chore(deps): update github actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	major	v5.0.3 → v6.1.0
actions/checkout	action	major	v6.0.2 → v7.0.1
actions/download-artifact	action	major	v7.0.0 → v8.0.1
actions/setup-python	action	major	v6.2.0 → v7.0.0
actions/upload-artifact	action	major	v6.0.0 → v7.0.1
codecov/codecov-action	action	major	v5.5.2 → v7.0.0
conda-incubator/setup-miniconda	action	major	v3.3.0 → v4.0.1
mamba-org/setup-micromamba	action	major	v2.0.7 → v3.1.0

---

Release Notes

actions/cache (actions/cache)

v6.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in #​1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

• Update packages, migrate to ESM by @​Samirat in #​1760

Full Changelog: actions/cache@v5...v6.0.0

v6

Compare Source

v5.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in #​1775

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

Compare Source

What's Changed

• Update ts-http-runtime dependency by @​yacaovsnc in #​1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

Compare Source

What's Changed

• Add release instructions and update maintainer docs by @​Link- in #​1696
• Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @​Link- in #​1697
• Fix workflow permissions and cleanup workflow names / formatting by @​Link- in #​1699
• docs: Update examples to use the latest version by @​XZTDean in #​1690
• Fix proxy integration tests by @​Link- in #​1701
• Fix cache key in examples.md for bun.lock by @​RyPeck in #​1722
• Update dependencies & patch security vulnerabilities by @​Link- in #​1738

New Contributors

• @​XZTDean made their first contribution in #​1690
• @​RyPeck made their first contribution in #​1722

Full Changelog: actions/cache@v5...v5.0.4

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/download-artifact (actions/download-artifact)

v8.0.1

Compare Source

What's Changed

• Support for CJK characters in the artifact name by @​danwkennedy in #​471
• Add a regression test for artifact name + content-type mismatches by @​danwkennedy in #​472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

Compare Source

v8 - What's new

[!IMPORTANT]
actions/download-artifact@​v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @​actions/* packages, we've upgraded the package to ESM.

What's Changed

• Don't attempt to un-zip non-zipped downloads by @​danwkennedy in #​460
• Add a setting to specify what to do on hash mismatch and default it to error by @​danwkennedy in #​461

Full Changelog: actions/download-artifact@v7...v8.0.0

v8

Compare Source

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

v7

Compare Source

v6.3.0

Compare Source

What's Changed

Enhancement

• Add RHEL support and include Linux distro in cache keys by @​priyagupta108 in #​1323
• Fix pip cache error handling on Windows by @​priyagupta108 in #​1040

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​1281
• Upgrade actions dependencies by @​gowridurgad with @​Copilot in #​1303
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1324
• Upgrade dependency versions and test workflow configuration by @​HarithaVattikuti in #​1322

Documentation

• Update advanced-usage.md by @​Dunky-Z in #​811

New Contributors

• @​gowridurgad with @​Copilot made their first contribution in #​1303
• @​jasongin made their first contribution in #​1324
• @​Dunky-Z made their first contribution in #​811

Full Changelog: actions/setup-python@v6...v6.3.0

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in #​754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in #​762
• Support direct file uploads by @​danwkennedy in #​764

New Contributors

• @​Link- made their first contribution in #​754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v7

Compare Source

codecov/codecov-action (codecov/codecov-action)

v7.0.0

Compare Source

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v7

Compare Source

v6.0.2

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

Compare Source

What's Changed

• fix: prevent template injection in run: steps (VULN-1652) by @​thomasrockhu-codecov in #​1947
• chore(release): 6.0.1 by @​thomasrockhu-codecov in #​1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

Compare Source

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

• Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by @​thomasrockhu-codecov in #​1929
• Th/6.0.0 by @​thomasrockhu-codecov in #​1928

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v6

Compare Source

v5.5.5

Compare Source

This release only contains the keybase.io change as described here.

Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5

v5.5.4

Compare Source

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

• Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by @​thomasrockhu-codecov in #​1926
• chore(release): 5.5.4 by @​thomasrockhu-codecov in #​1927

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

v5.5.3

Compare Source

What's Changed

• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​1874
• chore(release): bump to 5.5.3 by @​thomasrockhu-codecov in #​1922

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

conda-incubator/setup-miniconda (conda-incubator/setup-miniconda)

v4.0.1

Compare Source

Fixes

• Fix MultipleKeysError on conda 25.11+ when a user-supplied condarc-file
  already declares auto_activate: now only one of auto_activate /
  auto_activate_base is written to .condarc, preferring whichever key the
  user's existing condarc uses.
• Add auto_activate to the boolean coercion set so its value is serialized as
  a YAML boolean when it is the chosen canonical key.
• Add local_repodata_ttl to KNOWN_CONDARC_KEYS to silence a spurious
  "Unrecognized condarc key" warning for a valid conda key.

v4.0.0

Compare Source

Breaking Changes

• #​459: Upgrade action runtime to Node.js 24.x (requires runners with
  Node 24 support; this is the reason for the v4 major bump)
• #​450: Switch action build to ESM (for @actions/exec v3)

Features and Enhancements

• #​469: Add conda-init input to optionally skip conda init and
  document activation for restricted environments
• #​482: Add channels parsing utility and URL validation
• #​481: Enable stricter TypeScript checks and typing
• #​480: Add more tests, increase coverage, add Codecov integration and
  coverage badge
• #​479: Add TypeDoc-based API docs, generation and checks; configure
  GitHub Pages and Netlify previews

Fixes

• #​465: Fix double channel configuration being applied
• #​467: Speed up Windows post-run cleanup by moving the extracted
  packages directory instead of removing files one by one
• #​470: Fix name-version-build syntax expansion and add tests
• #​475: Split shell init and activation of the test environment to remove
  spurious warning

Performance

• #​486: Remove HTML index scraping for Miniconda version validation
• #​487: Parallelize Windows takeown calls with Promise.all
• #​488: Replace isDefaultEnvironment subprocess with local YAML reads
• #​489: Replace conda config subprocesses with direct .condarc YAML
  writes

Tasks and Maintenance

• #​444: Bump conda-incubator/setup-miniconda from 3.2.0 to 3.3.0
• #​445: Bump actions/checkout from 6.0.1 to 6.0.2
• #​449: Bump @​actions/exec from 2.0.0 to 3.0.0
• #​456, #​484, #​491: Bump actions/upload-artifact
• #​460: Bump actions/download-artifact from 7.0.0 to 8.0.1
• #​464: Update dependencies for actions and packages
• #​466: Bump @​actions/tool-cache from 2.0.2 to 4.0.0
• #​473: Bump flatted from 3.2.9 to 3.4.2
• #​476: Bump picomatch
• #​477: Bump conda-incubator/installer from 0.1.0 to 0.1.1
• #​485: Bump vite from 8.0.0 to 8.0.8
• #​492: Bump actions/upload-pages-artifact from 3 to 5
• #​493: Bump marocchino/sticky-pull-request-comment from 2 to 3
• #​494: Bump actions/deploy-pages from 4 to 5
• #​495: Bump codecov/codecov-action from 5 to 6
• #​496: Bump @​actions/core from 3.0.0 to 3.0.1

v4

Compare Source

Fixes

• Fix MultipleKeysError on conda 25.11+ when a user-supplied condarc-file
  already declares auto_activate: now only one of auto_activate /
  auto_activate_base is written to .condarc, preferring whichever key the
  user's existing condarc uses.
• Add auto_activate to the boolean coercion set so its value is serialized as
  a YAML boolean when it is the chosen canonical key.
• Add local_repodata_ttl to KNOWN_CONDARC_KEYS to silence a spurious
  "Unrecognized condarc key" warning for a valid conda key.

mamba-org/setup-micromamba (mamba-org/setup-micromamba)

v3.1.0

Compare Source

What's Changed

New features

• Support Windows ARM64 (win-arm64) by @​weiji14 in #​269

Documentation

• Update README examples to use setup-micromamba v3 by @​pavelzw with @​Copilot in #​305

Dependency updates

• Bump the actions group with 3 updates by @​dependabot[bot] in #​299
• Bump the actions group across 1 directory with 5 updates by @​dependabot[bot] in #​308
• Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group by @​dependabot[bot] in #​311
• Bump the actions group with 3 updates by @​dependabot[bot] in #​312
• Bump the node group across 1 directory with 14 updates by @​dependabot[bot] in #​309

New Contributors

• @​pavelzw with @​Copilot made their first contribution in #​305
• @​weiji14 made their first contribution in #​269

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

v3.0.0

Compare Source

What's Changed

New features

• Update Node.js version from 20 to 24 by @​glass-ships in #​296
• Hash bytes rather than encoded string by @​bhperry in #​297

Dependency updates

• Bump the node group with 9 updates by @​dependabot[bot] in #​286
• Bump the actions group with 2 updates by @​dependabot[bot] in #​285
• Bump the node group across 1 directory with 13 updates by @​dependabot[bot] in #​292
• Bump the actions group across 1 directory with 4 updates by @​dependabot[bot] in #​289
• Bump the node group across 1 directory with 14 updates by @​dependabot[bot] in #​294

Other changes

• Pin github actions by @​pavelzw in #​298

New Contributors

• @​glass-ships made their first contribution in #​296

Full Changelog: mamba-org/setup-micromamba@v2...v3.0.0

v3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for conda-lock ready!

Name	Link
🔨 Latest commit	80a96fb
🔍 Latest deploy log	https://app.netlify.com/projects/conda-lock/deploys/6a634cc47b96ad000818728f
😎 Deploy Preview	https://deploy-preview-898--conda-lock.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.