chore(deps): bump the actions-version-updates group across 1 directory with 11 updates

[dependabot]

Bumps the actions-version-updates group with 11 updates in the / directory:

Package	From	To
step-security/harden-runner	2.12.0	2.19.1
actions/checkout	4.2.2	6.0.2
actions/dependency-review-action	4.7.1	4.9.0
actions/add-to-project	0.5.0	2.0.0
tspascoal/get-user-teams-membership	3	4
actions-ecosystem/action-add-labels	1.1.0	1.1.3
subosito/flutter-action	2.19.0	2.23.0
stefanzweifel/git-auto-commit-action	5.2.0	7.1.0
ossf/scorecard-action	2.4.1	2.4.3
github/codeql-action	3.28.18	4.35.3
mridang/action-test-reporter	1.7.0	3

Updates step-security/harden-runner from 2.12.0 to 2.19.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.1

What's Changed

• fix: detect ubuntu-slim runners early and bail out by @​devantler in step-security/harden-runner#657

What the fix changes

• Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

• Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
• Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

• @​devantler made their first contribution in step-security/harden-runner#657

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

v2.19.0

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

• Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.
• System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0

v2.18.0

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

v2.17.0

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

... (truncated)

Commits

• a5ad31d Merge pull request #657 from devantler/fix/ubuntu-slim-user-env
• 6e92856 build dist and trim ubuntu-slim message
• 4e0504e Merge branch 'main' into fix/ubuntu-slim-user-env
• 8d3c67d Release v2.19.0 (#661)
• 6c3c2f2 Feature/deploy on self hosted vm (#658)
• 376d25a fix: detect ubuntu-slim runners early and bail out
• f808768 Feature/policy store (#656)
• fe10465 v2.16.1 (#654)
• fa2e9d6 Release v2.16.0 (#646)
• 58077d3 Release v2.15.1 (#641)
• Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248
• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• v6-beta by @​ericsciple in actions/checkout#2298
• update readme/changelog for v6 by @​ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226
• Prepare v5.0.0 release by @​salmanmkc in actions/checkout#2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

v4.2.0

• Add Ref and Commit outputs by @​lucacome in actions/checkout#1180
• Dependency updates by @​dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

v4.1.6

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732

... (truncated)

Commits

• de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
• 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
• 8e8c483 Clarify v6 README (#2328)
• 033fa0d Add worktree support for persist-credentials includeIf (#2327)
• c2d88d3 Update all references from v5 and v4 to v6 (#2314)
• 1af3b93 update readme/changelog for v6 (#2311)
• 71cf226 v6-beta (#2298)
• 069c695 Persist creds to a separate file (#2286)
• ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
• 08c6903 Prepare v5.0.0 release (#2238)
• Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.7.1 to 4.9.0

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

• There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @​felickz!
• Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @​jantiebot!
• There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @​juxtin!

What's Changed

• Compare normalized purls to account for encoding quirks by @​juxtin in actions/dependency-review-action#1056
• Make purl comparisons case insensitive by @​juxtin in actions/dependency-review-action#1057
• Feat: Add Patched Version to Vulnerabilities summary by @​felickz in actions/dependency-review-action#1045
• fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @​jantiebot in actions/dependency-review-action#1060
• Bump actions/stale from 10.1.0 to 10.2.0 by @​dependabot[bot] in actions/dependency-review-action#1058
• Bump actions/checkout from 4 to 6 by @​dependabot[bot] in actions/dependency-review-action#1021
• Updates for release 4.9.0 by @​ahpook in actions/dependency-review-action#1064

New Contributors

• @​jantiebot made their first contribution in actions/dependency-review-action#1060

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

4.8.3

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

• GitHub Actions can't push to our protected main by @​dangoor in actions/dependency-review-action#1017
• Bump actions/stale from 9.1.0 to 10.1.0 by @​dependabot[bot] in actions/dependency-review-action#995
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in actions/dependency-review-action#1003
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in actions/dependency-review-action#1005
• Upgrade glob to address a vulnerability by @​brrygrdn in actions/dependency-review-action#1024
• Bump js-yaml by @​dependabot[bot] in actions/dependency-review-action#1020
• Addressing vulnerabilities by @​Ahmed3lmallah in actions/dependency-review-action#1036
• Bump fast-xml-parser from 5.3.3 to 5.3.5 by @​dependabot[bot] in actions/dependency-review-action#1050
• Bump fast-xml-parser from 5.3.5 to 5.3.6 by @​dependabot[bot] in actions/dependency-review-action#1053
• Properly truncate long summaries and catch errors by @​juxtin in actions/dependency-review-action#1052
• Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by @​dependabot[bot] in actions/dependency-review-action#931
• Changes for Release 4.8.3 by @​ahpook in actions/dependency-review-action#1054

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

v4.8.2

Minor fixes:

• Fix PURL parsing for scoped packages (#1008 from @​danielhardej)
• Fix for large summaries (#1007 from @​gitulisca)

... (truncated)

Commits

• 2031cfc Merge pull request #1064 from actions/ahpook/release-4.9.0
• d02fa39 Updates for release 4.9.0
• 4038a34 Merge pull request #1021 from actions/dependabot/github_actions/actions/check...
• a632b83 Merge pull request #1058 from actions/dependabot/github_actions/actions/stale...
• 57a3d46 Merge pull request #1060 from jantiebot/main
• 5ecdc4b Merge pull request #1045 from forks-felickz/main
• e8c2f9a fix: remove inferrable type annotation to pass eslint
• 0e129e1 Prettier - Refactor summary table rendering for improved readability
• aa60746 Add 'show-patched-versions' option to configuration and update summary handling
• e404798 Merge upstream actions/dependency-review-action main
• Additional commits viewable in compare view

Updates actions/add-to-project from 0.5.0 to 2.0.0

Release notes

Sourced from actions/add-to-project's releases.

v2

What's Changed

• Update instructions for fine grained PAT by @​talune in actions/add-to-project#596
• build(deps-dev): bump prettier from 3.2.5 to 3.3.2 by @​dependabot[bot] in actions/add-to-project#594
• build(deps-dev): bump eslint-plugin-github from 4.10.2 to 5.0.1 by @​dependabot[bot] in actions/add-to-project#593
• Resolve Regular Expression syntax checking errors by @​talune in actions/add-to-project#598
• build(deps-dev): bump typescript from 5.4.5 to 5.5.2 by @​dependabot[bot] in actions/add-to-project#595
• build(deps-dev): bump ts-jest from 29.1.5 to 29.3.0 by @​dependabot[bot] in actions/add-to-project#675
• Batch updating some dependencies for vulns by @​TylerDixon in actions/add-to-project#679
• build(deps): bump undici from 5.28.4 to 5.28.5 by @​dependabot[bot] in actions/add-to-project#662
• build(deps-dev): bump eslint-plugin-prettier from 5.1.3 to 5.2.5 by @​dependabot[bot] in actions/add-to-project#682
• Have dependabot also run builds as another commit when creating PRs by @​TylerDixon in actions/add-to-project#684
• build(deps): bump @​octokit/request-error from 5.1.1 to 6.1.7 by @​dependabot[bot] in actions/add-to-project#683
• build(deps): bump @​octokit/request from 8.4.1 to 9.2.2 by @​dependabot[bot] in actions/add-to-project#681
• Bump eslint-plugin-jest from 28.6.0 to 28.11.0 by @​dependabot[bot] in actions/add-to-project#685
• Bump @​types/node from 16.18.101 to 22.13.14 by @​dependabot[bot] in actions/add-to-project#686
• Bump @​types/jest from 29.5.12 to 29.5.14 by @​dependabot[bot] in actions/add-to-project#687
• Bump @​vercel/ncc from 0.38.1 to 0.38.3 by @​dependabot[bot] in actions/add-to-project#688
• Bump ts-jest from 29.3.0 to 29.3.2 by @​dependabot[bot] in actions/add-to-project#694
• chore: removes sourcemap-register from build step by @​andrialexandrou in actions/add-to-project#696
• Bump @​octokit/plugin-paginate-rest from 9.2.2 to 13.0.1 by @​dependabot[bot] in actions/add-to-project#699
• Bump ts-jest from 29.3.2 to 29.4.0 by @​dependabot[bot] in actions/add-to-project#703
• Bump @​types/node from 22.13.14 to 24.0.12 by @​dependabot[bot] in actions/add-to-project#709
• Potential fix for code scanning alert no. 6: Workflow does not contain permissions by @​wiinci in actions/add-to-project#715
• Potential fix for code scanning alert no. 5: Workflow does not contain permissions by @​wiinci in actions/add-to-project#716
• Potential fix for code scanning alert no. 7: Workflow does not contain permissions by @​wiinci in actions/add-to-project#717
• Fix code scanning alert:missing regex anchor by @​wiinci in actions/add-to-project#719
• Add Missing Languages to CodeQL Advanced Configuration by @​KyFaSt in actions/add-to-project#710
• Bump @​octokit/request from 9.2.2 to 10.0.3 by @​dependabot[bot] in actions/add-to-project#705
• Bump concurrently from 8.2.2 to 9.2.0 by @​dependabot[bot] in actions/add-to-project#707
• Bump prettier from 3.3.2 to 3.6.2 by @​dependabot[bot] in actions/add-to-project#721
• Bump concurrently from 9.2.0 to 9.2.1 by @​dependabot[bot] in actions/add-to-project#722
• Bump @​types/node from 24.0.12 to 24.5.2 by @​dependabot[bot] in actions/add-to-project#730
• Bump actions/checkout from 4 to 5 by @​dependabot[bot] in actions/add-to-project#714
• Bump actions/setup-node from 4 to 5 by @​dependabot[bot] in actions/add-to-project#726
• build(deps-dev): bump @​typescript-eslint/parser from 7.14.1 to 7.18.0 by @​dependabot[bot] in actions/add-to-project#616
• Bump ts-jest from 29.4.1 to 29.4.5 by @​dependabot[bot] in actions/add-to-project#742
• Bump js-yaml from 3.14.1 to 3.14.2 by @​dependabot[bot] in actions/add-to-project#750
• Bump actions/upload-artifact from 4 to 5 by @​dependabot[bot] in actions/add-to-project#748
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in actions/add-to-project#741
• Bump jest and @​types/jest by @​dependabot[bot] in actions/add-to-project#743
• Bump actions/setup-node from 5 to 6 by @​dependabot[bot] in actions/add-to-project#744
• Consolidate ESLint 9 and TypeScript ESLint 8 dependency updates by @​Copilot in actions/add-to-project#751
• Bump @​octokit/request-error from 6.1.8 to 7.1.0 by @​dependabot[bot] in actions/add-to-project#757
• Bump globals from 15.15.0 to 16.5.0 by @​dependabot[bot] in actions/add-to-project#756
• Bump @​octokit/plugin-paginate-rest from 13.1.1 to 14.0.0 by @​dependabot[bot] in actions/add-to-project#754
• Bump @​vercel/ncc from 0.38.3 to 0.38.4 by @​dependabot[bot] in actions/add-to-project#753
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in actions/add-to-project#752
• Bump eslint from 9.39.1 to 9.39.2 by @​dependabot[bot] in actions/add-to-project#759
• Bump ts-jest from 29.4.5 to 29.4.6 by @​dependabot[bot] in actions/add-to-project#760

... (truncated)

Commits

• 5afcf98 Merge pull request #712 from salmanmkc/node24
• ffed68f Merge main and update action runtime to Node 24
• 27022a1 Merge pull request #777 from actions/dependabot/npm_and_yarn/types/node-25.5.0
• cc89d2e Merge pull request #778 from actions/dependabot/npm_and_yarn/globals-17.4.0
• ef8e6ff Merge pull request #779 from actions/dependabot/npm_and_yarn/eslint-plugin-je...
• eb406b3 Merge pull request #780 from actions/dependabot/npm_and_yarn/handlebars-4.7.9
• bb8d4d7 Bump handlebars from 4.7.8 to 4.7.9
• a6fcf8b Bump eslint-plugin-jest from 29.12.1 to 29.15.1
• b35f5d3 Bump globals from 17.0.0 to 17.4.0
• 036fea0 Bump @​types/node from 25.0.3 to 25.5.0
• Additional commits viewable in compare view

Updates tspascoal/get-user-teams-membership from 3 to 4

Release notes

Sourced from tspascoal/get-user-teams-membership's releases.

4.0.0

What's Changed

Maintenance release to upgrade to node 24

• Upgrade action runtime to node24 by @​Copilot in tspascoal/get-user-teams-membership#54
• docs: add GitHub Apps installation token as supported auth option by @​Copilot in tspascoal/get-user-teams-membership#52
• docs(readme): add note about fine-grained personal access token permissions by @​kakakakakku in tspascoal/get-user-teams-membership#40
• fix typo in example by @​bryangingechen in tspascoal/get-user-teams-membership#42

Runtime Dependencies Updates

• Bump @​actions/core from 2.0.1 to 3.0.0 by @​dependabot[bot] in tspascoal/get-user-teams-membership#48
• Bump @​actions/github from 6.0.1 to 9.0.0 by @​dependabot[bot] in tspascoal/get-user-teams-membership#49

New Contributors

• @​bryangingechen made their first contribution in tspascoal/get-user-teams-membership#42
• @​kakakakakku made their first contribution in tspascoal/get-user-teams-membership#40

Full Changelog: tspascoal/get-user-teams-membership@v3...v4.0.0

Commits

• 818140d dist for for 4.0.1
• a6c1534 Merge pull request #61 from tspascoal/add-unit-tests
• 59b7148 bump version on package.json
• 44e3797 Add unit tests
• d99840d Merge pull request #60 from tspascoal/user-required
• 097de9a Merge pull request #59 from tspascoal/improve-performance
• ddff291 fix: make username input required in getInput
• 8fba4f0 Improve performance by increasing the page size
• 90aeb63 Merge pull request #58 from tspascoal/copilot/fix-isteammember-output-docs
• 05c1b17 fix name in action.yml
• Additional commits viewable in compare view

Updates actions-ecosystem/action-add-labels from 1.1.0 to 1.1.3

Commits

• 18f1af5 Make github_token not requirement (#259)
• 7548625 Update default branch for release trigger (#254)
• a8ae047 Update workflow trigger pull_request -> pull_request_target (#183)
• b2442fe Make github_token input optional (#160)
• 442934f Bump lodash from 4.17.15 to 4.17.19 (#69)
• 4efa0cd Bump @​actions/core from 1.2.4 to 1.2.6 (#100)
• cff25c1 Bump jest-circus from 24.9.0 to 26.0.1 (#40)
• 7fd0d4e Bump @​zeit/ncc from 0.20.5 to 0.22.3 (#42)
• bdfefdd Bump @​types/semver from 6.2.1 to 7.2.0 (#41)
• 96c379d Bump typescript from 3.8.3 to 3.9.3 (#39)
• Additional commits viewable in compare view

Updates subosito/flutter-action from 2.19.0 to 2.23.0

Release notes

Sourced from subosito/flutter-action's releases.

v2.23.0

What's Changed

• feat: fvm support by @​pedroafmonteiro in subosito/flutter-action#383
• Add separate pub-cache boolean flag by @​kuhnroyal in subosito/flutter-action#377
• chores by @​bartekpacia in subosito/flutter-action#390
• add a CI job that checks out a specific master commit by @​bartekpacia in subosito/flutter-action#391
• readme: minor updates by @​bartekpacia in subosito/flutter-action#392
• Simplify extraction of zip files by @​kuhnroyal in subosito/flutter-action#379

New Contributors

• @​pedroafmonteiro made their first contribution in subosito/flutter-action#383

Full Changelog: subosito/flutter-action@v2...v2.23.0

v2.22.0

What's Changed

• Upgrade actions/cache to v5 by @​Azincc in subosito/flutter-action#385
• Remove macos-13 (Intel) runner from CI by @​bartekpacia in subosito/flutter-action#388

New Contributors

• @​Azincc made their first contribution in subosito/flutter-action#385

Full Changelog: subosito/flutter-action@v2...v2.22.0

v2.21.0

What's Changed

• Add cache hit outputs by @​beninato8 in subosito/flutter-action#364
• fix broken links in README by @​bartekpacia in subosito/flutter-action#365
• Support dynamic values for PUB-CACHE-PATH by @​beninato8 in subosito/flutter-action#363

New Contributors

• @​beninato8 made their first contribution in subosito/flutter-action#364

Full Changelog: subosito/flutter-action@v2.20.0...v2.21.0

v2.20.0

What's Changed

• perf: Only install yq on Windows if used by @​christerswahn in subosito/flutter-action#362
• use env if it existed by @​atishoo in subosito/flutter-action#360

New Contributors

• @​christerswahn made their first contribution in subosito/flutter-action#362
• @​atishoo made their first contribution in subosito/flutter-action#360

Full Changelog: subosito/flutter-action@v2...v2.20.0

Commits

• 1a44944 Simplify extraction of zip files (#379)
• 4efee11 readme: minor updates (#392)
• d97c38e add a CI job that checks out a specific master commit (#391)
• 75b905c chores (#390)
• 7ff07e9 Add separate pub-cache boolean flag (#377)
• 6622f58 feat: fvm support (#383)
• 0ca7a94 Remove macos-13 (Intel) runner from CI (#388)
• de04a6a Upgrade actions/cache to v5 (#385)
• fd55f4c Support dynamic values for PUB-CACHE-PATH (#363)
• ca16aee fix broken links in README (#365)
• Additional commits viewable in compare view

Updates stefanzweifel/git-auto-commit-action from 5.2.0 to 7.1.0

Release notes

Sourced from stefanzweifel/git-auto-commit-action's releases.

v7.1.0

Added

• Add skip_push input option (#401) @​kvanzuijlen

Changes

• docs: fix typo in README.md (#400) @​GideonBear

Dependency Updates

• Bump actions/checkout from 5 to 6 (#399) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))
• Bump bats from 1.12.0 to 1.13.0 (#398) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.0.0

Added

• Restore skip_fetch, skip_checkout, create_branch (#388) @​stefanzweifel
• Restore Detached State Detection (#393) @​stefanzweifel
• Add Support for Tag Messages (