[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	pin	v5 → v5.1.0
actions/checkout	action	pin	v6 → v6.1.0
actions/create-github-app-token	action	pin	v2 → v2.2.2
actions/upload-artifact	action	pin	v6 → v6.0.0
cachix/install-nix-action	action	pin	v31 → v31.11.3
changesets/action	action	pin	v1 → v1.9.0
daun/playwright-report-summary	action	pin	v3 → v3.11.0
docker/login-action	action	pin	v3 → v3.7.0
nix-community/cache-nix-action	action	pin	v6 → v6.1.3

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Playwright test results

 5 passed
 1 skipped

Details

 6 tests across 3 suites
 8 seconds
 7759fb6

Skipped tests

pop-out.spec.ts › Popping Out › user can pop out and cancel to return to normal schedule

[GraemeF]

Review: held, not merged.

What this changes. Eight of the nine actions move from a major tag such as @v6 to an exact tag such as @v6.1.0. Each major tag already resolves to the same commit as the exact tag, so nothing that runs changes. actions/cache is the one real update: it moves from a v5.0.x sha to caa2961, which is the tagged v5.1.0 commit in actions/cache. The v5.0.3 to v5.1.0 notes cover dependency and security bumps and read-only cache handling. They change no inputs, permissions or secrets this repo uses.

Release ages. Every pinned release is older than three days. The youngest is cachix/install-nix-action v31.11.2, published 2026-10-14. CI's build, check-changes and bun.nix checks are green.

Why it is held. The dependency baseline requires every workflow action to be pinned to a full commit sha. This PR pins eight actions to version tags, which are still mutable, so merging it would not bring the workflows to the baseline. The fix is a Renovate config change, such as extending helpers:pinGitHubActionDigests, after which Renovate will propose sha pins in place of this PR. That config change goes through a normal reviewed PR. This hold ends when it lands.

[GraemeF]

Review: held, not merged.

This pull request pins nine actions to exact version tags. Every action here should be pinned to a full commit sha with its version in a comment, and a tag can be moved after the fact. So this cannot merge as it stands.

What was checked:

• All nine releases are older than three days. The newest is cachix/install-nix-action v31.11.2, published 2026-10-14.
• Seven of the floating major tags already resolve to the version pinned here, so the run-time behaviour of those does not change.
• actions/cache moves from the sha that was commented v5 to caa29612, which is the tagged v5.1.0 release in actions/cache. That is a real minor update.
• nix-community/cache-nix-action keeps the same sha. Only its comment changes, from v6 to v6.1.3, which matches the tag.
• No permission or secret use changes in the workflows.

#1328 adds helpers:pinGitHubActionDigests to the Renovate config. This pull request is held until that lands. Renovate should then rewrite it to pin digests, and it will be reviewed again as it stands then.

[GraemeF]

Review: held, not merged.

This pull request moves the workflows' action references from a floating major tag to an exact version tag, for example actions/checkout@v6 to actions/checkout@v6.1.0.

What was checked

• Every new tag resolves to the same commit that its floating major tag points at today. So, apart from actions/cache, nothing that runs in CI changes.
• actions/cache moves from the v5.0.1 commit to caa2961, which is the v5.1.0 tag. Its only change is handling read-only cache access. That is safe here.
• Every release is well over three days old. The newest is cachix/install-nix-action v31.11.2, published on 2026-10-14.
• CI is green on the head commit. Renovate's stability check is still pending.

Why it is held

The organisation's dependency baseline requires every action to be pinned to a full commit SHA. This pull request pins to version tags, and a tag can be moved. Merging it would rewrite about thirty references that would then need re-pinning. The fix belongs in renovate.json, by adding helpers:pinGitHubActionDigests. Renovate should then replace this pull request with one that pins to SHAs.

The hold ends when that config change lands. This pull request will then be reviewed afresh, or closed if Renovate has superseded it.

[GraemeF]

Review: held, not merged.

This pull request pins most actions to an exact version tag such as actions/checkout@v6.1.0. The dependency baseline requires every workflow action to be pinned to a full commit sha. A tag can be moved, so a tag pin does not meet it. Only actions/cache and nix-community/cache-nix-action end up sha-pinned, and both already were.

What was checked:

• Every new tag exists in its action's own repository, and the two sha pins match their tagged releases (actions/cache v5.1.0 is caa2961, cache-nix-action v6.1.3 is 135667e).
• Every release is older than three days. The newest is cachix/install-nix-action v31.11.2, published 2026-10-14.
• CI is green on the head commit. Renovate's own stability check is still pending.

The fix is in the repo's Renovate config rather than in this branch. Adding the helpers:pinGitHubActionDigests preset to renovate.json makes Renovate pin each action to its commit sha with the version as a comment. Renovate should then rewrite this pull request as digest pins, and the hold ends when that config change lands.

[GraemeF]

Review: held, not merged.

This pull request pins the workflows' actions to exact version tags, such as actions/checkout@v6.1.0. A tag is mutable, so this is not a pin. The repo's workflows must pin every action to a full commit SHA, with the version in a trailing comment, as .github/actions/setup/action.yml already does.

What was checked:

• The diff touches only uses: lines in five workflow files, and the single commit is Renovate's.
• actions/cache@caa296126883cff596d87d8935842f9db880ef25 is the v5.1.0 tag in actions/cache. Its only change is handling read-only cache access, which does not affect how this repo uses it.
• The cache-nix-action change is a comment only. The SHA does not move.
• Every other change swaps one tag for another, so the workflows stay unpinned.

The cause is the Renovate config. config:js-app pins versions, but nothing asks Renovate to pin action digests. Adding helpers:pinGitHubActionDigests to .github/renovate.json would make Renovate replace this pull request with SHA pins.

The update is held until that config change lands. Renovate should then close or replace this pull request.

[GraemeF]

Review: still held, not merged.

Renovate pushed a new commit at 03:03 UTC today. It moves cachix/install-nix-action to 31.11.3. That release came out on 2026-10-22 and only updates the bundled Nix from 2.35.3 to 2.35.4, which removes the compromised eMudhra certificates from the installer. It turns three days old on 2026-10-25 at 22:14 UTC.

The other references are unchanged since the last review. They are still version tags rather than commit SHAs.

The hold still ends when #1328 merges. That pull request adds helpers:pinGitHubActionDigests to the Renovate config. Its checks are green and it is waiting for review. After it merges, Renovate should rewrite this pull request as digest pins, and it will be reviewed again then.