chore(deps): bump actions/cache/restore from 4.3.0 to 6.1.0 by dependabot[bot] · Pull Request #287 · hyperpolymath/MetaManifold-WebUI

dependabot · 2026-10-25T11:28:39Z

Bumps actions/cache/restore from 4.3.0 to 6.1.0.

Release notes

Sourced from actions/cache/restore's releases.

v6.1.0

What's Changed

Bump @actions/cache to v6.1.0 - handle read-only cache access by @jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Update packages, migrate to ESM by @Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Bump @actions/cache to v5.1.0 - handle read-only cache access by @jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

... (truncated)

Changelog

Sourced from actions/cache/restore's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token

Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2

Migrated to ESM module system

Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

55cc834 Merge pull request #1768 from jasongin/readonly-cache
d8cd72f Bump @actions/cache to v6.1.0 - handle cache write error due to RO token
2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
e9b91fd Prettier fixes
e4884b8 Rebuild dist
10baf01 Fixed licenses
e39b386 Fix test mock return order
b692820 PR feedback
6074912 Rebuild dist bundles as ESM to match type:module
5a912e8 Fix lint and jest issues
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/cache/restore](https://github.com/actions/cache) from 4.3.0 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...55cc834) --- updated-dependencies: - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-25T11:29:08Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 060b2ff4-e78b-49d8-9ef0-36bc38f049e4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-10-25T11:29:20Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Dependabot opened #287, #288, #289 and #290 within an hour of each other. Three of them move an action to the exact SHA this repository already uses elsewhere, so they are one change - 'use the version already pinned' - and merging them separately costs three serialised runs of the full suite on main (Julia tests alone is 20-35 minutes), plus a rebase of the remaining two after each merge. - actions/cache/restore and actions/cache/save 4.3.0 -> 6.1.0, the SHA actions/cache is already pinned at in six places. - actions/upload-artifact 4.6.2 -> 7.0.2, the SHA already pinned in four. - upload-sarif's comment claimed v4.38.0 and '4.38.1 blocked estate-wide', while the pinned SHA actually resolves to v4.39.0 on Dependabot's reading, so the note described a version the pin was already past. The comment now states what is true and why the SHA rather than the tag is the pin. github/codeql-action is now ignored by Dependabot: a pin that carries an estate-wide decision should be moved by hand with its comment, not silently. That leaves #290 (4.39.0 -> 4.39.1) as the owner's call rather than a bot's. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

hyperpolymath · 2026-10-25T11:40:31Z

Folded into #292, which lands the same pin alignment in one change.

Three pull requests that each move an action to the exact SHA this repository already pins elsewhere are one change, and merging them one at a time costs three serialised runs of the full suite on main — Julia tests alone is 20–35 minutes here — plus a rebase of the remaining two after every merge. #292 contains all three, verified byte-identical to the SHAs already in use:

actions/cache/restore 4.3.0 → 6.1.0 (same SHA as actions/cache, pinned six times)
actions/cache/save 4.3.0 → 6.1.0 (same)
actions/upload-artifact 4.6.2 → 7.0.2 (same SHA, already pinned four times)

Nothing is lost: the diff is preserved in #292 and recoverable at refs/pull/287/head. Dependabot has rebase-strategy: auto (added in #286), so it will not re-open these in a stale state, and the new Branch freshness check would have flagged each one as it fell behind.

dependabot · 2026-10-25T11:40:35Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

…292) ## Change and reason Dependabot opened **four pull requests in an hour** (#287, #288, #289, #290). Three of them move an action to the **exact SHA this repository already pins elsewhere**, so they are one change — "use the version already in use" — and merging them one at a time costs three serialised runs of the full suite on `main` (`Julia tests` alone is 20–35 min), plus a rebase of the remaining two after each merge. This does the three in one pass and leaves the fourth to a person. | Action | From | To | Why it is safe | | --- | --- | --- | --- | | `actions/cache/restore`, `actions/cache/save` | 4.3.0 | **6.1.0** | Same SHA `actions/cache` is already pinned at in six places in `ci.yml`. | | `actions/upload-artifact` | 4.6.2 | **7.0.2** | Same SHA already pinned in four places (`ci.yml` line 501, `hypatia-scan-reusable.yml` ×2). | | `github/codeql-action/upload-sarif` | — | unchanged | Comment corrected only: see below. | ### The one that needed reading, not merging #290 bumps `upload-sarif` "from 4.39.0 to 4.39.1", while the comment beside the pin says: ``` uses: github/codeql-action@6f2ac81f… # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) ``` Two facts that do not fit together: Dependabot resolves the pinned SHA to **4.39.0**, so the comment was already describing a version the pin had moved past, and it still records an estate-wide block on 4.38.1. A reviewer cannot tell from the diff whether the new SHA is blocked, allowed, or something else — the comment contradicts the pin. So this PR does **not** take the 4.39.1 bump. It corrects the comment to state what is true (the SHA resolves to v4.39.0, and the SHA rather than the tag is the pin), and adds an `ignore` rule so Dependabot stops rewriting a pin that carries an estate-wide decision: ```yaml ignore: - dependency-name: github/codeql-action update-types: [version-update:semver-major, version-update:semver-minor, version-update:semver-patch] ``` #290 stays open as the owner's call: it is a patch release whose only change is the bundled CodeQL version, and whether the estate's block reaches 4.39.x is not something this repository's files can answer. ## Validation ``` bash scripts/check-governance-contract.sh # 70 checks passed (unchanged on this branch) bash scripts/tests/test-governance-contract.sh ``` All workflow files and `.github/dependabot.yml` parse as YAML, and the four changed SHAs are byte-identical to the ones already used in this repository (verified by grep, not by trust in the bot). **Not run:** the Julia and frontend suites — no Julia or TypeScript is touched. CI runs them. ## Scope Closing #287, #288 and #289 in favour of this, so the pending dependency work is one pull request instead of three. No pin moves to a SHA this repository does not already use; no `renv.lock`, `Manifest.toml` or `tool_versions.yml` change. ## Contribution checks - [x] I followed [CONTRIBUTING.md](../CONTRIBUTING.md). - [x] This branch starts at `main`'s tip and has no merge commits from it. - [x] CI has run; see checks. - [x] Existing licensing, citation and acknowledgement text is unchanged. Co-authored-by: Arena Agent <agent@arena.ai> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 25, 2026

hyperpolymath mentioned this pull request Oct 25, 2026

chore(ci): one pass over action pins instead of four dependency PRs #292

Merged

4 tasks done

hyperpolymath closed this Oct 25, 2026

dependabot Bot deleted the dependabot/github_actions/actions/cache/restore-6.1.0 branch October 25, 2026 11:40

Navigation Menu

Repository navigation

chore(deps): bump actions/cache/restore from 4.3.0 to 6.1.0 - #287

chore(deps): bump actions/cache/restore from 4.3.0 to 6.1.0#287
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/cache/restore-6.1.0

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

coderabbitai Bot commented Oct 25, 2026

Review skipped

Uh oh!

sonarqubecloud Bot commented Oct 25, 2026

Uh oh!

hyperpolymath commented Oct 25, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 25, 2026

v6.1.0

What's Changed

v6.0.0

What's Changed

v5.1.0

What's Changed

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

Releases

How to prepare a release

Changelog

6.1.0

6.0.0

5.0.4

5.0.3

5.0.2

Uh oh!

coderabbitai Bot commented Oct 25, 2026

Review skipped

Uh oh!

sonarqubecloud Bot commented Oct 25, 2026

Quality Gate passed

Uh oh!

hyperpolymath commented Oct 25, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant