chore(deps): bump the github-actions group with 2 updates by dependabot[bot] · Pull Request #1113 · microsoft/vscode-java-dependency

dependabot · 2026-10-23T02:54:26Z

Bumps the github-actions group with 2 updates: actions/setup-java and actions/create-github-app-token.

Updates actions/setup-java from 6.0.1 to 6.1.0

Release notes

Sourced from actions/setup-java's releases.

v6.1.0

What's Changed

Preserve compound Liberica build versions from .sdkmanrc by @brunoborges with @Copilot in actions/setup-java#1268

Support Temurin on Linux RISC-V by @yawkat in actions/setup-java#1269

Stop GPG agent before removing signature-verification home by @brunoborges with @Copilot in actions/setup-java#1273

Prefer Zulu 4-segment hotfix builds when resolving version ranges by @brunoborges in actions/setup-java#1278

Support Temurin JEP 322 patch versions like 26.0.2.1+1 by @brunoborges in actions/setup-java#1279

chore(deps): bump undici from 6.28.0 to 6.29.0 by @dependabot[bot] in actions/setup-java#1274

chore(deps): bump the monthly-npm-updates group with 13 updates by @dependabot[bot] in actions/setup-java#1276

feat: support Maven server credential origins by @YunaBraska in actions/setup-java#1282

Support Maven plugin repositories in generated settings.xml by @brunoborges in actions/setup-java#1286

New Contributors

@yawkat made their first contribution in actions/setup-java#1269

@YunaBraska made their first contribution in actions/setup-java#1282

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

Commits

b843ebf Support Maven plugin repositories in generated settings.xml (#1286)
2a69be2 feat: support Maven server credential origins (#1282)
d0e6e4d chore(deps): bump the monthly-npm-updates group with 13 updates (#1276)
b24925b chore(deps): bump undici from 6.28.0 to 6.29.0 (#1274)
47b3648 Support Temurin JEP 322 patch versions like 26.0.2.1+1 (#1270) (#1279)
74920aa Prefer Zulu 4-segment hotfix builds when resolving version ranges (#1278)
a78ec39 Stop GPG agent before removing signature-verification home (#1273)
97c5a5e Support Temurin on Linux RISC-V (#1269)
1aa87b6 Preserve compound Liberica build versions from .sdkmanrc (#1268)
See full diff in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)

deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)

deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

add support for enterprise-level GitHub Apps (#263) (952a2a7)

support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)

validate private-key input (#376) (f24bbd8)

Commits

64ab729 chore(main): release 3.3.0 (#402)
f3a828e ci: create signed dist commits in release workflow (#404)
655017f docs: clarify when owner grants access to all repositories (#378)
12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
a47236f feat: update permission inputs (#399)
a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
e85f677 test: omit stack traces from snapshots (#401)
9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 2 updates: [actions/setup-java](https://github.com/actions/setup-java) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token). Updates `actions/setup-java` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@de7274f...b843ebf) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@bcd2ba4...64ab729) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

azure-pipelines · 2026-10-23T02:54:37Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Changyong Gong (chagong) · 2026-10-23T07:35:01Z

Decision: MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-dependency
Pull request: microsoft/vscode-java-dependency#1113 - chore(deps): bump the github-actions group with 2 updates
Update: Grouped minor updates: actions/setup-java 6.0.1 -> 6.1.0; actions/create-github-app-token 3.2.0 -> 3.3.0.
Safety assessment: Dependabot-only history; GitHub Actions-Only Gate passed. All nine edits are immutable SHA references matching release tags. Both actions remain necessary for JDK provisioning and coordinator authentication. Release notes and action interfaces confirm compatible existing inputs and unchanged Node 24 runtimes; post-merge-only token dispatch was not exercised on this PR. Low risk.
Final state: Head 319f5a5; MERGED at 2026-10-23T07:34:12Z; review APPROVED; merge state UNKNOWN after merge (CLEAN and MERGEABLE immediately before merge). All 33 checks passed, including all four required checks; none failed or pending.
Actions taken: Verified current-base ancestry; no branch update needed. Retrieved both failed-job logs and compared default-branch history. Reran Linux run 39892125758 and Windows run 39892125626 once each; both unchanged attempt-2 runs passed, confirming FLAKY_OR_TRANSIENT test-hook timeouts. No source changes, commits, or pushes. Requested Copilot review; no feedback was present at the final review refresh. Approved the audited head, rechecked reviews/CI/ancestry, and squash-merged as cc51c43; mergedAt verified.
Reason: None
Next action: None

Copilot

🟢 Approval recommended

The pins match the stated releases, existing workflow inputs remain compatible, and no blocking issues were identified.

No open issues 🎉

What changed in this PR

Updates two pinned GitHub Actions used by the extension’s CI and team-memory automation, without changing workflow inputs or job logic.

Changes:

Bumps actions/setup-java from 6.0.1 to 6.1.0 across platform and E2E workflows.
Bumps actions/create-github-app-token from 3.2.0 to 3.3.0 for coordinator dispatch.
Retains full commit-SHA pins with matching version comments.

File	Description
`.github/workflows/windows.yml`	Updates Java setup for Windows CI.
`.github/workflows/team-memory-post-merge.yml`	Updates token creation for coordinator dispatch.
`.github/workflows/macOS.yml`	Updates Java setup for macOS CI.
`.github/workflows/linux.yml`	Updates Java setup for Linux CI.
`.github/workflows/e2eUI.yml`	Updates Java setup in five E2E workflow jobs.

_{Review effort: Balanced}

dependabot Bot requested a review from Jinbo Wang (testforstephen) as a code owner October 23, 2026 02:54

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026

dependabot Bot requested review from Changyong Gong (chagong) and wenyt (wenytang-ms) as code owners October 23, 2026 02:54

dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Oct 23, 2026

Changyong Gong (chagong) requested a balanced review from Copilot October 23, 2026 07:33

Changyong Gong (chagong) approved these changes Oct 23, 2026

View reviewed changes

Changyong Gong (chagong) merged commit cc51c43 into main Oct 23, 2026
34 of 36 checks passed

dependabot Bot deleted the dependabot/github_actions/github-actions-783b37b52c branch October 23, 2026 07:34

Copilot started reviewing on behalf of Changyong Gong (chagong) October 23, 2026 07:34

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore(deps): bump the github-actions group with 2 updates - #1113

chore(deps): bump the github-actions group with 2 updates#1113
Changyong Gong (chagong) merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-783b37b52c

dependabot Bot commented on behalf of github Oct 23, 2026

Uh oh!

azure-pipelines Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Changyong Gong (chagong) commented Oct 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026

v6.1.0

What's Changed

New Contributors

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

3.2.0 (2026-05-12)

Features

Bug Fixes

Uh oh!

azure-pipelines Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Changyong Gong (chagong) commented Oct 23, 2026

Dependabot PR Manager result

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants