Merge d86d1a437e into d632683dd7

Prepare 4.2.0 release (#1878 )
* Bump package version to 4.1.8 * Add v4.1.8 changelog * Bump version to `4.2.0`
2025-10-30 04:55:54 +08:00 · 2024-09-26 22:09:13 +05:30 · 2024-09-25 13:51:15 -04:00 · 2024-01-16 08:51:56 +13:00 · 2022-12-13 11:16:31 +13:00
4 changed files with 23 additions and 15 deletions
--- a/.github/workflows/update-main-version.yml
+++ b/.github/workflows/update-main-version.yml
@@ -18,6 +18,9 @@ on:
 jobs:
  tag:
    runs-on: ubuntu-latest
+    env:
+      TARGET: ${{ github.event.inputs.target }}
+      MAIN_VERSION: ${{ github.event.inputs.major_version }}
    steps:
    # Note this update workflow can also be used as a rollback tool.
    # For that reason, it's best to pin `actions/checkout` to a known, stable version
@@ -30,6 +33,6 @@ jobs:
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
    - name: Tag new target
-      run: git tag -f ${{ github.event.inputs.major_version }} ${{ github.event.inputs.target }}
+      run: git tag -f "$MAIN_VERSION" "$TARGET"
    - name: Push new tag
-      run: git push origin ${{ github.event.inputs.major_version }} --force
+      run: git push origin "$MAIN_VERSION" --force
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog

+## v4.2.0
+
+* Add Ref and Commit outputs by @lucacome in https://github.com/actions/checkout/pull/1180
+* Dependency updates by @dependabot- https://github.com/actions/checkout/pull/1777, https://github.com/actions/checkout/pull/1872
+
 ## v4.1.7
 * Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in https://github.com/actions/checkout/pull/1739
 * Bump actions/checkout from 3 to 4 by @dependabot in https://github.com/actions/checkout/pull/1697
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "checkout",
-  "version": "4.1.7",
+  "version": "4.2.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "checkout",
-      "version": "4.1.7",
+      "version": "4.2.0",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.1",
@@ -14,12 +14,12 @@
        "@actions/github": "^6.0.0",
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.1",
-        "uuid": "^10.0.0"
+        "uuid": "^9.0.1"
      },
      "devDependencies": {
        "@types/jest": "^29.5.12",
        "@types/node": "^20.12.12",
-        "@types/uuid": "^10.0.0",
+        "@types/uuid": "^9.0.8",
        "@typescript-eslint/eslint-plugin": "^7.9.0",
        "@typescript-eslint/parser": "^7.9.0",
        "@vercel/ncc": "^0.38.1",
@@ -1603,9 +1603,9 @@
      "dev": true
    },
    "node_modules/@types/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ==",
+      "version": "9.0.8",
+      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.8.tgz",
+      "integrity": "sha512-jg+97EGIcY9AGHJJRaaPVgetKDsrTgbRjQ5Msgjh/DQKEFl0DtyRr/VCOyD1T2R1MNeWPK/u7JoGhlDZnKBAfA==",
      "dev": true
    },
    "node_modules/@types/yargs": {
@@ -6991,9 +6991,9 @@
      }
    },
    "node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
+      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
      "funding": [
        "https://github.com/sponsors/broofa",
        "https://github.com/sponsors/ctavan"
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "checkout",
-  "version": "4.1.7",
+  "version": "4.2.0",
  "description": "checkout action",
  "main": "lib/main.js",
  "scripts": {
@@ -33,12 +33,12 @@
    "@actions/github": "^6.0.0",
    "@actions/io": "^1.1.3",
    "@actions/tool-cache": "^2.0.1",
-    "uuid": "^10.0.0"
+    "uuid": "^9.0.1"
  },
  "devDependencies": {
    "@types/jest": "^29.5.12",
    "@types/node": "^20.12.12",
-    "@types/uuid": "^10.0.0",
+    "@types/uuid": "^9.0.8",
    "@typescript-eslint/eslint-plugin": "^7.9.0",
    "@typescript-eslint/parser": "^7.9.0",
    "@vercel/ncc": "^0.38.1",
Author	SHA1	Message	Date
Y. Meyer-Norwood	d3fe023418	Merge `d86d1a437e` into `d632683dd7`	2024-09-26 22:09:13 +05:30
Josh Gross	d632683dd7	Prepare 4.2.0 release (#1878 ) * Bump package version to 4.1.8 * Add v4.1.8 changelog * Bump version to `4.2.0`	2024-09-25 13:51:15 -04:00
Y. Meyer-Norwood	d86d1a437e	Merge branch 'main' into patch-1	2024-01-16 08:51:56 +13:00
Y. Meyer-Norwood	fe77b196f4	Prevent Script Injection Attack The user provided inputs here are vulnerable to script injection. This PR uses an intermediary environment variable to treat the input as a string, rather than as part of the command. See: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable	2022-12-13 11:16:31 +13:00