Skip to content

Bump actions/download-artifact from 4 to 8 - #4

Merged
singhpratech merged 1 commit into
mainfrom
dependabot/github_actions/actions/download-artifact-8
May 14, 2026
Merged

singhpratech merged 1 commit into
mainfrom
dependabot/github_actions/actions/download-artifact-8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 6, 2026 •

Copy link
Copy Markdown
Contributor

Bumps actions/download-artifact from 4 to 8.

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Apr 6, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@singhpratech
singhpratech enabled auto-merge (squash) May 14, 2026 19:16
@singhpratech
singhpratech merged commit d3731f6 into main May 14, 2026
6 checks passed
@singhpratech
singhpratech deleted the dependabot/github_actions/actions/download-artifact-8 branch May 14, 2026 19:17
singhpratech pushed a commit that referenced this pull request May 14, 2026
User-facing fix:
 - src/updater.cpp::installReleaseInteractive() Linux confirm dialog
   is now file-suffix-aware (closes #12 finding 2). Pre-v0.1.81 it
   hard-coded "move the new AppImage into place" regardless of what
   was downloaded; since v0.1.18 we ship .tar.gz on Linux (no
   AppImage), so tarball users got the wrong instructions for ~60
   releases. (Already on main as cf41e19; this commit bumps the
   version and writes the user-facing notes.)

Dependency refresh:
 - GitHub Actions matrix past the Node 20 cliff: checkout v4→v6 (#5),
   download-artifact v4→v8 (#4), codeql-action v3→v4 (#8).
 - RustCrypto family 0.10→0.11: md-5 / sha1 / sha2 (#6 / #7 / #11).
   compute_hash() uses a hex_encode() helper instead of `format!("{:x}")`
   because Array no longer impls LowerHex. Hex output is byte-identical
   to v0.1.80.
 - sqlformat 0.3.5→0.5.0 (#9) with ..FormatOptions::default() future-
   proofing.
 - libc 0.2.183→0.2.184 (#10).
 (PRs #4 / #5 / #8 / #10 already on main; #13 merged just before this
 commit; #6 / #7 / #9 / #11 auto-closed via the Closes keywords in #13.)

Internal cleanup:
 - cargo fmt sweep across rust-core/ (191 LoC, 5 files, zero behavior).
 - cargo clippy -- -D warnings: 4 pre-existing lints cleared
   (explicit_auto_deref, if_same_then_else, redundant_closure, two
   collapsible_match).

Verification: scripts/release-check.sh green (working-tree-clean check
defers to this commit), ctest 31/31, cargo test 130/130, stale-text-
check.sh 21/21 surfaces match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
singhpratech pushed a commit that referenced this pull request Jul 21, 2026
Version SSOT 0.1.120 -> 0.1.121 (CMakeLists, Cargo.toml/lock, mcpb
manifest). MCP tool count 48 -> 49 (the new select_range verb; tiers now
Read 24 / Act 14 / Write 11) across MCP_TOOL_COUNT and every current-tense
docs surface; v0.1.120 historical references left at 48/v0.1.120.

Docs swept to v0.1.121 (JSON-LD, sticky-CTA, hero badge — tagline
byte-identical except the version — download buttons/sizes, README
release row + installer filenames, docs.html/mcp.html/llms.txt tool
counts + a new select_range Act-table row). New v0.1.121 version card
added above v0.1.120 with the LATEST pill; no gaps in the card history.
release_notes/v0.1.121.md + CHANGELOG [0.1.121] added.

Test fix: protocol.rs asserted a hardcoded "0.1.120" serverInfo.version;
now derives from env!("CARGO_PKG_VERSION") so a version bump never leaves
it stale again.

The 6 fixes themselves are in the prior commits on this branch (e803578
API fixes #1/#3/#4/#5/#6; 65d4f4d charts Qt5.15 polyfill #2).

Local gates: ctest 71/71, Rust default + --features remote green, fmt +
clippy --all-features clean, stale-text-check 62/62, release-check green
(only tree-clean pending, resolved here). PII clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant