⬆️ Updates actions/checkout action to v6 #552

docs: update README.md by @motss in #1971
Add internal repos for checking out multiple repositories by @mouismail in #1977
Documentation update - add recommended permissions to Readme by @benwells in #2043
Adjust positioning of user email note and permissions heading by @joshmgross in #2044
Update README.md by @nebuk89 in #2194
Update CODEOWNERS for actions by @TingluoHuang in #2224
Update package dependencies by @salmanmkc in #2236
Prepare release v4.3.0 by @salmanmkc in #2237

New Contributors

@motss made their first contribution in #1971
@mouismail made their first contribution in #1977
@benwells made their first contribution in #2043
@nebuk89 made their first contribution in #2194
@salmanmkc made their first contribution in #2236

Full Changelog: actions/checkout@v4...v4.3.0

`v4.2.2`

Compare Source

url-helper.ts now leverages well-known environment variables by @jww3 in #1941
Expand unit test coverage for isGhes by @jww3 in #1946

`v4.2.1`

Compare Source

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in #1924

`v4.2.0`

Compare Source

Add Ref and Commit outputs by @lucacome in #1180
Dependency updates by @dependabot- #1777, #1872

`v4.1.7`

Compare Source

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in #1739
Bump actions/checkout from 3 to 4 by @dependabot in #1697
Check out other refs/* by commit by @orhantoy in #1774
Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in #1776

`v4.1.6`

Compare Source

Check platform to set archive extension appropriately by @cory-miller in #1732

`v4.1.5`

Compare Source

Update NPM dependencies by @cory-miller in #1703
Bump github/codeql-action from 2 to 3 by @dependabot in #1694
Bump actions/setup-node from 1 to 4 by @dependabot in #1696
Bump actions/upload-artifact from 2 to 4 by @dependabot in #1695
README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @cory-miller in #1707

`v4.1.4`

Compare Source

Disable extensions.worktreeConfig when disabling sparse-checkout by @jww3 in #1692
Add dependabot config by @cory-miller in #1688
Bump the minor-actions-dependencies group with 2 updates by @dependabot in #1693
Bump word-wrap from 1.2.3 to 1.2.5 by @dependabot in #1643

`v4.1.3`

Compare Source

Check git version before attempting to disable sparse-checkout by @jww3 in #1656
Add SSH user parameter by @cory-miller in #1685
Update actions/checkout version in update-main-version.yml by @jww3 in #1650

`v4.1.2`

Compare Source

Fix: Disable sparse checkout whenever sparse-checkout option is not present @dscho in #1598

`v4.1.1`

Compare Source

Correct link to GitHub Docs by @peterbe in #1511
Link to release page from what's new section by @cory-miller in #1514

`v4.1.0`

Compare Source

Add support for partial checkout filters

`v4.0.0`

Compare Source

`v3.6.0`

Compare Source

`v3.5.3`

Compare Source

`v3.5.2`

Compare Source

Fix api endpoint for GHES

`v3.5.1`

Compare Source

Fix slow checkout on Windows

`v3.5.0`

Compare Source

Add new public key for known_hosts

`v3.4.0`

Compare Source

`v3.3.0`

Compare Source

`v3.2.0`

Compare Source

`v3.1.0`

Compare Source

`v3.0.2`

Compare Source

Add input set-safe-directory

`v3.0.1`

Compare Source

`v3.0.0`

Compare Source

Update to node 16

`v2.7.0`

Compare Source

What's Changed

Add new public key for known_hosts (#1237) by @TingluoHuang in #1238

Full Changelog: actions/checkout@v2.6.0...v2.7.0

`v2.6.0`

Compare Source

What's Changed

Add backports to v2 branch by @cory-miller in #1040
- Includes backports from the following changes: #964, #1002, #1029
- Upgraded the licensed version to match what is used in v3.

Full Changelog: actions/checkout@v2.5.0...v2.6.0

`v2.5.0`

Compare Source

What's Changed

Update @actions/core to 1.10.0 by @rentziass in #962

Full Changelog: actions/checkout@v2...v2.5.0

`v2.4.2`

Compare Source

What's Changed

Add set-safe-directory input to allow customers to take control. (#770) by @TingluoHuang in #776
Prepare changelog for v2.4.2. by @TingluoHuang in #778

Full Changelog: actions/checkout@v2...v2.4.2

`v2.4.1`

Compare Source

Fixed an issue where checkout failed to run in container jobs due to the new git setting safe.directory

`v2.4.0`

Compare Source

Convert SSH URLs like org-<ORG_ID>@github.com: to https://github.com/ - pr

`v2.3.5`

Compare Source

Update dependencies

Configuration

📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2025-11-20T19:42:32Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pretty-quick@3.1.0
	semantic-release@17.3.9
	lint-staged@10.5.4
	prettier@2.2.1

View full report

socket-security · 2025-11-20T19:42:40Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `json-schema` is vulnerable to Prototype Pollution CVE: GHSA-896r-f27r-55mw json-schema is vulnerable to Prototype Pollution (CRITICAL) Affected versions: < 0.4.0 Patched version: 0.4.0 From: package-lock.json → `npm/jest-circus@26.6.3` → `npm/@semantic-release/npm@7.0.10` → `npm/jest@27.0.0-next.2` → `npm/json-schema@0.2.3` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/json-schema@0.2.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Prototype Pollution in npm `minimist` CVE: GHSA-xvch-5gv4-984h Prototype Pollution in minimist (CRITICAL) Affected versions: >= 1.0.0 < 1.2.6; < 0.2.4 Patched version: 1.2.6 From: package-lock.json → `npm/cz-conventional-changelog@3.3.0` → `npm/eslint-plugin-import@2.22.1` → `npm/jest-circus@26.6.3` → `npm/@semantic-release/release-notes-generator@9.0.1` → `npm/editorconfig-checker@3.3.0` → `npm/folio@0.3.18` → `npm/@semantic-release/npm@7.0.10` → `npm/jest@27.0.0-next.2` → `npm/minimist@1.2.5` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimist@1.2.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `npm` is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: package-lock.json → `npm/@semantic-release/npm@7.0.10` → `npm/npm@6.14.11` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@6.14.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `safer-buffer` is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: package-lock.json → `npm/cz-conventional-changelog@3.3.0` → `npm/jest-circus@26.6.3` → `npm/@semantic-release/npm@7.0.10` → `npm/jest@27.0.0-next.2` → `npm/safer-buffer@2.1.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/safer-buffer@2.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2025-11-20T19:44:51Z

Thanks for the PR!

This section of the codebase is owner by https://github.com/AlexRogalskiy/ - if they write a comment saying "LGTM" then it will be merged.

github-actions · 2025-11-20T19:48:30Z

🏷️ [bumpr]
Next version:v2.0.2
Changes:v2.0.1...AlexRogalskiy:renovate/actions-checkout-6.x

renovate bot added bump:patch npm dependencies labels Nov 20, 2025

auto-assign bot requested a review from AlexRogalskiy November 20, 2025 19:41

⬆️ Updates actions/checkout action to v6

2c2e49b

renovate bot force-pushed the renovate/actions-checkout-6.x branch from d325093 to 2c2e49b Compare December 2, 2025 17:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

⬆️ Updates actions/checkout action to v6 #552

⬆️ Updates actions/checkout action to v6 #552

Uh oh!

renovate bot commented Nov 20, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Nov 20, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Nov 20, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 20, 2025

Uh oh!

github-actions bot commented Nov 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

⬆️ Updates actions/checkout action to v6 #552

Are you sure you want to change the base?

⬆️ Updates actions/checkout action to v6 #552

Uh oh!

Conversation

renovate bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

⚠️ Minimum Compatible Runner Version

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

Uh oh!

socket-security bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 20, 2025

Uh oh!

github-actions bot commented Nov 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Nov 20, 2025 •

edited

Loading

socket-security bot commented Nov 20, 2025 •

edited

Loading

socket-security bot commented Nov 20, 2025 •

edited

Loading