chore(deps): bump on-headers and compression in /webapp - #243
Merged
mergify[bot] merged 1 commit intoAug 15, 2025
Conversation
Bumps [on-headers](https://github.com/jshttp/on-headers) and [compression](https://github.com/expressjs/compression). These dependencies needed to be updated together. Updates `on-headers` from 1.0.2 to 1.1.0 - [Release notes](https://github.com/jshttp/on-headers/releases) - [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md) - [Commits](jshttp/on-headers@v1.0.2...v1.1.0) Updates `compression` from 1.8.0 to 1.8.1 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@1.8.0...v1.8.1) --- updated-dependencies: - dependency-name: on-headers dependency-version: 1.1.0 dependency-type: indirect - dependency-name: compression dependency-version: 1.8.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
robfrank
approved these changes
Aug 15, 2025
mergify Bot
added a commit
that referenced
this pull request
Aug 15, 2025
…rom 3.7.0 to 3.13.0 [skip ci] Bumps [org.openrewrite.recipe:rewrite-logging-frameworks](https://github.com/openrewrite/rewrite-logging-frameworks) from 3.7.0 to 3.13.0. Release notes *Sourced from [org.openrewrite.recipe:rewrite-logging-frameworks's releases](https://github.com/openrewrite/rewrite-logging-frameworks/releases).* > 3.13.0 > ------ > > What's Changed > -------------- > > * Recipe to migrate deprecated JBoss Logging calls by [`@pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-logging-frameworks#245](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/245) > * Add `ArgumentArrayToVarargs` for logger methods that take a var args argument Object array by [`@timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-logging-frameworks#246](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/246) > * Avoid unsafe changes in `JulParameterizedArguments` when `JavaType.Array` argument is not a `J.NewArray` by [`@pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-logging-frameworks#244](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/244) > * LoggerLevelArgumentToMethod for JBoss Logging by [`@pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-logging-frameworks#243](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/243) > * Add a recipe to migrate from JBoss Logging to SLF4J by [`@pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-logging-frameworks#241](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/241) > * rename settings.local.json to settings.json by [`@zieka`](https://github.com/zieka) in [openrewrite/rewrite-logging-frameworks#247](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/247) > > **Full Changelog**: <openrewrite/rewrite-logging-frameworks@v3.12.0...v3.13.0> > > 3.12.1 > ------ > > What's Changed > -------------- > > * OpenRewrite v8.59.1: <https://github.com/openrewrite/rewrite> > > **Full Changelog**: <https://github.com/openrewrite/rewrite-logging-frameworks> > > 3.12.0 > ------ > > What's Changed > -------------- > > * Adds filePattern parameter to ConfigureLoggerLevel by [`@simonzn`](https://github.com/simonzn) in [openrewrite/rewrite-logging-frameworks#235](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/235) > * Handle existing arguments alongside concatenation in `ParameterizedLogging` by [`@timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-logging-frameworks#237](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/237) > * Fix Slf4jLogShouldBeConstant to preserve format specifiers with width, alignment, and precision. by [`@motlin`](https://github.com/motlin) in [openrewrite/rewrite-logging-frameworks#239](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/239) > > New Contributors > ---------------- > > * [`@simonzn`](https://github.com/simonzn) made their first contribution in [openrewrite/rewrite-logging-frameworks#235](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/235) > * [`@motlin`](https://github.com/motlin) made their first contribution in [openrewrite/rewrite-logging-frameworks#239](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/239) > > **Full Changelog**: <openrewrite/rewrite-logging-frameworks@v3.11.0...v3.12.0> > > 3.11.0 > ------ > > What's Changed > -------------- > > * fix: any last argument matching `Throwable.toString()` is left as is by [`@pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-logging-frameworks#229](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/229) > * refactor: org.openrewrite.mavencentral by [`@Laurens-W`](https://github.com/Laurens-W) in [openrewrite/rewrite-logging-frameworks#230](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/230) > * Don't if-wrap logs when arguments are getters by [`@pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-logging-frameworks#233](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/233) > > **Full Changelog**: <openrewrite/rewrite-logging-frameworks@v3.10.0...v3.11.0> > > 3.10.0 > ------ > > What's Changed > -------------- > > * Add recipe to change logger fields to private by [`@jhl221123`](https://github.com/jhl221123) in [openrewrite/rewrite-logging-frameworks#221](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/221) > * Add `MatchIsLogLevelEnabledWithLogStatements` to SLF4J best practices by [`@timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-logging-frameworks#222](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/222) > * Exclude spotbugs dependency by [`@greg-at-moderne`](https://github.com/greg-at-moderne) in [openrewrite/rewrite-logging-frameworks#225](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/225) > * Recipe to remove `.toString()` called on parameterized logging statement arguments by [`@pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-logging-frameworks#224](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/224) > * fix: match `.toString()` on any type, not just java.lang.Object by [`@pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-logging-frameworks#226](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/226) > > New Contributors > ---------------- > > * [`@jhl221123`](https://github.com/jhl221123) made their first contribution in [openrewrite/rewrite-logging-frameworks#221](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/221) > * [`@pdelagrave`](https://github.com/pdelagrave) made their first contribution in [openrewrite/rewrite-logging-frameworks#224](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/pull/224) ... (truncated) Commits * [`946d0ce`](openrewrite/rewrite-logging-frameworks@946d0ce) Update documentation examples * [`210eff9`](openrewrite/rewrite-logging-frameworks@210eff9) rename settings.local.json to settings.json ([#247](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/issues/247)) * [`2e67627`](openrewrite/rewrite-logging-frameworks@2e67627) Add a recipe to migrate from JBoss Logging to SLF4J ([#241](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/issues/241)) * [`c59c405`](openrewrite/rewrite-logging-frameworks@c59c405) LoggerLevelArgumentToMethod for JBoss Logging ([#243](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/issues/243)) * [`36a5200`](openrewrite/rewrite-logging-frameworks@36a5200) OpenRewrite recipe best practices * [`aa3f14f`](openrewrite/rewrite-logging-frameworks@aa3f14f) Avoid unsafe changes in `JulParameterizedArguments` when `JavaType.Array` arg... * [`249944e`](openrewrite/rewrite-logging-frameworks@249944e) Add `ArgumentArrayToVarargs` for logger methods that take a var args argument... * [`bb34ecf`](openrewrite/rewrite-logging-frameworks@bb34ecf) Create Claude settings file * [`ce8bc2d`](openrewrite/rewrite-logging-frameworks@ce8bc2d) refactor: Static imports for Collections and Collectors * [`af44c67`](openrewrite/rewrite-logging-frameworks@af44c67) Recipe to migrate deprecated JBoss Logging calls ([#245](https://redirect.github.com/openrewrite/rewrite-logging-frameworks/issues/245)) * Additional commits viewable in [compare view](openrewrite/rewrite-logging-frameworks@v3.7.0...v3.13.0) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
robfrank
approved these changes
Aug 15, 2025
dependabot
Bot
deleted the
dependabot/npm_and_yarn/webapp/multi-96c788614a
branch
August 15, 2025 15:09
mergify Bot
added a commit
that referenced
this pull request
Sep 21, 2025
…6.0 to 3.6.1 [skip ci] Bumps [org.apache.maven.plugins:maven-shade-plugin](https://github.com/apache/maven-shade-plugin) from 3.6.0 to 3.6.1. Release notes *Sourced from [org.apache.maven.plugins:maven-shade-plugin's releases](https://github.com/apache/maven-shade-plugin/releases).* > 3.6.1 > ----- > > 📝 Documentation updates > ----------------------- > > * [[MNGSITE-529]](https://issues.apache.org/jira/browse/MNGSITE-529) - Rename "Goals" to "Plugin Documentation" ([#250](https://redirect.github.com/apache/maven-shade-plugin/pull/250)) [`@Bukama`](https://github.com/Bukama) > > 👻 Maintenance > ------------- > > * Enable prevent branch protection rules ([#746](https://redirect.github.com/apache/maven-shade-plugin/pull/746)) [`@sparsick`](https://github.com/sparsick) > * Enable GH issues ([#253](https://redirect.github.com/apache/maven-shade-plugin/pull/253)) [`@Bukama`](https://github.com/Bukama) > * Add missing [`@Override`](https://github.com/Override) annotations ([#246](https://redirect.github.com/apache/maven-shade-plugin/pull/246)) [`@elharo`](https://github.com/elharo) > * Merge `ApacheLicenseResourceTransformer` tests ([#245](https://redirect.github.com/apache/maven-shade-plugin/pull/245)) [`@Goooler`](https://github.com/Goooler) > * Add test cases for .md supports in the Apache License and Notice transformers ([#243](https://redirect.github.com/apache/maven-shade-plugin/pull/243)) [`@Goooler`](https://github.com/Goooler) > * [[MSHADE-479]](https://issues.apache.org/jira/browse/MSHADE-479) - Make the mojo much less noisy ([#233](https://redirect.github.com/apache/maven-shade-plugin/pull/233)) [`@elharo`](https://github.com/elharo) > > 📦 Dependency updates > -------------------- > > * Bump org.codehaus.mojo:mrm-maven-plugin from 1.6.0 to 1.7.0 ([#748](https://redirect.github.com/apache/maven-shade-plugin/pull/748)) @[dependabot[bot]](https://github.com/apps/dependabot) > * Bump org.hamcrest:hamcrest-core from 2.2 to 3.0 ([#235](https://redirect.github.com/apache/maven-shade-plugin/pull/235)) @[dependabot[bot]](https://github.com/apps/dependabot) > * Bump org.apache.maven.plugins:maven-plugins from 42 to 45 ([#738](https://redirect.github.com/apache/maven-shade-plugin/pull/738)) @[dependabot[bot]](https://github.com/apps/dependabot) > * Bump org.apache.commons:commons-compress from 1.26.2 to 1.28.0 ([#743](https://redirect.github.com/apache/maven-shade-plugin/pull/743)) @[dependabot[bot]](https://github.com/apps/dependabot) > * Bump org.xmlunit:xmlunit-legacy from 2.10.0 to 2.10.3 ([#745](https://redirect.github.com/apache/maven-shade-plugin/pull/745)) @[dependabot[bot]](https://github.com/apps/dependabot) > * Bump ASM 9.8 to support JDK 25 bytecode ([#744](https://redirect.github.com/apache/maven-shade-plugin/pull/744)) [`@pan3793`](https://github.com/pan3793) > * Bump commons-io:commons-io from 2.13.0 to 2.14.0 in /src/it/projects/MSHADE-105/shaded-jar ([#241](https://redirect.github.com/apache/maven-shade-plugin/pull/241)) @[dependabot[bot]](https://github.com/apps/dependabot) Commits * [`9662c98`](apache/maven-shade-plugin@9662c98) [maven-release-plugin] prepare for next development iteration * [`06902bd`](apache/maven-shade-plugin@06902bd) [maven-release-plugin] prepare release maven-shade-plugin-3.6.1 * [`29e9a9d`](apache/maven-shade-plugin@29e9a9d) add .git * [`844e61a`](apache/maven-shade-plugin@844e61a) use github * [`43101f9`](apache/maven-shade-plugin@43101f9) [maven-release-plugin] prepare release maven-shade-plugin-3.6.1 * [`2ffb28d`](apache/maven-shade-plugin@2ffb28d) use release drafter v4 and dependabot to updade gha as well ([#750](https://redirect.github.com/apache/maven-shade-plugin/issues/750)) * [`f5b590e`](apache/maven-shade-plugin@f5b590e) Bump org.codehaus.mojo:mrm-maven-plugin from 1.6.0 to 1.7.0 * [`eee0319`](apache/maven-shade-plugin@eee0319) Bump org.hamcrest:hamcrest-core from 2.2 to 3.0 * [`0d5a7a4`](apache/maven-shade-plugin@0d5a7a4) fix upgrade, remove those useless final * [`6e5f0f3`](apache/maven-shade-plugin@6e5f0f3) Bump org.apache.maven.plugins:maven-plugins from 42 to 45 * Additional commits viewable in [compare view](apache/maven-shade-plugin@maven-shade-plugin-3.6.0...v3.6.1) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
mergify Bot
added a commit
that referenced
this pull request
Mar 10, 2026
[//]: # (dependabot-start)⚠️ \*\*Dependabot is rebasing this PR\*\*⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.7.0 to 4.0.0. Release notes *Sourced from [docker/setup-qemu-action's releases](https://github.com/docker/setup-qemu-action/releases).* > v4.0.0 > ------ > > * Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [`@crazy-max`](https://github.com/crazy-max) in [docker/setup-qemu-action#245](https://redirect.github.com/docker/setup-qemu-action/pull/245) > * Switch to ESM and update config/test wiring by [`@crazy-max`](https://github.com/crazy-max) in [docker/setup-qemu-action#241](https://redirect.github.com/docker/setup-qemu-action/pull/241) > * Bump `@actions/core` from 1.11.1 to 3.0.0 in [docker/setup-qemu-action#244](https://redirect.github.com/docker/setup-qemu-action/pull/244) > * Bump `@docker/actions-toolkit` from 0.67.0 to 0.77.0 in [docker/setup-qemu-action#243](https://redirect.github.com/docker/setup-qemu-action/pull/243) > * Bump `@isaacs/brace-expansion` from 5.0.0 to 5.0.1 in [docker/setup-qemu-action#240](https://redirect.github.com/docker/setup-qemu-action/pull/240) > * Bump js-yaml from 3.14.1 to 3.14.2 in [docker/setup-qemu-action#231](https://redirect.github.com/docker/setup-qemu-action/pull/231) > * Bump lodash from 4.17.21 to 4.17.23 in [docker/setup-qemu-action#238](https://redirect.github.com/docker/setup-qemu-action/pull/238) > > **Full Changelog**: <docker/setup-qemu-action@v3.7.0...v4.0.0> Commits * [`ce36039`](docker/setup-qemu-action@ce36039) Merge pull request [#245](https://redirect.github.com/docker/setup-qemu-action/issues/245) from crazy-max/node24 * [`6386344`](docker/setup-qemu-action@6386344) node 24 as default runtime * [`1ea3db7`](docker/setup-qemu-action@1ea3db7) Merge pull request [#243](https://redirect.github.com/docker/setup-qemu-action/issues/243) from docker/dependabot/npm\_and\_yarn/docker/actions-to... * [`b56a002`](docker/setup-qemu-action@b56a002) chore: update generated content * [`c43f02d`](docker/setup-qemu-action@c43f02d) build(deps): bump `@docker/actions-toolkit` from 0.67.0 to 0.77.0 * [`ce10c58`](docker/setup-qemu-action@ce10c58) Merge pull request [#244](https://redirect.github.com/docker/setup-qemu-action/issues/244) from docker/dependabot/npm\_and\_yarn/actions/core-3.0.0 * [`429fc9d`](docker/setup-qemu-action@429fc9d) chore: update generated content * [`060e5f8`](docker/setup-qemu-action@060e5f8) build(deps): bump `@actions/core` from 1.11.1 to 3.0.0 * [`44be13e`](docker/setup-qemu-action@44be13e) Merge pull request [#231](https://redirect.github.com/docker/setup-qemu-action/issues/231) from docker/dependabot/npm\_and\_yarn/js-yaml-3.14.2 * [`1897438`](docker/setup-qemu-action@1897438) chore: update generated content * Additional commits viewable in [compare view](docker/setup-qemu-action@c7c5346...ce36039) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
mergify Bot
added a commit
that referenced
this pull request
Mar 19, 2026
…updates [skip ci] Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/cache](https://github.com/actions/cache) | `5.0.3` | `5.0.4` | | [graalvm/setup-graalvm](https://github.com/graalvm/setup-graalvm) | `1.4.5` | `1.5.0` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.5.0` | `2.6.1` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.32.5` | `4.33.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.69` | `1.0.75` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.289.0` | `1.295.0` | | [webfactory/ssh-agent](https://github.com/webfactory/ssh-agent) | `0.9.1` | `0.10.0` | Updates `actions/cache` from 5.0.3 to 5.0.4 Release notes *Sourced from [actions/cache's releases](https://github.com/actions/cache/releases).* > v5.0.4 > ------ > > What's Changed > -------------- > > * Add release instructions and update maintainer docs by [`@Link`](https://github.com/Link)- in [actions/cache#1696](https://redirect.github.com/actions/cache/pull/1696) > * Potential fix for code scanning alert no. 52: Workflow does not contain permissions by [`@Link`](https://github.com/Link)- in [actions/cache#1697](https://redirect.github.com/actions/cache/pull/1697) > * Fix workflow permissions and cleanup workflow names / formatting by [`@Link`](https://github.com/Link)- in [actions/cache#1699](https://redirect.github.com/actions/cache/pull/1699) > * docs: Update examples to use the latest version by [`@XZTDean`](https://github.com/XZTDean) in [actions/cache#1690](https://redirect.github.com/actions/cache/pull/1690) > * Fix proxy integration tests by [`@Link`](https://github.com/Link)- in [actions/cache#1701](https://redirect.github.com/actions/cache/pull/1701) > * Fix cache key in examples.md for bun.lock by [`@RyPeck`](https://github.com/RyPeck) in [actions/cache#1722](https://redirect.github.com/actions/cache/pull/1722) > * Update dependencies & patch security vulnerabilities by [`@Link`](https://github.com/Link)- in [actions/cache#1738](https://redirect.github.com/actions/cache/pull/1738) > > New Contributors > ---------------- > > * [`@XZTDean`](https://github.com/XZTDean) made their first contribution in [actions/cache#1690](https://redirect.github.com/actions/cache/pull/1690) > * [`@RyPeck`](https://github.com/RyPeck) made their first contribution in [actions/cache#1722](https://redirect.github.com/actions/cache/pull/1722) > > **Full Changelog**: <actions/cache@v5...v5.0.4> Changelog *Sourced from [actions/cache's changelog](https://github.com/actions/cache/blob/main/RELEASES.md).* > Releases > ======== > > How to prepare a release > ------------------------ > > > [!NOTE] > > Relevant for maintainers with write access only. > > 1. Switch to a new branch from `main`. > 2. Run `npm test` to ensure all tests are passing. > 3. Update the version in [`https://github.com/actions/cache/blob/main/package.json`](https://github.com/actions/cache/blob/main/package.json). > 4. Run `npm run build` to update the compiled files. > 5. Update this [`https://github.com/actions/cache/blob/main/RELEASES.md`](https://github.com/actions/cache/blob/main/RELEASES.md) with the new version and changes in the `## Changelog` section. > 6. Run `licensed cache` to update the license report. > 7. Run `licensed status` and resolve any warnings by updating the [`https://github.com/actions/cache/blob/main/.licensed.yml`](https://github.com/actions/cache/blob/main/.licensed.yml) file with the exceptions. > 8. Commit your changes and push your branch upstream. > 9. Open a pull request against `main` and get it reviewed and merged. > 10. Draft a new release <https://github.com/actions/cache/releases> use the same version number used in `package.json` > 1. Create a new tag with the version number. > 2. Auto generate release notes and update them to match the changes you made in `RELEASES.md`. > 3. Toggle the set as the latest release option. > 4. Publish the release. > 11. Navigate to <https://github.com/actions/cache/actions/workflows/release-new-action-version.yml> > 1. There should be a workflow run queued with the same version number. > 2. Approve the run to publish the new version and update the major tags for this action. > > Changelog > --------- > > ### 5.0.4 > > * Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns) > * Bump `undici` to v6.24.1 (WebSocket decompression bomb protection, header validation fixes) > * Bump `fast-xml-parser` to v5.5.6 > > ### 5.0.3 > > * Bump `@actions/cache` to v5.0.5 (Resolves: <https://github.com/actions/cache/security/dependabot/33>) > * Bump `@actions/core` to v2.0.3 > > ### 5.0.2 > > * Bump `@actions/cache` to v5.0.3 [#1692](https://redirect.github.com/actions/cache/pull/1692) > > ### 5.0.1 > > * Update `@azure/storage-blob` to `^12.29.1` via `@actions/cache@5.0.1` [#1685](https://redirect.github.com/actions/cache/pull/1685) > > ### 5.0.0 > > > [!IMPORTANT] > > `actions/cache@v5` runs on the Node.js 24 runtime and requires a minimum Actions Runner version of `2.327.1`. ... (truncated) Commits * [`6682284`](actions/cache@6682284) Merge pull request [#1738](https://redirect.github.com/actions/cache/issues/1738) from actions/prepare-v5.0.4 * [`e340396`](actions/cache@e340396) Update RELEASES * [`8a67110`](
Bumps on-headers and compression. These dependencies needed to be updated together.
Updates
on-headersfrom 1.0.2 to 1.1.0Release notes
Sourced from on-headers's releases.
Changelog
Sourced from on-headers's changelog.
Commits
4b017af1.1.0b636f2d♻️ refactor header array code3e2c2d4✨ ignore falsy header keys, matching node behavior172eb41✨ support duplicate headersc6e3849🔒️ fix array handling6893518💚 update CI - add newer node versions56a345d✨ add script to update known hashes175ab21👷 add upstream change detection (#31)ce0b2c8ci: apply OSSF Scorecard security best practices (#20)1a38c54fix: useubuntu-latestas ci runner (#19)Maintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.
Updates
compressionfrom 1.8.0 to 1.8.1Release notes
Sourced from compression's releases.
Changelog
Sourced from compression's changelog.
Commits
83a0c451.8.1ce62713deps: on-headers@1.1.0 (#246)f4acb23build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#244)6eaebe6build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (#241)37e0623build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 (#240)bc436b2build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#239)2f9f572build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 (#243)5f13b14[StepSecurity] ci: Harden GitHub Actions (#235)76e0945build(deps-dev): bump supertest from 6.2.3 to 6.3.4 (#231)ae6ee80build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 (#230)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.