build(deps): bump actions/setup-dotnet from 4.3.1 to 5.4.0#91
Conversation
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 4.3.1 to 5.4.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v4.3.1...v5.4.0) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v5 | ||
| uses: actions/setup-dotnet@v5.4.0 |
There was a problem hiding this comment.
📝 Info: Floating major tag narrowed to pinned minor version
In ci-build-test.yml, publish-all.yml, and security-scan.yml, the reference was changed from actions/setup-dotnet@v5 (a floating major tag that automatically picks up new minor/patch releases like v5.5.0, v5.6.0, etc.) to actions/setup-dotnet@v5.4.0 (pinned to exactly v5.4.0). This means these workflows will no longer receive automatic minor or patch updates to the action. This is likely intentional for reproducibility, but it does mean future action improvements or fixes won't be picked up without another explicit version bump PR.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| - name: 🗄️ Setup .NET | ||
| uses: actions/setup-dotnet@v5 | ||
| uses: actions/setup-dotnet@v5.4.0 |
There was a problem hiding this comment.
📝 Info: Mixed pinning strategies across workflow files
The repository uses two different pinning strategies for the same action: SHA-pinned commits in auto-pr-from-main.yml and code-quality.yml (actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1), and version tags in ci-build-test.yml, publish-all.yml, and security-scan.yml (actions/setup-dotnet@v5.4.0). This is a pre-existing inconsistency that the PR preserves. SHA pinning is generally considered more secure (immune to tag mutation), so the version-tagged files have a weaker guarantee. Consider standardizing on SHA pinning across all workflows for consistency.
Was this helpful? React with 👍 or 👎 to provide feedback.
Qodana Community for .NETIt seems all right 👌 No new problems were found according to the checks applied 💡 Qodana analysis was run in the pull request mode: only the changed files were checked View the detailed Qodana reportTo be able to view the detailed Qodana report, you can either:
To get - name: 'Qodana Scan'
uses: JetBrains/qodana-action@v2026.1.3
with:
upload-result: trueContact Qodana teamContact us at qodana-support@jetbrains.com
|
1 participant
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps actions/setup-dotnet from 4.3.1 to 5.4.0.
Release notes
Sourced from actions/setup-dotnet's releases.
... (truncated)
Commits
26b0ec1Expand the CSC problem matcher to light up more errors on GitHub. (#717)da5e548docs(action): explicitly mark all optional inputs with required: false (#737)9bd3b44Improve readability of global.json creation command (#694)4406a63Bump@actions/cacheto 5.1.0, log cache write denied (#746)dc3262dpin actions to commit SHAs in workflows (#744)95a3f8bValidate global.json SDK version before rollForward optimization (#742)9a946fdAdd rollForward note in README, improve proxy health check in e2e tests and b...98af08bSupport global.json's rollForward latest* variants (#538)8404272Update install scripts to v2026.05.19 (#736)f1970f5Don't download releases-index.json to resolve major version (#560)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)