chore(deps): update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v6.0.0 → v6.0.3
actions/setup-node	action	minor	v6.0.0 → v6.4.0
node	uses-with	minor	24.11.1 → 24.16.0
ruby (source)	uses-with	patch	3.4.7 → 3.4.9
ruby/setup-ruby	action	minor	v1.267.0 → v1.313.0
softprops/action-gh-release	action	minor	v2.4.2 → v2.6.2

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

actions/setup-node (actions/setup-node)

v6.4.0

Compare Source

v6.3.0

Compare Source

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in #​1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

• Fix npm audit issues by @​gowridurgad in #​1491
• Replace uuid with crypto.randomUUID() by @​trivikr in #​1378
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​1498

Bug fixes:

• Remove hardcoded bearer for mirror-url @​marco-ippolito in #​1467
• Scope test lockfiles by package manager and update cache tests by @​gowridurgad in #​1495

New Contributors

• @​susnux made their first contribution in #​1283

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

v6.1.0

Compare Source

What's Changed

Enhancement:

• Remove always-auth configuration handling by @​priyagupta108 in #​1436

Dependency updates:

• Upgrade @​actions/cache from 4.0.3 to 4.1.0 by @​dependabot[bot] in #​1384
• Upgrade actions/checkout from 5 to 6 by @​dependabot[bot] in #​1439
• Upgrade js-yaml from 3.14.1 to 3.14.2 by @​dependabot[bot] in #​1435

Documentation update:

• Add example for restore-only cache in documentation by @​aparnajyothi-y in #​1419

Full Changelog: actions/setup-node@v6...v6.1.0

actions/node-versions (node)

v24.16.0: 24.16.0

Compare Source

Node.js 24.16.0

v24.15.0: 24.15.0

Compare Source

Node.js 24.15.0

v24.14.1: 24.14.1

Compare Source

Node.js 24.14.1

v24.14.0: 24.14.0

Compare Source

Node.js 24.14.0

v24.13.1: 24.13.1

Compare Source

Node.js 24.13.1

v24.13.0: 24.13.0

Compare Source

Node.js 24.13.0

v24.12.0: 24.12.0

Compare Source

Node.js 24.12.0

ruby/setup-ruby (ruby/setup-ruby)

v1.313.0

Compare Source

What's Changed

• Add jruby-10.0.6.0 by @​ruby-builder-bot in #​921

Full Changelog: ruby/setup-ruby@v1.312.0...v1.313.0

v1.312.0

Compare Source

What's Changed

• Use BUNDLE_LOCKFILE when detecting the lockfile by @​Thomascountz in #​919

New Contributors

• @​Thomascountz made their first contribution in #​919

Full Changelog: ruby/setup-ruby@v1.311.0...v1.312.0

v1.311.0

Compare Source

What's Changed

• Add jruby-9.4.15.0 by @​ruby-builder-bot in #​920

Full Changelog: ruby/setup-ruby@v1.310.0...v1.311.0

v1.310.0

Compare Source

What's Changed

• Add ruby-4.0.5 by @​ruby-builder-bot in #​918

Full Changelog: ruby/setup-ruby@v1.309.0...v1.310.0

v1.309.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​917

Full Changelog: ruby/setup-ruby@v1.308.0...v1.309.0

v1.308.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​912

Full Changelog: ruby/setup-ruby@v1.307.0...v1.308.0

v1.307.0

Compare Source

What's Changed

• Update README: fix outdated URLs and Ruby version examples by @​fkmy in #​910
• Add ruby-4.0.4 by @​ruby-builder-bot in #​911

Full Changelog: ruby/setup-ruby@v1.306.0...v1.307.0

v1.306.0

Compare Source

What's Changed

• Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1 by @​ruby-builder-bot in #​909

Full Changelog: ruby/setup-ruby@v1.305.0...v1.306.0

v1.305.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​908

Full Changelog: ruby/setup-ruby@v1.304.0...v1.305.0

v1.304.0

Compare Source

What's Changed

• Add jruby-10.1.0.0 by @​ruby-builder-bot in #​906

Full Changelog: ruby/setup-ruby@v1.303.0...v1.304.0

v1.303.0

Compare Source

What's Changed

• Add ruby-4.0.3 by @​ruby-builder-bot in #​903

Full Changelog: ruby/setup-ruby@v1.302.0...v1.303.0

v1.302.0

Compare Source

Full Changelog: ruby/setup-ruby@v1.301.0...v1.302.0

v1.301.0

Compare Source

What's Changed

• Add truffleruby-34.0.0,truffleruby+graalvm-34.0.0 by @​ruby-builder-bot in #​901

Full Changelog: ruby/setup-ruby@v1.300.0...v1.301.0

v1.300.0

Compare Source

What's Changed

• Refactor matrix script by @​ntkme in #​897
• Add jruby-10.0.5.0 by @​ruby-builder-bot in #​900

Full Changelog: ruby/setup-ruby@v1.299.0...v1.300.0

v1.299.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​896

Full Changelog: ruby/setup-ruby@v1.298.0...v1.299.0

v1.298.0

Compare Source

What's Changed

• Add ruby-3.2.11 by @​ruby-builder-bot in #​895

Full Changelog: ruby/setup-ruby@v1.297.0...v1.298.0

v1.297.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​894

Full Changelog: ruby/setup-ruby@v1.296.0...v1.297.0

v1.296.0

Compare Source

What's Changed

• Add ruby-3.3.11 by @​ruby-builder-bot in #​893

Full Changelog: ruby/setup-ruby@v1.295.0...v1.296.0

v1.295.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​890

Full Changelog: ruby/setup-ruby@v1.294.0...v1.295.0

v1.294.0

Compare Source

What's Changed

• Add ruby-4.0.2 by @​ruby-builder-bot in #​889

Full Changelog: ruby/setup-ruby@v1.293.0...v1.294.0

v1.293.0

Compare Source

What's Changed

• Update README to remove JRuby version notes by @​headius in #​887
• Update CRuby releases on Windows by @​ruby-builder-bot in #​888

Full Changelog: ruby/setup-ruby@v1.292.0...v1.293.0

v1.292.0

Compare Source

What's Changed

• Update Node to 24 by @​eregon in #​886

Full Changelog: ruby/setup-ruby@v1.291.0...v1.292.0

v1.291.0

Compare Source

What's Changed

• Add ruby-3.4.9 by @​ruby-builder-bot in #​885

Full Changelog: ruby/setup-ruby@v1.290.0...v1.291.0

v1.290.0

Compare Source

What's Changed

• Improve Windows version detection and HOME variable export by @​jbaiza in #​883

New Contributors

• @​jbaiza made their first contribution in #​883

Full Changelog: ruby/setup-ruby@v1.289.0...v1.290.0

v1.289.0

Compare Source

What's Changed

• Bump actions/checkout from 4 to 6 by @​dependabot[bot] in #​874
• Bump fast-xml-parser from 5.3.3 to 5.3.4 by @​dependabot[bot] in #​869
• Document the role of the setup-ruby release team and maintainers by @​eregon in #​876
• Bump fast-xml-parser from 5.3.4 to 5.3.6 by @​dependabot[bot] in #​877
• Bump minimatch from 3.1.2 to 3.1.4 by @​dependabot[bot] in #​878
• Bump fast-xml-parser from 5.3.6 to 5.4.1 by @​dependabot[bot] in #​879
• Add jruby-10.0.4.0 by @​ruby-builder-bot in #​881

Full Changelog: ruby/setup-ruby@v1.288.0...v1.289.0

v1.288.0

Compare Source

What's Changed

• Move check-new-windows-versions.yml workflow from ruby/ruby-builder to ruby/setup-ruby by @​eregon in #​870
• Add jruby-10.0.3.0 by @​ruby-builder-bot in #​875

Full Changelog: ruby/setup-ruby@v1.287.0...v1.288.0

v1.287.0

Compare Source

What's Changed

• Improve the mise.toml parser to conform to the TOML specification by @​pan93412 in #​868

New Contributors

• @​pan93412 made their first contribution in #​868

Full Changelog: ruby/setup-ruby@v1.286.0...v1.287.0

v1.286.0

Compare Source

What's Changed

• Add truffleruby-33.0.1,truffleruby+graalvm-33.0.1 by @​ruby-builder-bot in #​864

Full Changelog: ruby/setup-ruby@v1.285.0...v1.286.0

v1.285.0

Compare Source

What's Changed

• Convert to String earlier in generate-windows-versions.rb by @​eregon in #​862
• Update all dependencies to latest by @​eregon in #​863

Full Changelog: ruby/setup-ruby@v1.284.0...v1.285.0

v1.284.0

Compare Source

What's Changed

• Fix compatibility to ruby-3.2 by @​larskanis in #​861

Full Changelog: ruby/setup-ruby@v1.283.0...v1.284.0

v1.283.0

Compare Source

What's Changed

• Add restriction and validation for download urls by @​ntkme in #​856
• Add ruby-3.2.10 by @​ruby-builder-bot in #​860

Full Changelog: ruby/setup-ruby@v1.282.0...v1.283.0

v1.282.0

Compare Source

What's Changed

• Add ruby-4.0.1 by @​ruby-builder-bot in #​859

Full Changelog: ruby/setup-ruby@v1.281.0...v1.282.0

v1.281.0

Compare Source

What's Changed

• Generate test matrix dynamically by @​ntkme in #​854
• Add truffleruby-33.0.0,truffleruby+graalvm-33.0.0 by @​ruby-builder-bot in #​857

Full Changelog: ruby/setup-ruby@v1.280.0...v1.281.0

v1.280.0

Compare Source

What's Changed

• Test ruby 4.0 on windows by @​ntkme in #​853
• Add token input for downloading release assets by @​TingluoHuang in #​851

New Contributors

• @​TingluoHuang made their first contribution in #​851

Full Changelog: ruby/setup-ruby@v1.279.0...v1.280.0

v1.279.0

Compare Source

Full Changelog: ruby/setup-ruby@v1.278.0...v1.279.0

v1.278.0

Compare Source

What's Changed

• Set BUNDLER_VERSION whenever we know which version to use by @​eregon in #​849

Full Changelog: ruby/setup-ruby@v1.277.0...v1.278.0

v1.277.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​847

Full Changelog: ruby/setup-ruby@v1.276.0...v1.277.0

v1.276.0

Compare Source

What's Changed

• Add ruby-4.0.0 by @​ruby-builder-bot in #​844

Full Changelog: ruby/setup-ruby@v1.275.0...v1.276.0

v1.275.0

Compare Source

What's Changed

• Skip saving cache for merge_group event by @​ntkme in #​812

Full Changelog: ruby/setup-ruby@v1.274.0...v1.275.0

v1.274.0

Compare Source

What's Changed

• Fix rubyinstaller2 urls for latest release by @​zenspider in #​842

New Contributors

• @​zenspider made their first contribution in #​842

Full Changelog: ruby/setup-ruby@v1.273.0...v1.274.0

v1.273.0

Compare Source

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in #​840

Full Changelog: ruby/setup-ruby@v1.272.0...v1.273.0

v1.272.0

Compare Source

What's Changed

• Add ruby-4.0.0-preview3 by @​ruby-builder-bot in #​839

Full Changelog: ruby/setup-ruby@v1.271.0...v1.272.0

v1.271.0

Compare Source

What's Changed

• Add ruby-3.4.8 by @​ruby-builder-bot in #​838

Full Changelog: ruby/setup-ruby@v1.270.0...v1.271.0

v1.270.0

Compare Source

What's Changed

• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​830
• When setting $JAVA_HOME also add $JAVA_HOME/bin to PATH by @​eregon in #​836

Full Changelog: ruby/setup-ruby@v1.269.0...v1.270.0

v1.269.0

Compare Source

What's Changed

• Account for Bundler 4 by @​eregon in #​832

Full Changelog: ruby/setup-ruby@v1.268.0...v1.269.0

v1.268.0

Compare Source

What's Changed

• Add ruby-4.0.0-preview2 by @​ruby-builder-bot in #​825

Full Changelog: ruby/setup-ruby@v1.267.0...v1.268.0

softprops/action-gh-release (softprops/action-gh-release)

v2.6.2

Compare Source

What's Changed

Other Changes 🔄

• chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @​dependabot[bot] in #​775
• chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​777
• chore(deps): bump vite from 8.0.0 to 8.0.5 by @​dependabot[bot] in #​781

Full Changelog: softprops/action-gh-release@v2...v2.6.2

v2.6.1

Compare Source

2.6.1 is a patch release focused on restoring linked discussion thread creation when
discussion_category_name is set. It fixes #764, where the draft-first publish flow
stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

• fix: preserve discussion category on publish by @​chenrui333 in #​765

v2.6.0

Compare Source

2.6.0 is a minor release centered on previous_tag support for generate_release_notes,
which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range.
It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync,
a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where
GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Exciting New Features 🎉

• feat: support previous_tag for generate_release_notes by @​pocesar in #​372

Bug fixes 🐛

• fix: recover concurrent asset metadata 404s by @​chenrui333 in #​760

Other Changes 🔄

• docs: clarify reused draft release behavior by @​chenrui333 in #​759
• docs: clarify working_directory input by @​chenrui333 in #​761
• ci: verify dist bundle freshness by @​chenrui333 in #​762
• fix: clarify immutable prerelease uploads by @​chenrui333 in #​763

v2.5.3

Compare Source

2.5.3 is a patch release focused on the remaining path-handling and release-selection bugs uncovered after 2.5.2.
It fixes #639, #571, #280, #614, #311, #403, and #368.
It also adds documentation clarifications for #541, #645, #542, #393, and #411,
where the current behavior is either usage-sensitive or constrained by GitHub platform limits rather than an action-side runtime bug.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

• fix: prefer token input over GITHUB_TOKEN by @​chenrui333 in #​751
• fix: clean up duplicate drafts after canonicalization by @​chenrui333 in #​753
• fix: support Windows-style file globs by @​chenrui333 in #​754
• fix: normalize refs-tag inputs by @​chenrui333 in #​755
• fix: expand tilde file paths by @​chenrui333 in #​756

Other Changes 🔄

• docs: clarify token precedence by @​chenrui333 in #​752
• docs: clarify GitHub release limits by @​chenrui333 in #​758
• documentation clarifications for empty-token handling, preserve_order, and special-character asset filename behavior

Full Changelog: softprops/action-gh-release@v2...v2.5.3

v2.5.2

Compare Source

2.5.2 is a patch release focused on the remaining release-creation and prerelease regressions in the 2.5.x bug-fix cycle.
It fixes #705, fixes #708, fixes #740, fixes #741, and fixes #722.
Regression testing covers the shared-tag race, prerelease event behavior, dotfile asset labels,
same-filename concurrent uploads, and blocked-tag cleanup behavior.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

• fix: canonicalize releases after concurrent create by @​chenrui333 in #​746
• fix: preserve prereleased events for prereleases by @​chenrui333 in #​748
• fix: restore dotfile asset labels by @​chenrui333 in #​749
• fix: handle upload already_exists races across workflows by @​api2062 in #​745
• fix: clean up orphan drafts when tag creation is blocked by @​chenrui333 in #​750

New Contributors

• @​api2062 made their first contribution in #​745

Full Changelog: softprops/action-gh-release@v2...v2.5.2

v2.5.1

Compare Source

2.5.1 is a patch release focused on regressions introduced in 2.5.0 and on release lookup reliability.
It fixes #713, addresses #703, and fixes #724. Regression testing shows that
current master no longer reproduces the finalize-race behavior reported in #704 and #709.

What's Changed

Bug fixes 🐛

• fix: fetch correct asset URL after finalization; test; some refactoring by @​pzhlkj6612 in #​738
• fix: release marked as 'latest' despite make_latest: false by @​Boshen in #​715
• fix: use getReleaseByTag API instead of iterating all releases by @​kim-em in #​725

Other Changes 🔄

• dependency updates, including the ESM/runtime compatibility refresh in #​731

New Contributors

• @​autarch made their first contribution in #​716
• @​pzhlkj6612 made their first contribution in #​738
• @​Boshen made their first contribution in #​715
• @​kim-em made their first contribution in #​725

Full Changelog: softprops/action-gh-release@v2...v2.5.1

v2.5.0

Compare Source

What's Changed

Exciting New Features 🎉

• feat: mark release as draft until all artifacts are uploaded by @​dumbmoron in #​692

Other Changes 🔄

• chore(deps): bump the npm group across 1 directory with 5 updates by @​dependabot[bot] in #​697
• chore(deps): bump actions/checkout from 5.0.0 to 5.0.1 in the github-actions group by @​dependabot[bot] in #​689

New Contributors

• @​dumbmoron made their first contribution in #​692

Full Changelog: softprops/action-gh-release@v2.4.2...v2.5.0

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.