Skip to content

chore(deps): bump the ci-dependencies group across 1 directory with 9 updates - #1097

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/ci-dependencies-fa7f373558
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/ci-dependencies-fa7f373558

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the ci-dependencies group with 9 updates in the /.github/workflows directory:

Package From To
actions/checkout 4 7
astral-sh/setup-uv 5.4.2 10.3.3
Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml c6b3effa6d2e9fff97500d9688b54106f556c433 ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
Comfy-Org/github-workflows/.github/workflows/cursor-review.yml 06f835f96accfd84d0a0929777d602837402608c ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
Comfy-Org/github-workflows/.github/workflows/groom.yml 23c7b69392d08e57f545d393faa391e43cf4dd55 ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
actions/setup-python 5 7
Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml 3b2c8ca1f52056b54453a659fdb4473cfc88aa0e ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
pypa/gh-action-pypi-publish 1.14.2 1.14.3
codecov/codecov-action 7.0.0 7.1.1

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates astral-sh/setup-uv from 5.4.2 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

📚 Documentation

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

🧰 Maintenance

... (truncated)

Commits
  • 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
  • 0192b69 chore: update known checksums for 0.13.6 (#1117)
  • 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
  • 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
  • 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
  • 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
  • 56618ca docs: update version references to v10.3.2 (#1104)
  • 07a047e chore: update known checksums for 0.13.5 (#1103)
  • e1b8536 docs: update version references to v10.3.1 (#1102)
  • 18d369b chore(deps): roll up Dependabot updates (#1101)
  • Additional commits viewable in compare view

Updates Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml from c6b3effa6d2e9fff97500d9688b54106f556c433 to ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e

Commits
  • ef94b5d perf(cursor-approve): drop the full-history clone from the checkout axes (#463)
  • e3bc077 ci: bump cursor-review to github-workflows@188a00d (#432)
  • ee59d1a [groom] cursor-review's severity badge is authored from two tables in post-re...
  • 7fb0560 ci(coderabbit-config): refresh the vendored CodeRabbit schema (#438)
  • 188a00d groom: slack-notify.sh: webhook mode and two of its five positional parameter...
  • 60faaa7 fix(cursor-review): pass Panel integrity on a cancelled run only when a push ...
  • 6af4cb8 fix(detect-unreviewed-merge): count an approving bot unless its login is igno...
  • b994a33 ci(cursor-review): move the Cursor CLI pin in cursor-axis-base.yml alongside ...
  • e7d7bcf feat(cursor-review): axes_alongside_panel — run cursor-approve's start phase ...
  • 7fdd9be perf(cursor-review): drop the full-history clones from the review round's cri...
  • Additional commits viewable in compare view

Updates Comfy-Org/github-workflows/.github/workflows/cursor-review.yml from 06f835f96accfd84d0a0929777d602837402608c to ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e

Commits
  • ef94b5d perf(cursor-approve): drop the full-history clone from the checkout axes (#463)
  • e3bc077 ci: bump cursor-review to github-workflows@188a00d (#432)
  • ee59d1a [groom] cursor-review's severity badge is authored from two tables in post-re...
  • 7fb0560 ci(coderabbit-config): refresh the vendored CodeRabbit schema (#438)
  • 188a00d groom: slack-notify.sh: webhook mode and two of its five positional parameter...
  • 60faaa7 fix(cursor-review): pass Panel integrity on a cancelled run only when a push ...
  • 6af4cb8 fix(detect-unreviewed-merge): count an approving bot unless its login is igno...
  • b994a33 ci(cursor-review): move the Cursor CLI pin in cursor-axis-base.yml alongside ...
  • e7d7bcf feat(cursor-review): axes_alongside_panel — run cursor-approve's start phase ...
  • 7fdd9be perf(cursor-review): drop the full-history clones from the review round's cri...
  • Additional commits viewable in compare view

Updates Comfy-Org/github-workflows/.github/workflows/groom.yml from 23c7b69392d08e57f545d393faa391e43cf4dd55 to ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e

Commits
  • ef94b5d perf(cursor-approve): drop the full-history clone from the checkout axes (#463)
  • e3bc077 ci: bump cursor-review to github-workflows@188a00d (#432)
  • ee59d1a [groom] cursor-review's severity badge is authored from two tables in post-re...
  • 7fb0560 ci(coderabbit-config): refresh the vendored CodeRabbit schema (#438)
  • 188a00d groom: slack-notify.sh: webhook mode and two of its five positional parameter...
  • 60faaa7 fix(cursor-review): pass Panel integrity on a cancelled run only when a push ...
  • 6af4cb8 fix(detect-unreviewed-merge): count an approving bot unless its login is igno...
  • b994a33 ci(cursor-review): move the Cursor CLI pin in cursor-axis-base.yml alongside ...
  • e7d7bcf feat(cursor-review): axes_alongside_panel — run cursor-approve's start phase ...
  • 7fdd9be perf(cursor-review): drop the full-history clones from the review round's cri...
  • Additional commits viewable in compare view

Updates actions/setup-python from 5 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

... (truncated)

Commits
  • 6d4fd22 Cache upgrade to 6.3.0 (#1370)
  • ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
  • ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
  • 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
  • 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
  • 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
  • e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
  • 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
  • af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
  • 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
  • Additional commits viewable in compare view

Updates Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml from 3b2c8ca1f52056b54453a659fdb4473cfc88aa0e to ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e

Commits
  • ef94b5d perf(cursor-approve): drop the full-history clone from the checkout axes (#463)
  • e3bc077 ci: bump cursor-review to github-workflows@188a00d (#432)
  • ee59d1a [groom] cursor-review's severity badge is authored from two tables in post-re...
  • 7fb0560 ci(coderabbit-config): refresh the vendored CodeRabbit schema (#438)
  • 188a00d groom: slack-notify.sh: webhook mode and two of its five positional parameter...
  • 60faaa7 fix(cursor-review): pass Panel integrity on a cancelled run only when a push ...
  • 6af4cb8 fix(detect-unreviewed-merge): count an approving bot unless its login is igno...
  • b994a33 ci(cursor-review): move the Cursor CLI pin in cursor-axis-base.yml alongside ...
  • e7d7bcf feat(cursor-review): axes_alongside_panel — run cursor-approve's start phase ...
  • 7fdd9be perf(cursor-review): drop the full-history clones from the review round's cri...
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

Commits
  • 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
  • 331eccb Upgrade certifi and sigstore
  • f68fee4 💰 Sync the FUNDING config
  • c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
  • 9090099 🧪 Make smoke test deps hash-pinned in CI
  • 34e40c2 📌 Bump pip-tools managed transitive deptrees
  • e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
  • dd8c5f4 🔧 Make pip-tools config available in container
  • See full diff in compare view

Updates codecov/codecov-action from 7.0.0 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates

Bumps the ci-dependencies group with 9 updates in the /.github/workflows directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `5.4.2` | `10.3.3` |
| [Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml](https://github.com/comfy-org/github-workflows) | `c6b3effa6d2e9fff97500d9688b54106f556c433` | `ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e` |
| [Comfy-Org/github-workflows/.github/workflows/cursor-review.yml](https://github.com/comfy-org/github-workflows) | `06f835f96accfd84d0a0929777d602837402608c` | `ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e` |
| [Comfy-Org/github-workflows/.github/workflows/groom.yml](https://github.com/comfy-org/github-workflows) | `23c7b69392d08e57f545d393faa391e43cf4dd55` | `ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5` | `7` |
| [Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml](https://github.com/comfy-org/github-workflows) | `3b2c8ca1f52056b54453a659fdb4473cfc88aa0e` | `ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `7.0.0` | `7.1.1` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v7)

Updates `astral-sh/setup-uv` from 5.4.2 to 10.3.3
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v5.4.2...68559e9)

Updates `Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml` from c6b3effa6d2e9fff97500d9688b54106f556c433 to ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
- [Commits](Comfy-Org/github-workflows@c6b3eff...ef94b5d)

Updates `Comfy-Org/github-workflows/.github/workflows/cursor-review.yml` from 06f835f96accfd84d0a0929777d602837402608c to ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
- [Commits](Comfy-Org/github-workflows@06f835f...ef94b5d)

Updates `Comfy-Org/github-workflows/.github/workflows/groom.yml` from 23c7b69392d08e57f545d393faa391e43cf4dd55 to ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
- [Commits](Comfy-Org/github-workflows@23c7b69...ef94b5d)

Updates `actions/setup-python` from 5 to 7
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v7)

Updates `Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml` from 3b2c8ca1f52056b54453a659fdb4473cfc88aa0e to ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
- [Commits](Comfy-Org/github-workflows@3b2c8ca...ef94b5d)

Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@dc37677...7245906)

Updates `codecov/codecov-action` from 7.0.0 to 7.1.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@fb8b358...303a32d)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml
  dependency-version: ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
  dependency-type: direct:production
  dependency-group: ci-dependencies
- dependency-name: Comfy-Org/github-workflows/.github/workflows/cursor-review.yml
  dependency-version: ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
  dependency-type: direct:production
  dependency-group: ci-dependencies
- dependency-name: Comfy-Org/github-workflows/.github/workflows/groom.yml
  dependency-version: ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
  dependency-type: direct:production
  dependency-group: ci-dependencies
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-dependencies
- dependency-name: Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml
  dependency-version: ef94b5d4ba41fa6f77bb2bdcaec5d63b5005652e
  dependency-type: direct:production
  dependency-group: ci-dependencies
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-dependencies
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 1, 2026
@coderabbitai

coderabbitai Bot commented Nov 1, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants