuildKit image before builder creation by @crazy-max in docker/setup-buildx-action#609

Use shared error helpers for Buildx and Docker commands by @crazy-max in docker/setup-buildx-action#620

Bump @docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614

Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

Bump @docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600

Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585

Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598

Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-buildx-action#572

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-buildx-action#551

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/setup-buildx-action#557 docker/setup-buildx-action#580

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-buildx-action#573

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-buildx-action#576

Bump js-yaml from 4.1.1 to 5.2.0 in docker/setup-buildx-action#562

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-buildx-action#577

Bump tmp from 0.2.5 to 0.2.7 in docker/setup-buildx-action#556

Bump undici from 6.25.0 to 6.27.0 in docker/setup-buildx-action#570

Bump vite from 7.3.2 to 7.3.6 in docker/setup-buildx-action#569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

Commits

f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
e700274 chore: update generated content
3061c91 skip BuildKit image pre-pulls for explicit endpoints
594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
bd6e702 chore: update generated content
6268c9d pull BuildKit image before builder creation
e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
533ed8e build(deps): bump the codeql-actions group with 2 updates
bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
d5079fb chore: update generated content
Additional commits viewable in compare view

Updates docker/login-action from 4.2.0 to 4.6.0

Release notes

Sourced from docker/login-action's releases.

v4.6.0

Harden buildx scoped config path handling by @crazy-max in docker/login-action#1059

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1095.0 in docker/login-action#1051

Bump js-yaml from 5.2.1 to 5.2.2 in docker/login-action#1057

Bump postcss from 8.5.10 to 8.5.22 in docker/login-action#1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Surface Docker Hub OIDC error responses by @crazy-max in docker/login-action#1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Support dhi.io as Docker Hub OIDC registry by @crazy-max in docker/login-action#1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Docker Hub OIDC login support by @crazy-max in docker/login-action#1048

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1091.0 in docker/login-action#1037

Bump @docker/actions-toolkit from 0.92.0 to 0.94.0 in docker/login-action#1044 docker/login-action#1050

Bump brace-expansion from 1.1.13 to 1.1.16 in docker/login-action#1046

Bump js-yaml from 5.2.0 to 5.2.1 in docker/login-action#1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Skip empty registry-auth secret mask by @crazy-max in docker/login-action#1035

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Preserve names in esbuild bundle by @crazy-max in docker/login-action#1022

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 docker/login-action#999 docker/login-action#1030

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/login-action#1023

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/login-action#1029

Bump http-proxy-agent and https-proxy-agent to 9.1.0 in docker/login-action#1017

Bump js-yaml from 4.1.1 to 5.2.0 in docker/login-action#1028

Bump sigstore from 4.1.0 to 4.1.1 in docker/login-action#1031

Bump tmp from 0.2.5 to 0.2.7 in docker/login-action#1002

Bump undici from 6.24.1 to 6.27.0 in docker/login-action#1020

Bump vite from 7.3.3 to 7.3.6 in docker/login-action#1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

Commits

dbcb813 Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
5bcb015 [dependabot skip] chore: update generated content
b30b2f2 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
9087f1e Merge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.2
0009830 [dependabot skip] chore: update generated content
2325523 build(deps): bump js-yaml from 5.2.1 to 5.2.2
4ec1d4a Merge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.22
5fc99ba Merge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...
e512bd5 Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...
a146c91 Merge pull request #1059 from crazy-max/harden-buildx-scope-paths
Additional commits viewable in compare view

Updates docker/build-push-action from 7.2.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

Use the shared error helper for Buildx commands by @crazy-max in docker/build-push-action#1620

Prevent workflow command injection in metadata logs by @crazy-max in docker/build-push-action#1617

Bump @docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592

Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613

Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615

Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611

Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606

Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577

Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

v7.3.0

Preserve names in esbuild bundle by @crazy-max in docker/build-push-action#1567

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/build-push-action#1545 docker/build-push-action#1572

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/build-push-action#1568

Bump js-yaml from 4.1.1 to 4.3.0 in docker/build-push-action#1566

Bump tmp from 0.2.5 to 0.2.7 in docker/build-push-action#1547

Bump undici from 6.24.1 to 6.27.0 in docker/build-push-action#1564

Bump vite from 7.3.2 to 7.3.6 in docker/build-push-action#1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

Commits

c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
459b674 [dependabot skip] chore: update generated content
4dedcb2 chore(deps): Bump @docker/actions-toolkit from 0.99.0 to 0.100.0
379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
9877975 chore: update generated content
7ed0556 use the shared Buildx error summary helper
91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
80dbc86 [dependabot skip] chore: update generated content
50cac3a chore(deps): Bump @docker/actions-toolkit from 0.98.0 to 0.99.0
03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
Additional commits viewable in compare view

Updates actions/setup-node from 6.5.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in actions/setup-node#1421

Support absolute paths in node-version-file by @v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in actions/setup-node#1578

docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in actions/setup-node#1593

Fixed cache recommendation syntax by @SubJunk in actions/setup-node#1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in actions/setup-node#1583

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-node#1584

Pin @types/node to v24 by @v-priyagupta108 in actions/setup-node#1585

Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in actions/setup-node#1599

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-node#1598

Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in actions/setup-node#1590

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-node#1610

Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in actions/setup-node#1602

Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in actions/setup-node#1629

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-node#1616

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-node#1615

Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in actions/setup-node#1631

Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in actions/setup-node#1636

Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in actions/setup-node#1638

Update dependencies and add license files by @v-HarithaVattikuti in actions/setup-node#1642

Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-node#1635

New Contributors

@v-jitenderpalsingh made their first contribution in actions/setup-node#1580

@philip-gai made their first contribution in actions/setup-node#1584

@gperdomor made their first contribution in actions/setup-node#1421

@SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

v7.0.0

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in actions/setup-node#1577

Migrate to ESM and upgrade dependencies by @gowridurgad in actions/setup-node#1574

... (truncated)

Commits

949feb2 Bump eslint from 10.5.0 to 10.11.0 a...
Description has been truncated

Bumps the actions group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.1` | | [hashicorp/setup-packer](https://github.com/hashicorp/setup-packer) | `3.3.0` | `3.4.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.0` | `6.3.0` | | [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `3.0.3` | `4.0.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.4.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.6.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.2.0` | `7.4.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.5.0` | `7.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml](https://github.com/huggingface/doc-builder) | `9fc8a41d7729c424fdb2192f2f85ff63102ec9a3` | `90ddd199e07144a13408c523680c76987343c95f` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.95.5` | `3.99.0` | | [actions/stale](https://github.com/actions/stale) | `10.4.0` | `11.0.0` | Updates `actions/checkout` from 6.0.3 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6.0.3...3d3c42e) Updates `hashicorp/setup-packer` from 3.3.0 to 3.4.0 - [Release notes](https://github.com/hashicorp/setup-packer/releases) - [Commits](hashicorp/setup-packer@3286471...ce93c3c) Updates `aws-actions/configure-aws-credentials` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@v6.2.0...e125382) Updates `slackapi/slack-github-action` from 3.0.3 to 4.0.0 - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md) - [Commits](slackapi/slack-github-action@45a88b9...dcb1066) Updates `docker/setup-buildx-action` from 4.1.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@d7f5e7f...f87e599) Updates `docker/login-action` from 4.2.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...dbcb813) Updates `docker/build-push-action` from 7.2.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@f9f3042...c3c9e26) Updates `actions/setup-node` from 6.5.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@2499707...949feb2) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) Updates `huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml` from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md) - [Commits](huggingface/doc-builder@9fc8a41...90ddd19) Updates `trufflesecurity/trufflehog` from 3.95.5 to 3.99.0 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...b2b0a92) Updates `actions/stale` from 10.4.0 to 11.0.0 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@1e223db...4391f3d) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: hashicorp/setup-packer dependency-version: 3.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: slackapi/slack-github-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml dependency-version: 90ddd199e07144a13408c523680c76987343c95f dependency-type: direct:production dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/stale dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

HuggingFaceDocBuilderDev · 2026-10-14T01:24:43Z

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

Automated hardening of the workflow files flagged on #1140: **action pins** only. Each kind of fix has its own pull request, from a `security/workflow-hardening/pr-1140-*` branch, and any of them can be merged first: the others are rebuilt on top when this one lands. Targets `dependabot/github_actions/actions-b193fe668c`. Files changed, and what changed them: - `.github/workflows/build-ami.yml` — action pins - `.github/workflows/security.yml` — action pins Fixed by this PR: - **HIGH** `unpinned-action` (pinact) — .github/workflows/build-ami.yml:40 - **HIGH** `unpinned-action` (pinact) — .github/workflows/security.yml:18 Pins come from `pinact` and are mechanical: each SHA is the commit the tag already resolves to.  Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>

Automated hardening of the workflow files flagged on #1140: **job permissions** only. Each kind of fix has its own pull request, from a `security/workflow-hardening/pr-1140-*` branch, and any of them can be merged first: the others are rebuilt on top when this one lands. > [!WARNING] > **This changes when the workflow runs and what it can reach.** Both triggers and permissions were rewritten in `.github/workflows/cache_diffusion.yml`, `.github/workflows/cache_llm.yml`, `.github/workflows/doc-build.yml`, `.github/workflows/doc-pr-build.yml`, `.github/workflows/stale.yaml`, `.github/workflows/test_cpu_only.yml`, `.github/workflows/test_inf2_diffusers.yml`, `.github/workflows/test_inf2_export.yml`, `.github/workflows/test_inf2_llm.yml`, `.github/workflows/test_inf2_seq2seq.yml`, `.github/workflows/test_inf2_slow.yml`, `.github/workflows/test_inf2_transformers.yml`, `.github/workflows/test_inf2_vllm.yml`. Read the diff before merging — either one can change what the workflow is able to do. Targets `dependabot/github_actions/actions-b193fe668c`. Files changed, and what changed them: - `.github/workflows/cache_diffusion.yml` — job permissions - `.github/workflows/cache_llm.yml` — job permissions - `.github/workflows/doc-build.yml` — job permissions - `.github/workflows/doc-pr-build.yml` — job permissions - `.github/workflows/stale.yaml` — job permissions - `.github/workflows/test_cpu_only.yml` — job permissions - `.github/workflows/test_inf2_diffusers.yml` — job permissions - `.github/workflows/test_inf2_export.yml` — job permissions - `.github/workflows/test_inf2_llm.yml` — job permissions - `.github/workflows/test_inf2_seq2seq.yml` — job permissions - `.github/workflows/test_inf2_slow.yml` — job permissions - `.github/workflows/test_inf2_transformers.yml` — job permissions - `.github/workflows/test_inf2_vllm.yml` — job permissions Fixed by this PR: - **HIGH** `excessive-permissions` (zizmor) — .github/workflows/stale.yaml:8 - **HIGH** `excessive-permissions` (zizmor) — .github/workflows/stale.yaml:9 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/cache_diffusion.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/cache_diffusion.yml:26 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/cache_diffusion.yml:37 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/cache_llm.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/cache_llm.yml:26 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/cache_llm.yml:37 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/doc-build.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/doc-build.yml:19 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/doc-pr-build.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/doc-pr-build.yml:18 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_cpu_only.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_cpu_only.yml:56 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_cpu_only.yml:67 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_diffusers.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_diffusers.yml:40 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_diffusers.yml:51 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_diffusers.yml:84 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_export.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_export.yml:48 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_export.yml:59 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_llm.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_llm.yml:68 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_llm.yml:79 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_llm.yml:92 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_llm.yml:112 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_llm.yml:147 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_seq2seq.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_seq2seq.yml:36 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_seq2seq.yml:47 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_slow.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_slow.yml:48 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_slow.yml:59 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_transformers.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_transformers.yml:46 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_transformers.yml:57 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_transformers.yml:90 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_vllm.yml:1 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_vllm.yml:70 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_vllm.yml:81 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_vllm.yml:95 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_vllm.yml:123 - **MEDIUM** `excessive-permissions` (zizmor) — .github/workflows/test_inf2_vllm.yml:145 **This does not fix everything.** 5 further finding(s) (5 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet. ### Permissions `.github/workflows/build-ami.yml` | job | granted | why | |---|---|---| | `build-ami` | `contents: read`, `id-token: write` | aws-actions/configure-aws-credentials assumes an AWS role via OIDC, which requires id-token: write, and actions/checkout needs contents: read; Packer and the Slack notification use AWS credentials and a Slack secret, not the GITHUB_TOKEN. | `.github/workflows/build-vllm-image.yml` | job | granted | why | |---|---|---| | `docker` | `contents: read`, `packages: write` | docker/build-push-action pushes images to ghcr.io using the GITHUB_TOKEN login, requiring packages: write; checkout needs contents: read, and no step pushes commits, tags, or releases, so the existing contents: write is unnecessary. | `.github/workflows/cache_diffusion.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local composite action ./.github/actions/sanity-check is not visible here but only receives an HF token, so review it to confirm it makes no GitHub API calls. | | `cache` | `contents: read` | actions/checkout needs contents: read; the local actions install_neuronx_runtime and setup_venv and the Python cache script interact with Hugging Face rather than GitHub, but review those local actions to confirm they make no GitHub API calls. | `.github/workflows/cache_llm.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local ./.github/actions/sanity-check composite action is not visible but receives only an HF token, so verify it makes no GitHub API calls. | | `cache` | `contents: read` | actions/checkout needs contents: read; the local install_neuronx_runtime and setup_venv actions and auto_fill_llm_cache.py appear to only install packages and talk to Hugging Face with HF_TOKEN, so review those local actions for any GitHub token use. | `.github/workflows/doc-build.yml` | job | granted | why | |---|---|---| | `build_documentation` | `contents: read` | actions/checkout needs contents: read; the doc build and push go to the Hugging Face Hub using the HF_DOC_BUILD_PUSH secret, not the GITHUB_TOKEN, and the local composite actions (install_neuronx_runtime, setup_venv) are not visible here but appear to be environment setup, so they are the steps to verify. | `.github/workflows/doc-pr-build.yml` | job | granted | why | |---|---|---| | `build_documentation` | `contents: read` | actions/checkout needs contents: read; the local composite actions (install_neuronx_runtime, setup_venv) are not visible here but are presumably environment setup, and the doc build plus same-run upload-artifact need no token scopes. | `.github/workflows/doc-pr-upload.yml` > `build` was left as it is — The job only calls the external reusable workflow huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml, which is not in this file, so its token use cannot be seen; it likely downloads artifacts from the triggering run (actions: read) and authenticates with the passed secrets rather than GITHUB_TOKEN. `.github/workflows/stale.yaml` | job | granted | why | |---|---|---| | `stale` | `issues: write`, `pull-requests: write` | actions/stale comments on, labels, and closes stale issues and pull requests, which requires issues: write and pull-requests: write; no checkout or other token use is present. | `.github/workflows/test_cpu_only.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local composite action ./.github/actions/sanity-check is not visible here but is given only an HF token, so it likely needs no GitHub token scope — reviewer should confirm. | | `test-cpu` | `contents: read` | actions/checkout needs contents: read; remaining steps are local setup composite actions (install_neuronx_runtime, setup_venv) and pytest runs that use only HF secrets, not the GitHub token. | `.github/workflows/test_inf2_diffusers.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local composite action ./.github/actions/sanity-check is not visible here but receives only an HF token, so verify it makes no GitHub API calls. | | `diffusers-model-tests` | `contents: read` | actions/checkout needs contents: read; remaining steps install dependencies via local composite actions and run pytest with Hugging Face secrets, which do not use the GITHUB_TOKEN. | | `diffusers-cache-cli-tests` | `contents: read` | actions/checkout needs contents: read; remaining steps install dependencies via local composite actions and run pytest with Hugging Face secrets, which do not use the GITHUB_TOKEN. | `.github/workflows/test_inf2_export.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local composite action ./.github/actions/sanity-check is not visible here but receives only an HF token, so it is assumed not to use GITHUB_TOKEN — reviewer should verify it. | | `do-the-job` | `contents: read` | actions/checkout needs contents: read; the local composite actions install_neuronx_runtime and setup_venv are not visible but appear to only install dependencies, and the pytest run uses an HF token, not GITHUB_TOKEN. | `.github/workflows/test_inf2_llm.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local ./.github/actions/sanity-check composite action is not visible here but takes only an HF token and appears to run lint/sanity checks, so the reviewer should confirm it makes no GitHub API calls. | | `llm-export-models` | `contents: read` | actions/checkout needs contents: read; the local ./.github/actions/export_test_models action is not visible here but takes only an HF token and exports models to the Hugging Face Hub, so the reviewer should confirm it does not use the GitHub token. | | `llm-module-tests` | `contents: read` | actions/checkout needs contents: read; the remaining steps are local setup actions (install_neuronx_runtime, setup_venv) and pytest runs that use only HF secrets. | | `llm-model-tests-1` | `contents: read` | actions/checkout needs contents: read; the remaining steps are local setup actions and pytest runs authenticated only to the Hugging Face Hub. | | `llm-model-tests-2` | `contents: read` | actions/checkout needs contents: read; the pytest runs and the optimum-cli hub cache synchronize step use only HF tokens, not the GitHub token. | `.github/workflows/test_inf2_seq2seq.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local composite action ./.github/actions/sanity-check is not visible here but receives an HF token rather than the GITHUB_TOKEN, so reviewers should confirm it makes no GitHub API calls. | | `do-the-job` | `contents: read` | actions/checkout needs contents: read; the local composite actions (install_neuronx_runtime, setup_venv) and the pytest runs use HF secrets, not the GITHUB_TOKEN, so reviewers should confirm those composite actions make no GitHub API calls. | `.github/workflows/test_inf2_slow.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local composite action ./.github/actions/sanity-check is not visible here but is given only an HF token, so verify it makes no GitHub API calls. | | `do-the-job` | `contents: read` | actions/checkout needs contents: read; the remaining steps (local composite actions install_neuronx_runtime and setup_venv, apt/pip installs, pytest) appear to only install software and run tests, so check those local actions make no GitHub API calls. | `.github/workflows/test_inf2_transformers.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local ./.github/actions/sanity-check composite action is not visible but receives only an HF token input, so it is assumed not to use the GITHUB_TOKEN — reviewer should verify that action. | | `transformers-modeling-tests` | `contents: read` | actions/checkout needs contents: read; remaining steps run local setup actions (install_neuronx_runtime, setup_venv) and pytest with an HF secret, which should not touch the GITHUB_TOKEN — check the local actions if unsure. | | `transformers-pipeline-tests` | `contents: read` | actions/checkout needs contents: read; local setup actions and pytest with an HF secret should not use the GITHUB_TOKEN — check the local actions if unsure. | `.github/workflows/test_inf2_vllm.yml` | job | granted | why | |---|---|---| | `sanity` | `contents: read` | actions/checkout needs contents: read; the local composite action ./.github/actions/sanity-check is not visible but is passed only an HF token, so it likely needs no GitHub token scope — reviewer should verify it. | | `vllm-export-models` | `contents: read` | actions/checkout needs contents: read; the local action ./.github/actions/export_test_models takes only an HF token and appears to export models to the Hugging Face hub, not GitHub — reviewer should confirm. | | `vllm-engine-tests` | `contents: read` | actions/checkout needs contents: read; remaining steps install the runtime via local actions and run pytest locally with an HF token, needing no GitHub token scope. | | `vllm-service-tests` | `contents: read` | actions/checkout needs contents: read; remaining steps install dependencies and run pytest locally. | | `vllm-docker-tests` | `contents: read` | actions/checkout needs contents: read; the docker image is built locally via make and tested with pytest, with no push to GHCR. | `.github/workflows/test_sagemaker.yml` | job | granted | why | |---|---|---| | `do-the-job` | `contents: read`, `id-token: write` | aws-actions/configure-aws-credentials assumes an AWS role via OIDC, which requires id-token: write, and actions/checkout needs contents: read; the local composite actions (install_neuronx_runtime, setup_venv) are not visible here but appear to only install software. | Anything not listed above keeps the permissions it had. To measure a job this could not read, add [`GitHubSecurityLab/actions-permissions/monitor`](https://github.com/GitHubSecurityLab/actions-permissions) to it and run the workflow — it reports the minimum the run actually used. Claude decided the scopes each job needs; the YAML was edited by code. Read the table below before merging.  Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 14, 2026

hf-security-analysis Bot added a commit that referenced this pull request Oct 14, 2026

fix(ci): pin actions in workflows flagged on #1140

d2b5f0c

hf-security-analysis Bot mentioned this pull request Oct 14, 2026

fix(ci): pin GitHub Actions to commit SHAs (#1140) #1141

Merged

hf-security-analysis Bot added a commit that referenced this pull request Oct 14, 2026

fix(ci): scope job permissions in workflows flagged on #1140

ed68237

hf-security-analysis Bot mentioned this pull request Oct 14, 2026

fix(ci): scope GITHUB_TOKEN permissions per job (#1140) #1142

Merged

hf-security-analysis Bot added 2 commits October 14, 2026 10:05

Navigation Menu

Repository navigation

chore(deps): bump the actions group across 1 directory with 12 updates - #1140

chore(deps): bump the actions group across 1 directory with 12 updates#1140
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/actions-b193fe668c

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

Uh oh!

HuggingFaceDocBuilderDev commented Oct 14, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v3.4.0

What's Changed

New Contributors

v6.3.0

6.3.0 (2026-09-11)

Features

v6.2.4

6.2.4 (2026-08-31)

Bug Fixes

v6.2.3

6.2.3 (2026-07-22)

Bug Fixes

v6.2.2

6.2.2 (2026-07-07)

Miscellaneous Chores

v6.2.1

6.2.1 (2026-06-26)

Bug Fixes

Changelog

6.3.0 (2026-09-11)

Features

6.2.4 (2026-08-31)

Bug Fixes

6.2.3 (2026-07-22)

Bug Fixes

6.2.2 (2026-07-07)

Miscellaneous Chores

6.2.1 (2026-06-26)

Bug Fixes

6.2.0 (2026-06-01)

Features

Slack GitHub Action v4.0.0

Major Changes

Patch Changes

Slack GitHub Action v3.0.5

Patch Changes

Slack GitHub Action v3.0.4

Patch Changes

slack-github-action

4.0.0

Major Changes

Patch Changes

3.0.5

Patch Changes

3.0.4

Patch Changes

3.0.3

Patch Changes

3.0.2

Patch Changes

v4.4.1

v4.4.0

v4.3.0

v4.2.0

v4.6.0

v4.5.2

v4.5.1

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading