Bump the actions group across 1 directory with 13 updates by dependabot[bot] · Pull Request #15076 · huggingface/diffusers

dependabot · 2026-10-19T05:57:41Z

Updates the requirements on actions/upload-artifact, actions/github-script, actions/create-github-app-token, actions/download-artifact, docker/setup-buildx-action, docker/build-push-action, huggingface/doc-builder/.github/workflows/build_main_documentation.yml, huggingface/doc-builder/.github/workflows/build_pr_documentation.yml, anthropics/claude-code-action, huggingface/tailscale-action, trufflesecurity/trufflehog, crate-ci/typos and huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml to permit the latest version.
Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
c2acded chore: prepare v7.0.2 release
4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
8cbe1be Bump @actions/artifact to 6.3.1
See full diff in compare view

Updates actions/github-script from 8.0.0 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.

Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.

getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.

If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in actions/github-script#695

ci: use deployment: false for integration test environments by @salmanmkc in actions/github-script#712

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in actions/github-script#700

New Contributors

@Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits

3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
ca10bbd fix: use @octokit/core/types import for v7 compatibility
86e48e2 merge: incorporate main branch changes
c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
ff8117e ci: fix user-agent test to handle orchestration ID
81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
3953caf docs: update README examples from @v8 to @v9, add getOctokit docs and v9 brea...
c17d55b ci: add getOctokit integration test job
a047196 test: add getOctokit integration tests via callAsyncFunction
Additional commits viewable in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)

deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)

deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

add support for enterprise-level GitHub Apps (#263) (952a2a7)

support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)

validate private-key input (#376) (f24bbd8)

Commits

64ab729 chore(main): release 3.3.0 (#402)
f3a828e ci: create signed dist commits in release workflow (#404)
655017f docs: clarify when owner grants access to all repositories (#378)
12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
a47236f feat: update permission inputs (#399)
a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
e85f677 test: omit stack traces from snapshots (#401)
9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

Update the readme by @danwkennedy in actions/download-artifact#473

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Update @actions/artifact to 6.3.1 by @tunc-d in actions/download-artifact#492

Prepare download-artifact v8.0.2 by @tunc-d in actions/download-artifact#493

New Contributors

@tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
e455989 Prepare download-artifact v8.0.2
a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
29bb7ce Update @actions/artifact to 6.3.1
484a0b5 Update the readme (#473)
See full diff in compare view

Updates docker/setup-buildx-action from 4.2.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

Skip BuildKit image pre-pulls for explicit endpoints by @crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

Use official Buildx releases for cloud driver by @crazy-max in docker/setup-buildx-action#606

Pull BuildKit image before builder creation by @crazy-max in docker/setup-buildx-action#609

Use shared error helpers for Buildx and Docker commands by @crazy-max in docker/setup-buildx-action#620

Bump @docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614

Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

Bump @docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600

Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585

Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598

Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

Commits

f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
e700274 chore: update generated content
3061c91 skip BuildKit image pre-pulls for explicit endpoints
594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
bd6e702 chore: update generated content
6268c9d pull BuildKit image before builder creation
e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
533ed8e build(deps): bump the codeql-actions group with 2 updates
bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
d5079fb chore: update generated content
Additional commits viewable in compare view

Updates docker/build-push-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

Use the shared error helper for Buildx commands by @crazy-max in docker/build-push-action#1620

Prevent workflow command injection in metadata logs by @crazy-max in docker/build-push-action#1617

Bump @docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592

Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613

Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615

Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611

Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606

Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577

Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

Commits

c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
459b674 [dependabot skip] chore: update generated content
4dedcb2 chore(deps): Bump @docker/actions-toolkit from 0.99.0 to 0.100.0
379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
9877975 chore: update generated content
7ed0556 use the shared Buildx error summary helper
91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
80dbc86 [dependabot skip] chore: update generated content
50cac3a chore(deps): Bump @docker/actions-toolkit from 0.98.0 to 0.99.0
03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
Additional commits viewable in compare view

Updates huggingface/doc-builder/.github/workflows/build_main_documentation.yml from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f

Changelog

Sourced from huggingface/doc-builder/.github/workflows/build_main_documentation.yml's changelog.

Release checklist
Checkout the release branch (for a patch the current release branch, for a new minor version, create one):
git checkout -b vXX.xx-release
The -b is only necessary for creation (so remove it when doing a patch).
Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.

Commit these changes with the message: "Release: v<VERSION>".
Add a tag in git to mark the release:
git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'
Push the tag and release commit to git:
git push --tags origin vXX.xx-release
Build the source distribution and the wheel in the top-level directory:
rm -rf dist
uv build
Upload the package to the pypi test server first:
twine upload dist/* -r testpypi
Check that you can install it in a virtualenv by running:
pip install hf-doc-builder
pip uninstall hf-doc-builder
pip install -i https://test.pypi.org/simple/ hf-doc-builder
It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
Upload the final version to actual pypi:
twine upload dist/* -r pypi
Add release notes to the tag in github once everything is looking hunky-dory.

Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.

Commits

90ddd19 Keep server-rendered doc pages through hydration (#851)
c69e96c [meilisearch] delete stale documents in a single task (#848)
c7489a4 [meilisearch] don't parse code comments as headings, use page titles (#847)
See full diff in compare view

Updates huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f

Changelog

Sourced from huggingface/doc-builder/.github/workflows/build_pr_documentation.yml's changelog.

Release checklist
Checkout the release branch (for a patch the current release branch, for a new minor version, create one):
git checkout -b vXX.xx-release
The -b is only necessary for creation (so remove it when doing a patch).
Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.

Commit these changes with the message: "Release: v<VERSION>".
Add a tag in git to mark the release:
git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'
Push the tag and release commit to git:
git push --tags origin vXX.xx-release
Build the source distribution and the wheel in the top-level directory:
rm -rf dist
uv build
Upload the package to the pypi test server first:
twine upload dist/* -r testpypi
Check that you can install it in a virtualenv by running:
pip install hf-doc-builder
pip uninstall hf-doc-builder
pip install -i https://test.pypi.org/simple/ hf-doc-builder
It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
Upload the final version to actual pypi:
twine upload dist/* -r pypi
Add release notes to the tag in github once everything is looking hunky-dory.

Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.

Commits

90ddd19 Keep server-rendered doc pages through hydration (#851)
c69e96c [meilisearch] delete stale documents in a single task (#848)
c7489a4 [meilisearch] don't parse code comments as headings, use page titles (#847)
See full diff in compare view

Updates anthropics/claude-code-action from 1.0.193 to 1.0.248

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.248

Full Changelog: anthropics/claude-code-action@v1.0.247...v1.0.248

v1.0.247

Full Changelog: anthropics/claude-code-action@v1.0.246...v1.0.247

v1.0.246

Full Changelog: anthropics/claude-code-action@v1.0.245...v1.0.246

v1.0.245

Full Changelog: anthropics/claude-code-action@v1.0.244...v1.0.245

v1.0.244

Full Changelog: anthropics/claude-code-action@v1.0.243...v1.0.244

v1.0.243

Full Changelog: anthropics/claude-code-action@v1.0.242...v1.0.243

v1.0.242

Full Changelog: anthropics/claude-code-action@v1.0.241...v1.0.242

v1.0.241

Full Changelog: anthropics/claude-code-action@v1.0.240...v1.0.241

v1.0.240

Full Changelog: anthropics/claude-code-action@v1.0.239...v1.0.240

v1.0.239

Full Changelog: anthropics/claude-code-action@v1.0.238...v1.0.239

v1.0.238

What's Changed

ci: security hardening for GitHub Actions workflows that call Claude by @qing-ant in anthropics/claude-code-action#1867

New Contributors

@qing-ant made their first contribution in anthropics/claude-code-action#1867

Full Changelog: anthropics/claude-code-action@v1.0.237...v1.0.238

v1.0.237

Full Changelog: anthropics/claude-code-action@v1.0.236...v1.0.237

v1.0.236

Full Changelog: anthropics/claude-code-action@v1.0.235...v1.0.236

v1.0.235

Full Changelog: anthropics/claude-code-action@v1.0.234...v1.0.235

v1.0.234

Full Changelog: anthropics/claude-code-action@v1.0.233...v1.0.234

... (truncated)

Commits

1d6de8c chore: bump Claude Code to 2.1.296 and Agent SDK to 0.3.296
2dca132 chore: bump Claude Code to 2.1.295 and Agent SDK to 0.3.295
38c80c1 chore: bump Claude Code to 2.1.294 and Agent SDK to 0.3.294
6fed3ca chore: bump Claude Code to 2.1.293 and Agent SDK to 0.3.293
5898584 chore: bump Claude Code to 2.1.292 and Agent SDK to 0.3.292
86d88e6 chore: bump Claude Code to 2.1.291 and Agent SDK to 0.3.291
6c69018 chore: bump Claude Code to 2.1.290 and Agent SDK to 0.3.290
cab360f chore: bump Claude Code to 2.1.289 and Agent SDK to 0.3.289
ed670b4 chore: bump Claude Code to 2.1.288 and Agent SDK to 0.3.288
97c5347 chore: bump Claude Code to 2.1.287 and Agent SDK to 0.3.287
Additional commits viewable in compare view

Updates huggingface/tailscale-action to 9d1a67c46875a956cf2d1975473da978a970a2a9

Commits

See full diff in compare view

Updates trufflesecurity/trufflehog from 3.97.0 to 3.99.2

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.2

What's Changed

Copy over dedupe cache size into the engine from the config by @camgunz in trufflesecurity/trufflehog#5402

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

v3.99.1

What's Changed

Update github-actions by @renovate[bot] in trufflesecurity/trufflehog#5363

[INT-1084] Make the results deduplication cache size configurable by @camgunz in trufflesecurity/trufflehog#5399

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

v3.99.0

What's Changed

Fix Sumo Logic detector ignoring configured verifier endpoints by @unsmith in trufflesecurity/trufflehog#5395

Add OAuth2 (ROPC) auth for verification requests by @unsmith in trufflesecurity/trufflehog#5392

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

v3.98.1

What's Changed

Add postman source documentation by @kashifkhan0771 in trufflesecurity/trufflehog#5389

Add a TruffleHog dectector for Kong Konnect Platform by @mrwanny in trufflesecurity/trufflehog#5305

Add api_timeout_seconds to Gerrit source proto by @kashifkhan0771 in trufflesecurity/trufflehog#5394

New Contributors

@mrwanny made their first contribution in trufflesecurity/trufflehog#5305

Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1

v3.98.0

What's Changed

Int 595 verify asymmetry by @shahzadhaider1 in trufflesecurity/trufflehog#5261

return error body for fetchBearerToken by @jordanTunstill in trufflesecurity/trufflehog#5301

Update module github.com/charmbracelet/bubbletea to v1.3.10 by @renovate[bot] in trufflesecurity/trufflehog#5281

Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @renovate[bot] in trufflesecurity/trufflehog#5280

[INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @camgunz in trufflesecurity/trufflehog#5351

[INT-1091] Treat Square 403 as verified on INSUFFICIENT_SCOPES by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5367

feat: add --no-ignore-tag to report secrets on trufflehog:ignore lines by @thiswillnevermatch in trufflesecurity/trufflehog#5293

Fix failing TestGHCRListImages test in CI by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5368

Revert duplicate --no-ignore-tag changes from #5293 by @shahzadhaider1 in trufflesecurity/trufflehog#5369

Show progress inside S3 buckets by @shahzadhaider1 in trufflesecurity/trufflehog#5330

fix(output): escape special characters in --github-actions output by @kenanyararbas in trufflesecurity/trufflehog#5353

fix(detectors): remove stray fmt.Printf in portainertoken by @Gracy769 in trufflesecurity/trufflehog#5334

resolve race condition in result deduplication cache by @kvnphvm in trufflesecurity/trufflehog#5359

added entropy filter and improved verification for gitlab v2/v3 by @jordanTunstill in trufflesecurity/trufflehog#5358

... (truncated)

Commits

e76dff8 Somehow forgot to pull the config value into the engine (#5402)
005b692 [INT-1084] Make the results deduplication cache size configurable (#5399)
f6499ff Update github-actions (#5363)
b2b0a92 Add OAuth2 (ROPC) auth for verification requests (#5392)
ab5ee07 Fix Sumo Logic detector ignoring configured verifier endpoints (#5395)
4c282f5 Add api_timeout_seconds to Gerrit source proto (#5394)
c95844e Add a TruffleHog dectector for Kong Konnect Platform (#5305)
cc79781 Add postman source documentation (#5389)
0186870 Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clien...
bb9ed13 docs: point five internal links at files that exist (#5375)
Additional commits viewable in compare view

Updates crate-ci/typos from 1.49.0 to 1.51.1

Release notes

Sourced from crate-ci/typos's releases.

v1.51.1

[1.51.1] - 2026-10-06

Features

Add ARM Windows builds

v1.51.0

[1.51.0] - 2026-10-06

Fixes

Don't correct bimap

Features

Updated the dictionary with the September 2026 changes

v1.50.3

[1.50.3] - 2026-09-25

Fixes

Don'y panicwhen case-converting non-ASCII corrections

v1.50.2

[1.50.2] - 2026-09-15

Fixes

Don't panic when files being examined are removed

v1.50.1

[1.50.1] - 2026-09-01

Fixes

Don't correct asend in Python code

v1.50.0

[1.50.0] - 2026-08-28

Features

Updated the dictionary with the August 2026 changes

v1.49.1

[1.49.1] - 2026-08-27

Fixes

... (truncated)

Changelog

Sourced from crate-ci/typos's changelog.

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased] - ReleaseDate

[1.51.1] - 2026-10-06

Features

Add ARM Windows builds

[1.51.0] - 2026-10-06

Fixes

Don't correct bimap

Features

Updated the dictionary with the September 2026 changes

[1.50.3] - 2026-09-25

Fixes

Don'y panicwhen case-converting non-ASCII corrections

[1.50.2] - 2026-09-15

Fixes

Don't panic when files being examined are removed

[1.50.1] - 2026-09-01

Fixes

Don't correct asend in Python code

[1.50.0] - 2026-08-28

Features

Updated the dictionary with the August 2026 changes

[1.49.1] - 2026-08-27

... (truncated)

Commits

7f9d081 chore: Release
4fc41d7 docs: Update changelog
eb4f299 Merge pull request #1602 from meop/ci/platform-release-matrix
7623265 ci: release a win-arm64-msvc artifact
cf01e3f ci: match any windows runner when staging the release archive
dcea711 chore: Release
73ce342 chore: Release
58d970f docs: Update changelog
d59c567 Merge pull request #1634 from epage/bimap
3689e3c fix(dict): Remove bimap from being corrected
Additional commits viewable in compare view

Updates huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f

Changelog

Sourced from huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml's changelog.

Release checklist
Checkout the release branch (for a patch the current release branch, for a new minor version, create one):
git checkout -b vXX.xx-release
The -b is only necessary for creation (so remove it when doing a patch).
Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.

Commit these changes with the message: "Release: v<VERSION>".
Add a tag in git to mark the release:
git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'
Push the tag and release commit to git:
git push --tags origin vXX.xx-release
Build the source distribution and the wheel in the top-level directory:
rm -rf dist
uv build
Upload the package to the pypi test server first:
twine upload dist/* -r testpypi
Check that you can install it in a virtualenv by running:
pip install hf-doc-builder
pip uninstall hf-doc-builder
pip install -i https://test.pypi.org/simple/ hf-doc-builder
It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
Upload the final version to actual pypi:
twine upload dist/* -r pypi
Add release notes to the tag in github once everything is looking hunky-dory.

Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.

Commits

90ddd19 Keep server-rendered doc pages through hydration (#851)
c69e96c [meilisearch] delete stale documents in a single task (#848)
c7489a4 [meilisearch] don't parse code comments as headings, use page titles (#847)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Updates the requirements on [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/github-script](https://github.com/actions/github-script), [actions/create-github-app-token](https://github.com/actions/create-github-app-token), [actions/download-artifact](https://github.com/actions/download-artifact), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/build-push-action](https://github.com/docker/build-push-action), [huggingface/doc-builder/.github/workflows/build_main_documentation.yml](https://github.com/huggingface/doc-builder), [huggingface/doc-builder/.github/workflows/build_pr_documentation.yml](https://github.com/huggingface/doc-builder), [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action), [huggingface/tailscale-action](https://github.com/huggingface/tailscale-action), [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog), [crate-ci/typos](https://github.com/crate-ci/typos) and [huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml](https://github.com/huggingface/doc-builder) to permit the latest version. Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v8...3a2844b) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@bcd2ba4...64ab729) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) Updates `docker/setup-buildx-action` from 4.2.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@bb05f3f...f87e599) Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@53b7df9...c3c9e26) Updates `huggingface/doc-builder/.github/workflows/build_main_documentation.yml` from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md) - [Commits](huggingface/doc-builder@9fc8a41...90ddd19) Updates `huggingface/doc-builder/.github/workflows/build_pr_documentation.yml` from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md) - [Commits](huggingface/doc-builder@9fc8a41...90ddd19) Updates `anthropics/claude-code-action` from 1.0.193 to 1.0.248 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@9d7150b...1d6de8c) Updates `huggingface/tailscale-action` to 9d1a67c46875a956cf2d1975473da978a970a2a9 - [Release notes](https://github.com/huggingface/tailscale-action/releases) - [Commits](https://github.com/huggingface/tailscale-action/commits/9d1a67c46875a956cf2d1975473da978a970a2a9) Updates `trufflesecurity/trufflehog` from 3.97.0 to 3.99.2 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@bcfcf73...e76dff8) Updates `crate-ci/typos` from 1.49.0 to 1.51.1 - [Release notes](https://github.com/crate-ci/typos/releases) - [Changelog](https://github.com/crate-ci/typos/blob/main/CHANGELOG.md) - [Commits](crate-ci/typos@8a48f81...7f9d081) Updates `huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml` from 9fc8a41d7729c424fdb2192f2f85ff63102ec9a3 to 90ddd199e07144a13408c523680c76987343c95f - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md) - [Commits](huggingface/doc-builder@9fc8a41...90ddd19) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: huggingface/doc-builder/.github/workflows/build_main_documentation.yml dependency-version: 90ddd199e07144a13408c523680c76987343c95f dependency-type: direct:production dependency-group: actions - dependency-name: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml dependency-version: 90ddd199e07144a13408c523680c76987343c95f dependency-type: direct:production dependency-group: actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.248 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: huggingface/tailscale-action dependency-version: 9d1a67c46875a956cf2d1975473da978a970a2a9 dependency-type: direct:production dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: crate-ci/typos dependency-version: 1.51.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml dependency-version: 90ddd199e07144a13408c523680c76987343c95f dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 19, 2026

github-actions Bot added CI size/M PR with diff < 200 LOC labels Oct 19, 2026

hf-security-analysis Bot added a commit that referenced this pull request Oct 19, 2026

fix(ci): pin actions in workflows flagged on #15076

c66ab1e

hf-security-analysis Bot mentioned this pull request Oct 19, 2026

fix(ci): pin GitHub Actions to commit SHAs (#15076) #15077

Open

Navigation Menu

Repository navigation

Bump the actions group across 1 directory with 13 updates - #15076

Bump the actions group across 1 directory with 13 updates#15076
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-1a9a55b888

dependabot Bot commented on behalf of github Oct 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026

v7.0.2

What's Changed

New Contributors

v9.0.0

What's Changed

New Contributors

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

3.2.0 (2026-05-12)

Features

Bug Fixes

v8.0.2

What's Changed

New Contributors

v4.4.1

v4.4.0

v4.3.0

v7.4.0

Release checklist

Release checklist

v1.0.248

v1.0.247

v1.0.246

v1.0.245

v1.0.244

v1.0.243

v1.0.242

v1.0.241

v1.0.240

v1.0.239

v1.0.238

What's Changed

New Contributors

v1.0.237

v1.0.236

v1.0.235

v1.0.234

v3.99.2

What's Changed

v3.99.1

What's Changed

v3.99.0

What's Changed

v3.98.1

What's Changed

New Contributors

v3.98.0

What's Changed

v1.51.1

[1.51.1] - 2026-10-06

Features

v1.51.0

[1.51.0] - 2026-10-06

Fixes

Features

v1.50.3

[1.50.3] - 2026-09-25

Fixes

v1.50.2

[1.50.2] - 2026-09-15

Fixes

v1.50.1

[1.50.1] - 2026-09-01

Fixes

v1.50.0

[1.50.0] - 2026-08-28

Features

v1.49.1

[1.49.1] - 2026-08-27

Fixes

Change Log

[Unreleased] - ReleaseDate