Bump actions/upload-artifact from 4 to 7#1382
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Changed
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
|
|
||
| - name: Upload artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| uses: actions/upload-artifact@v7 |
There was a problem hiding this comment.
Upload/download artifact version mismatch may break downloads
Medium Severity
actions/upload-artifact is bumped to v7 but actions/download-artifact remains at v4 in both build-riscv64.yml (line 118) and build-wheels.yml (line 479). These upload/download action pairs are designed to be used at matching major versions. The upload jobs produce artifacts that later jobs in the same workflow attempt to download—a version mismatch risks download failures if the v7 upload uses API features that v4 download doesn't understand. download-artifact v7 exists and needs to be bumped in tandem.
Additional Locations (1)
Pull Request Test Coverage Report for Build 22782253161Details
💛 - Coveralls |
|
Superseded by #1416. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/upload-artifact-7
branch
Bumps actions/upload-artifact from 4 to 7.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEddc45eddocs: update README to correct action name for Node.js 24 support615b319chore: release v6.0.0 for Node.js 24 support017748bMerge pull request #744 from actions/fix-storage-blob38d4c79chore: rebuild distDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Medium Risk
CI-only change, but it affects artifact publishing paths across multiple workflows; failures would break release/build pipelines if runner compatibility or action behavior changes.
Overview
CI dependency bump: Updates all GitHub Actions workflows that upload build outputs to use
actions/upload-artifact@v7instead of@v4.This change applies to artifact uploads for the Rust crate, the WASM/NPM package, riscv64 wheel builds, and the main Python wheel/sdist workflows, with no code or build commands otherwise modified.
Written by Cursor Bugbot for commit 7438e36. This will update automatically on new commits. Configure here.