chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v6.0.2 → v6.1.0
actions/create-github-app-token	action	minor	v3.0.0 → v3.2.0
actions/labeler	action	minor	v6.0.1 → v6.2.0
actions/upload-artifact	action	patch	v7.0.0 → v7.0.2
changesets/action	action	minor	v1.7.0 → v1.9.0
juulsn/todo-issue	action	pinDigest	→ c27fbdb
mscharley/dependency-changesets-action	action	patch	v1.2.3 → v1.2.5
stefanzweifel/git-auto-commit-action	action	minor	v7.1.0 → v7.2.0
withstudiocms/automations	action	pinDigest	→ f32588d
withstudiocms/automations (changelog)	workflow	digest	274ff11 → f32588d

---

Release Notes

actions/checkout (actions/checkout)

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features

• add support for enterprise-level GitHub Apps (#​263) (952a2a7)
• support full repository names in repositories input (#​372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#​364) (43e5c34)
• validate private-key input (#​376) (f24bbd8)

v3.1.1

Compare Source

Bug Fixes

• improve error message when app identifier is empty (#​362) (07e2b76), closes #​249

v3.1.0

Compare Source

Bug Fixes

• deps: bump p-retry from 7.1.1 to 8.0.0 (#​357) (3bbe07d)

Features

• add client-id input and deprecate app-id (#​353) (e6bd4e6)
• update permission inputs (#​358) (076e948)

actions/labeler (actions/labeler)

v6.2.0

Compare Source

What's Changed

Bug Fix

• Improve PR number validation and warning messages in input handling by @​chiranjib-swain in #​939

Dependency Updates

• Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by @​dependabot in #​943
• Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 by @​dependabot in #​942

Full Changelog: actions/labeler@v6.1.0...v6.2.0

v6.1.0

Compare Source

Enhancements

• Add changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by @​bluca in #​923

Bug Fixes

• Improve Labeler Action documentation and permission error handling by @​chiranjib-swain in #​897
• Preserve manually added labels during workflow runs and refine label synchronization logic by @​chiranjib-swain in #​917

Dependency Updates

• Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by @​dependabot in #​877
• Upgrade minimatch from 10.0.1 to 10.2.3 by @​dependabot in #​926
• Upgrade dependencies (@​actions/core, @​actions/github, js-yaml, minimatch, @​typescript-eslint) by @​Copilot in #​934

New Contributors

• @​chiranjib-swain made their first contribution in #​897
• @​bluca made their first contribution in #​923
• @​Copilot made their first contribution in #​934

Full Changelog: actions/labeler@v6...v6.1.0

actions/upload-artifact (actions/upload-artifact)

v7.0.2

Compare Source

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in #​821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

changesets/action (changesets/action)

v1.9.0

Compare Source

Minor Changes

• #​636 b072bcc Thanks @​bluwy! - Add a new @changesets/action/pr-comment sub-action to comment on PRs

• #​625 8795eee Thanks @​bluwy! - Add a new @changesets/action/pr-status sub-action to generate the changeset status comment for PRs as an alternative to the Changesets Bot.

Patch Changes

• #​535 34f64f6 Thanks @​Andarist! - Fixed an issue with GitHub releases not being created for successfully published packages when some packages failed to be published to the registry.

• #​632 1d54b9e Thanks @​bluwy! - Simplify internal implementation to get changelog entries for a package version

• #​629 e0c90aa Thanks @​bluwy! - Fix custom version and publish command argument parsing

• #​645 f9585d9 Thanks @​Andarist! - Improved force-push handling when using commitMode: "github-api" so updating an existing branch no longer temporarily resets the target branch to the base commit, avoiding cases where GitHub closes open pull requests during the update. This should remove a possibility of a GitHub state race that caused the force-pushed PRs not being reopened.

v1.8.0

Compare Source

Minor Changes

• #​258 f5dbf72 Thanks @​tom-sherman! - Support draft version PR modes with a new prDraft input. Use create to create new version PRs as drafts, or always to also convert existing version PRs back to draft when updating them.

Patch Changes

• #​502 6002dbd Thanks @​oshytiko! - Fixed initial .changeset state being picked up, when cwd parameter is provided

• #​536 81b3f61 Thanks @​radnan! - Fixed .changeset state being picked for the version command when cwd parameter is provided

mscharley/dependency-changesets-action (mscharley/dependency-changesets-action)

v1.2.5

Compare Source

What's Changed

• Bug Fix: handle multi-document YAML in pnpm-lock.yaml by @​wisestuart in #​687

New Contributors

• @​wisestuart made their first contribution in #​687

Full Changelog: mscharley/dependency-changesets-action@v1.2.4...v1.2.5

v1.2.4

Compare Source

What's Changed

• fix: allow for pnpm workspaces that only define catalogs by @​mscharley in #​634
• fix: allow automated rebuilds of dist by @​mscharley in #​635
• fix: allow numeric version numbers in catalogs by @​mscharley in #​644

Full Changelog: mscharley/dependency-changesets-action@v1.2.3...v1.2.4

stefanzweifel/git-auto-commit-action (stefanzweifel/git-auto-commit-action)

v7.2.0

Compare Source

Added

• Add hooks to run shell snippets around git operations (#​411) @​stefanzweifel
• Emit warning for pull_request_target trigger usage (#​410) @​stefanzweifel

Fixed

• docs(action): fix input and output descriptions in action.yml (#​406) @​kranthipoturaju
• docs: fix typos, grammar, and formatting across markdown files (#​408) @​kranthipoturaju
• docs: fix broken and redirecting URLs in README.md (#​407) @​kranthipoturaju
• README: clearify meaning of the repository field (#​404) @​gucio321

Dependency Updates

• Bump actions/checkout from 6 to 7 (#​409) [@​dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))
• Bump release-drafter/release-drafter from 6 to 7 (#​403) [@​dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 03a9b28

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9bde4313-6367-4691-b768-02c1102e4b0a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}