chore(deps): update github-actions-updates (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	major	v4 → v5
actions/checkout	action	major	v5 → v6
actions/download-artifact	action	major	v5 → v8
actions/upload-artifact	action	major	v4 → v7
codecov/codecov-action	action	major	v5.5.1 → v6.0.0
crazy-max/ghaction-github-labeler	action	major	v5.3.0 → v6.0.0
release-drafter/release-drafter	action	major	v6.1.0 → v7.2.0

---

Release Notes

actions/cache (actions/cache)

v5

Compare Source

actions/checkout (actions/checkout)

v6

Compare Source

actions/download-artifact (actions/download-artifact)

v8

Compare Source

v7

Compare Source

v6

Compare Source

actions/upload-artifact (actions/upload-artifact)

v7

Compare Source

v6

Compare Source

v5

Compare Source

codecov/codecov-action (codecov/codecov-action)

v6.0.0

Compare Source

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

• Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by @​thomasrockhu-codecov in #​1929
• Th/6.0.0 by @​thomasrockhu-codecov in #​1928

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v5.5.4

Compare Source

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

• Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by @​thomasrockhu-codecov in #​1926
• chore(release): 5.5.4 by @​thomasrockhu-codecov in #​1927

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

v5.5.3

Compare Source

What's Changed

• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​1874
• chore(release): bump to 5.5.3 by @​thomasrockhu-codecov in #​1922

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

v5.5.2

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

crazy-max/ghaction-github-labeler (crazy-max/ghaction-github-labeler)

v6.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​249
• Switch to ESM and update config/test wiring by @​crazy-max in #​246
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​247
• Bump @​actions/github from 6.0.0 to 9.0.0 in #​248
• Bump brace-expansion from 1.1.11 to 1.1.12 in #​236
• Bump js-yaml from 4.1.0 to 4.1.1 in #​240
• Bump lodash from 4.17.21 to 4.17.23 in #​242
• Bump matcher from 3.0.0 to 6.0.0 in #​239
• Bump minimatch from 3.1.2 to 3.1.5 in #​245

Full Changelog: crazy-max/ghaction-github-labeler@v5.3.0...v6.0.0

release-drafter/release-drafter (release-drafter/release-drafter)

v7.2.0

Compare Source

What's Changed

New

• feat: allow always collapsing a category (#​1444) @​mhanberg

Bug Fixes

• fix: improve advanced substitutions in replacers (#​1555) @​jetersen
• fix: support repo-only _extends and prevent .github/ path doubling (#​1577) @​jetersen

Maintenance

• chore(deps): update dependency typescript to 6.0.2 (#​1587) @​renovate[bot]
• chore(deps): update vitest to 4.1.4 (#​1585) @​renovate[bot]
• ci(deps): update peter-evans/create-pull-request action to v8 (#​1588) @​renovate[bot]
• chore(deps): update dependency vite to 8.0.5 (#​1579) @​renovate[bot]
• chore(deps): update dependency nock to 14.0.12 (#​1583) @​renovate[bot]
• chore(deps): update dependency @​types/node to 24.12.2 (#​1582) @​renovate[bot]
• chore(deps): update dependency @​biomejs/biome to 2.4.10 (#​1581) @​renovate[bot]
• chore: move codegen to monthly scheduled workflow (#​1578) @​jetersen
• chore: replace vite-tsconfig-paths plugin with native resolve.tsconfigPaths (#​1571) @​jetersen

Documentation

• docs: fix autolabeler example tag (#​1568) @​cchanche

Dependency Updates

• build(deps): bump lodash and @​graphql-codegen/plugin-helpers (#​1589) @​dependabot[bot]
• fix(deps): update dependency @​actions/github to 9.1.0 (#​1586) @​renovate[bot]
• chore(deps): update dependency yaml to 2.8.3 (#​1580) @​renovate[bot]
• chore(deps): update node.js to v24.14.1 (#​1584) @​renovate[bot]
• chore(deps): update dependency @​biomejs/biome to 2.4.10 (#​1581) @​renovate[bot]

Full Changelog: release-drafter/release-drafter@v7.1.1...v7.2.0

v7.1.1

Compare Source

What's Changed

Bug Fixes

• fix: remove disable-releaser and disable-autolabeler from action.yaml (#​1564) @​cchanche

Full Changelog: release-drafter/release-drafter@v7.1.0...v7.1.1

v7.1.0

Compare Source

What's Changed

New

• feat: filter previous releases by range with semver (#​1445) @​cchanche
• feat: support advanced substitutions in replacers (#​1517) @​cchanche

Bug Fixes

• fix: support pull_request_target event in autolabeler (#​1560) @​jmeridth
• fix: empty template when prs all are excluded by labels (#​1429) @​Bledai
• fix: fall back to org .github repo when config not found in current repo (#​1554) @​jetersen

Maintenance

• ci: make sure PRs have a type label (#​1557) @​cchanche

Documentation

• docs: update README with pull_request_target example (#​1561) @​jmeridth

Full Changelog: release-drafter/release-drafter@v7.0.0...v7.1.0

v7.0.0

Compare Source

What's Changed

Breaking

• feat: new major version (#​1475) @​cchanche

Bug Fixes

• fix: JSON schema too strict with required fields (#​1535) @​jetersen

Maintenance

• chore(deps): update vitest to 4.1.0 (#​1544) @​renovate[bot]
• chore(deps): update linters (#​1549) @​renovate[bot]
• chore(deps): update dependency nock to 14.0.11 (#​1548) @​renovate[bot]
• chore(deps): update dependency @​graphql-codegen/near-operation-file-preset to 5.0.0 (#​1545) @​renovate[bot]
• chore(deps): update dependency @​types/node to 24.12.0 (#​1543) @​renovate[bot]
• chore(deps): update dependency @​graphql-codegen/cli to 6.2.1 (#​1542) @​renovate[bot]
• chore(deps): update vite (#​1541) @​renovate[bot]
• chore(deps): update linters (#​1540) @​renovate[bot]
• build(deps): bump actions/stale from 9 to 10 (#​1527) @​dependabot[bot]

Documentation

• docs: fix v7 docs (#​1532) @​cchanche

Other changes

• chore: migrate from ESLint + Prettier to Biome (#​1552) @​jetersen
• ci: fix licensed (#​1533) @​cchanche

Dependency Updates

• fix(deps): update dependency compare-versions to 6.1.1 (#​1547) @​renovate[bot]
• fix(deps): update dependency zod to 4.3.6 (#​1551) @​renovate[bot]
• fix(deps): update dependency semver to 7.7.4 (#​1550) @​renovate[bot]

Full Changelog: release-drafter/release-drafter@v6.4.0...v7.0.0

v6.4.0

Compare Source

What's Changed

New

• feat: Add support to excluded-paths (#​1522) @​guimorg
• feat: add include-pre-releases to action inputs (#​1525) @​cchanche

Maintenance

• revert: deprecate include-pre-releases (#​1523) @​cchanche

Full Changelog: release-drafter/release-drafter@v6.3.0...v6.4.0

v6.3.0

Compare Source

What's Changed

New

• feat: deprecate include-pre-releases in favor of prerelease (#​1515) @​christopherklint97

Maintenance

• chore: use probot logger instead of @​actions/core (#​1520) @​cchanche

Dependency Updates

8 changes

• chore: update lockfile (#​1521) @​cchanche
• build(deps-dev): bump brace-expansion from 1.1.11 to 1.1.12 (#​1494) @​dependabot[bot]
• build(deps): bump js-yaml (#​1493) @​dependabot[bot]
• build(deps-dev): bump node-fetch from 2.6.7 to 2.7.0 (#​1485) @​dependabot[bot]
• build(deps-dev): bump @​vercel/ncc from 0.34.0 to 0.38.4 (#​1484) @​dependabot[bot]
• build(deps): bump deepmerge from 4.2.2 to 4.3.1 (#​1482) @​dependabot[bot]
• build(deps): bump jws from 3.2.2 to 3.2.3 (#​1495) @​dependabot[bot]
• build(deps): bump lodash from 4.17.21 to 4.17.23 (#​1489) @​dependabot[bot]

Full Changelog: release-drafter/release-drafter@v6.2.0...v6.3.0

v6.2.0

Compare Source

What's Changed

New

• Add config option for history-limit (#​1470) @​gjvoosten
• Add 'commits-since' configuration option for release drafts (#​1451) @​slawekjaranowski

Maintenance

• build: support OIDC for npmjs publishing (#​1480) @​cchanche

Documentation

• Update README.md (#​1434) @​kunaljubce

Full Changelog: release-drafter/release-drafter@v6.1.1...v6.2.0

v6.1.1

Compare Source

What's Changed

Bug Fixes

• Honor Version Template (#​1459) @​ChronosMasterOfAllTime

Documentation

• docs: Add missing action inputs to README (#​1472) @​sasamuku

Full Changelog: release-drafter/release-drafter@v6.1.0...v6.1.1

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 4am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Security & Bug Review

I've reviewed this PR and found no security vulnerabilities or bugs in the changes themselves.

Summary

This PR updates GitHub Actions dependencies:

• actions/upload-artifact: v4 → v5
• actions/download-artifact: v5 → v6

Analysis

✅ No Security Issues Found

• These are official GitHub Actions with verified provenance
• Updates are handled by Renovate bot with proper version pinning
• No credential exposure or permission escalation

✅ No Bugs Detected

• All artifact upload/download operations maintain consistent naming (dist, docs, coverage-data-*)
• The merge-multiple: true parameter in download-artifact (line 118 of tests.yml) is compatible with v6
• Artifact retention and path configurations remain unchanged
• Jobs dependencies (needs: tests, needs: release) are unaffected

⚠️ Compatibility Note
The major version bumps suggest potential breaking changes. The most common breaking change in artifact actions is the backend storage format, but this typically doesn't affect workflows using matching upload/download versions. Since both actions are updated together, cross-version compatibility is maintained.

Recommendation: ✅ Safe to merge after CI passes. Monitor the first workflow run to confirm artifact upload/download operations succeed.