[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v5.0.0 → v5.1.0
erlang/rebar3	uses-with	minor	3.23.0 → 3.28.0
erlef/setup-beam	action	minor	v1.20.4 → v1.24.1
reviewdog/action-actionlint	action	minor	v1.68.0 → v1.80.6

---

Release Notes

actions/checkout

v5.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v5 by @​aiqiaoy in #​2501
• backport fixes to releases-v5 by @​aiqiaoy in #​2523

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v5.0.1...v5.1.0

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

erlang/rebar3

v3.28.0

Compare Source

Few interface changes, but some significant behavioural ones:

• Remove Certifi dependency and rely on root store
• Bump vendored hex_core to 0.20.1
• Improve description of rebar3 ct --dir option

Note that both the hex_core update and the certifi update are required for security. The removal of Certifi switches Rebar3 to use your operating system's root store, which may cause issues in some limited devices. However, since distrusted intermediary certificates are currently still in Certifi's hex package, we consider it safer to rely on operating system root stores.

If your device does not comply with the expected root store, you can configure one with {ssl_cacerts_path, "/path/to/cacerts.pem"}.

v3.27.3

Compare Source

• Bump vendored hex_core to 0.20

v3.27.2

Compare Source

• Fix for CVE-2026-103060

v3.27.1

Compare Source

• Support missing no_proxy option
• Keep quoting in zsh completion descriptions
• Remove redundant droplast implementation
• Implement Hex Auth
• Fix SIGQUIT (Ctrl+) producing a core dump in rebar3 shell
• Upgrade hex_core to 0.18.0

v3.27.0

Compare Source

• Vendor hex_core 0.12.2
• prepare for OTP-29 by defaulting to warn_deprecated_catch
• fix bogus timestamps when creating escripts
• Add precision flag (and config) to control output percentage precision
• Add middlebox_comp_mode to global options
• Ignore optional Hex package dependencies

v3.26.0

Compare Source

• fix rebar_app_info:source/1 spec
• fix the version range parser to support and/or version constraints
• IPv6 support for getting Hex packages
• CT: disable cth_readable_failonly hook when verbose option is set
• relx: do not discard command line parameters when parameter is not in config
• Support env variable substitution with defaults in rebar shell
• Improve documentation
• Return manifest macros as objects
• Expand extra src dirs recursively in manifests
• Make xref recognize apps again

v3.25.1

Compare Source

Two fixes for Windows:

• Update escriptize hook to work with newer Windows versions
  • The regex used to match hooks for Rebar3's own escript location relied on the win32 part of the architecture description line. Newer Windows versions now return a windows pattern instead
• Bump erlware_commons to 1.8.0 (fixes hanging resource fetches on Windows on OTP-28)

There are also a couple of minor improvements:

• Add file completion support for bash completion, fixing autocompletion of common command arguments that are file names
• Support resources of arbitrary size in rebar3, allowing fancier custom dependency plugins

v3.25.0

Compare Source

OTP-28 compatibility release, deprecates OTP-25.

• Bump Runner images for Nightly and release builds
• Prepare OTP-28 bump
• Bump eunit_formatters to 0.6.0
• docs: added a link to the license
• docs: replaced the link to the build status badge
• Bump cth_readable version for OTP-28 readiness
• fix: crash on rebar_compiler_format:colorize/2
• OTP-28 readiness (part 1)
• add env var for skipping project plugins
• Fallback to the default error format when a file is empty
• update vendored cf to support color in foot and ghostty
• Approach the sample config. file to rebar3.org's documentation
• Add Rebar3 and Erlang/OTP compatibility list
• make escriptize reproducible with erlang 27.1
• Bump relx vendored copy

v3.24.0

Compare Source

New features:

• Turn rich compiler errors on by default
• Tweak experimental manifest plugin to return ELP-compatible information

Bug fixes:

• make escriptize reproducible by setting timestamps for files in zip to unix epoch
• Log path when plugin template file read fails
• Prevent infinite compiler DAG growth
• Port Relx compatibility fix for escript files in OTP-27

Internal maintenance:

• Made rebar_utils:filtermap/2 to call directly lists:filtermap/2
• Cleaned up additional definitions in bootstrap
• Replaced rebar_utils:find_source/3 by a call to filelib:find_source/3 and Marked rebar_utils:find_source/3 as deprecated
• Fixing various typos in comments, types, and function names
• Bump hex_core and certifi dependencies
• Remove legacy hostname checks
• Replaced group_by_namespace/1 by a call to maps:groups_from_list/2
• Removed legacy OTP_RELEASE macro statements
• Removed legacy fun_stacktrace usage
• Removed unsused platform_define options
• Standardizing templates indentation

Regarding rich compiler errors, the change is optional.

Given the module:

-module(fake_mod).

-export([diagnostic/1]).

diagnostic(A) ->
    X = add(5 / 0),
    {X,X}.

add(X) -> X.

add(X, Y) -> X + Y.

Calling rebar3 compile can now yield:

...
===> Compiling apps/rebar/src/fake_mod.erl failed
   ┌─ apps/rebar/src/fake_mod.erl:
   │
 5 │  diagnostic(A) ->
   │             ╰── variable 'A' is unused

   ┌─ apps/rebar/src/fake_mod.erl:
   │
 6 │      X = add(5 / 0),
   │                ╰── evaluation of operator '/'/2 will fail with a 'badarith' exception

    ┌─ apps/rebar/src/fake_mod.erl:
    │
 11 │  add(X, Y) -> X + Y.
    │  ╰── function add/2 is unused

and in a terminal supporting color output:

By default, this format is turned on, but can be turned off optionally by configuring values with

{compiler_error_format, minimal}.

If this breaks your tooling, you may want to put it in your global rebar3 config file.

erlef/setup-beam

v1.24.1

Compare Source

What's Changed

• Update 3rd party licenses (automation) by @​github-actions[bot] in #​446
• Update 3rd party licenses (automation) by @​github-actions[bot] in #​459
• Update 3rd party licenses (automation) by @​github-actions[bot] in #​469
• fix: broken tests (mostly out of stuff being outdated) by @​paulo-ferraz-oliveira in #​468
• Bump actions/checkout from 6.0.2 to 7.0.0 by @​dependabot[bot] in #​467
• Bump eslint from 10.1.0 to 10.6.0 by @​dependabot[bot] in #​453
• Bump prettier from 3.8.1 to 3.9.1 by @​dependabot[bot] in #​454
• Bump globals from 17.4.0 to 17.7.0 by @​dependabot[bot] in #​452
• Remove lodash Dependency by @​maennchen in #​457

Full Changelog: erlef/setup-beam@v1...v1.24.1

v1.24.0

Compare Source

⚠️ Potentially breaking changes

Since GitHub is phasing out Node 20 runners, the erlef/setup-beam action has updated its requirements (see PR #​426). Please ensure your workflow files are updated to align with the latest GitHub Actions standards to avoid execution failures.

What's Changed

• Support Node 24 runtime by @​levibuzolic in #​426

• Fix error that occurs when parsing TOML files that use dotted keys by @​mitchellhenke in #​444

• Automation

  • Update 3rd party licenses (automation) by @​github-actions[bot] in #​435, #​436, and #​442

• Security

  • Bump eslint from 10.0.3 to 10.1.0 by @​dependabot[bot] in #​439
  • Bump yauzl from 3.2.0 to 3.2.1 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​437
  • Bump csv-parse from 6.1.0 to 6.2.1 by @​dependabot[bot] in #​440
  • Bump picomatch from 4.0.3 to 4.0.4 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​443
  • fix: address Prototype Pollution via parse() in NodeJS flatted by @​paulo-ferraz-oliveira in #​445

New Contributors

• @​levibuzolic made their first contribution in #​426
• @​mitchellhenke made their first contribution in #​444

Full Changelog: erlef/setup-beam@v1...v1.24.0

v1.23.0

Compare Source

What's Changed

Features

• feat: add macOS-26 to supported ImageOS mappings by @​petermm in #​430
• feat: add Erlang problem matchers by @​Taure in #​433

Fixes

• fix: use dynamic import in tests to prevent ESM hoisting race by @​petermm in #​429
• fix: download correct Gleam binary for macOS and Linux ARM64 by @​petermm in #​428
• Run ARM-specific tests consistently by @​paulo-ferraz-oliveira in #​434

Documentation

• Compatibility matrix strategy by @​sebastiw in #​389

Version updates

• Update 3rd party licenses (automation) by @​github-actions[bot] in #​425
• Bump undici from 6.23.0 to 6.24.0 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​432

New Contributors

• @​petermm made their first contribution in #​429
• @​Taure made their first contribution in #​433
• @​sebastiw made their first contribution in #​389

Full Changelog: erlef/setup-beam@v1...v1.23.0

v1.22.0

Compare Source

What's Changed

• Features

  • Support mise.toml as version-file (input) by @​dinokovac-river in #​415

• Dependabot updates

  • Bump @​actions/core from 1.11.1 to 3.0.0 by @​dependabot[bot] in #​419
  • Bump @​actions/exec from 1.1.1 to 3.0.0 by @​dependabot[bot] in #​405
  • Bump @​actions/tool-cache from 2.0.2 to 4.0.0 by @​dependabot[bot] in #​407
  • Bump @​eslint/js from 9.38.0 to 10.0.1 by @​dependabot[bot] in #​404
  • Bump actions/setup-node from 6.1.0 to 6.2.0 by @​dependabot[bot] in #​409
  • Bump actions/setup-node from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​423
  • Bump eslint from 10.0.1 to 10.0.3 by @​dependabot[bot] in #​420
  • Bump eslint-plugin-yml from 1.18.0 to 3.3.1 by @​dependabot[bot] in #​418
  • Bump globals from 17.3.0 to 17.4.0 by @​dependabot[bot] in #​421
  • Bump markdownlint-cli from 0.47.0 to 0.48.0 by @​dependabot[bot] in #​422
  • Bump prettier from 3.6.2 to 3.8.1 by @​dependabot[bot] in #​408
  • Bump raven-actions/actionlint from 2.1.0 to 2.1.1 by @​dependabot[bot] in #​410
  • Bump raven-actions/actionlint from 2.1.1 to 2.1.2 by @​dependabot[bot] in #​424
  • Bump semver from 7.7.2 to 7.7.4 by @​dependabot[bot] in #​406

• License updates

  • Fix for license update automation by @​paulo-ferraz-oliveira in #​412
  • Update 3rd party licenses (automation) by @​github-actions[bot] in #​413
  • Update 3rd party licenses (automation) by @​github-actions[bot] in #​414
  • Update 3rd party licenses (automation) by @​github-actions[bot] in #​416
  • Update 3rd party licenses (automation) by @​github-actions[bot] in #​417
  • Update 3rd party licenses by @​paulo-ferraz-oliveira in #​411

New Contributors

• @​dinokovac-river made their first contribution in #​415

Full Changelog: erlef/setup-beam@v1.21.0...v1.22.0

v1.21.0

Compare Source

What's Changed

• Bump eslint from 9.30.1 to 9.31.0 by @​dependabot[bot] in #​365
• Bump csv-parse from 5.6.0 to 6.0.0 by @​dependabot[bot] in #​364
• Bump @​eslint/js from 9.30.1 to 9.31.0 by @​dependabot[bot] in #​363
• Bump csv-parse from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​366
• Allow for Windows'25 container by @​essen in #​388
• Bump raven-actions/actionlint from 2.0.1 to 2.1.0 by @​dependabot[bot] in #​401
• Bump actions/setup-node from 4.4.0 to 6.1.0 by @​dependabot[bot] in #​400
• Bump js-yaml from 4.1.0 to 4.1.1 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​396
• Bump eslint from 9.31.0 to 9.38.0 by @​dependabot[bot] in #​394
• Bump shellcheck from 3.1.0 to 4.1.0 by @​dependabot[bot] in #​376
• Bump globals from 16.3.0 to 16.4.0 by @​dependabot[bot] in #​383
• Bump @​vercel/ncc from 0.38.3 to 0.38.4 by @​dependabot[bot] in #​387
• Improve output (around "Requested ... version") when we know input by @​paulo-ferraz-oliveira in #​368
• Bump actions/checkout from 4.2.2 to 6.0.1 by @​dependabot[bot] in #​399
• Bump the npm_and_yarn group across 1 directory with 2 updates by @​dependabot[bot] in #​403
• Bump @​eslint/js from 9.31.0 to 9.38.0 by @​dependabot[bot] in #​393

New Contributors

• @​essen made their first contribution in #​388

Full Changelog: erlef/setup-beam@v1...v1.21.0

reviewdog/action-actionlint

v1.80.6

Compare Source

What's Changed

• chore(deps): update python:3.15.1-alpine3.24 docker digest to 54448f6 by @​renovate[bot] in #​256

Full Changelog: reviewdog/action-actionlint@v1.80.5...v1.80.6

v1.80.5

Compare Source

What's Changed

• chore(deps): update python docker tag to v3.15.1 by @​renovate[bot] in #​255

Full Changelog: reviewdog/action-actionlint@v1.80.4...v1.80.5

v1.80.4

Compare Source

What's Changed

• chore(deps): update python:3.15.0-alpine3.24 docker digest to 2699b90 by @​renovate[bot] in #​254

Full Changelog: reviewdog/action-actionlint@v1.80.3...v1.80.4

v1.80.3

Compare Source

What's Changed

• chore(deps): update python:3.15.0-alpine3.24 docker digest to e7044cc by @​renovate[bot] in #​253

Full Changelog: reviewdog/action-actionlint@v1.80.2...v1.80.3

v1.80.2

Compare Source

What's Changed

• chore(deps): update python:3.15.0-alpine3.24 docker digest to ff4d3c9 by @​renovate[bot] in #​252

Full Changelog: reviewdog/action-actionlint@v1.80.1...v1.80.2

v1.80.1

Compare Source

What's Changed

• chore(deps): update python docker tag to v3.15.0 by @​renovate[bot] in #​251

Full Changelog: reviewdog/action-actionlint@v1.80.0...v1.80.1

v1.80.0

Compare Source

What's Changed

• chore(deps): update dependency pyflakes to v4.0.3 by @​renovate[bot] in #​250

Full Changelog: reviewdog/action-actionlint@v1.79.1...v1.80.0

v1.79.1

Compare Source

What's Changed

• chore(deps): update python:3.14.8-alpine3.24 docker digest to f6a589d by @​renovate[bot] in #​249

Full Changelog: reviewdog/action-actionlint@v1.79.0...v1.79.1

v1.79.0

Compare Source

What's Changed

• chore(deps): update dependency pyflakes to v4.0.2 by @​renovate[bot] in #​248

Full Changelog: reviewdog/action-actionlint@v1.78.1...v1.79.0

v1.78.1

Compare Source

What's Changed

• chore(deps): update python docker tag to v3.14.8 by @​renovate[bot] in #​247

Full Changelog: reviewdog/action-actionlint@v1.78.0...v1.78.1

v1.78.0

Compare Source

What's Changed

• chore(deps): update shogo82148/actions-create-release action to v1.9.2 by @​renovate[bot] in #​245
• chore(deps): update dependency pyflakes to v4.0.1 by @​renovate[bot] in #​246

Full Changelog: reviewdog/action-actionlint@v1.77.0...v1.78.0

v1.77.0

Compare Source

What's Changed

• chore(deps): update dependency pyflakes to v4 by @​renovate[bot] in #​244

Full Changelog: reviewdog/action-actionlint@v1.76.3...v1.77.0

v1.76.3

Compare Source

What's Changed

• fix: preserve quoted spaces in actionlint/reviewdog flags by @​shogo82148 in #​243

Full Changelog: reviewdog/action-actionlint@v1.76.2...v1.76.3

v1.76.2

Compare Source

What's Changed

• fix: preserve actionlint operational exit codes (2, 3) by @​shogo82148 in #​242

Full Changelog: reviewdog/action-actionlint@v1.76.1...v1.76.2

v1.76.1

Compare Source

What's Changed

• chore(deps): update python:3.14.7-alpine3.24 docker digest to 9e9fde4 by @​renovate[bot] in #​241

Full Changelog: reviewdog/action-actionlint@v1.76.0...v1.76.1

v1.76.0

Compare Source

What's Changed

• chore(deps): update reviewdog to 0.21.2 by @​github-actions[bot] in #​239

Full Changelog: reviewdog/action-actionlint@v1.75.3...v1.76.0

v1.75.3

Compare Source

What's Changed

• chore(deps): update python:3.14.7-alpine3.24 docker digest to 016508b by @​renovate[bot] in #​238

Full Changelog: reviewdog/action-actionlint@v1.75.2...v1.75.3

v1.75.2

Compare Source

What's Changed

• chore(deps): update python:3.14.7-alpine3.24 docker digest to 6f945b4 by @​renovate[bot] in #​237

Full Changelog: reviewdog/action-actionlint@v1.75.1...v1.75.2

v1.75.1

Compare Source

What's Changed

• chore(deps): update docker/setup-buildx-action action to v4.4.1 by @​renovate[bot] in #​235
• chore(deps): update python:3.14.7-alpine3.24 docker digest to 0b07f06 by @​renovate[bot] in #​236

Full Changelog: reviewdog/action-actionlint@v1.75.0...v1.75.1

v1.75.0

Compare Source

What's Changed

• chore(deps): update docker/setup-buildx-action action to v4.4.0 by @​renovate[bot] in #​232
• chore(deps): update docker/setup-qemu-action action to v4.4.0 by @​renovate[bot] in #​233
• replace to kjanat/actionlint and bump actionlint version by @​gion-pop in #​234

New Contributors

• @​gion-pop made their first contribution in #​234

Full Changelog: reviewdog/action-actionlint@v1.74.0...v1.75.0

v1.74.0

Compare Source

What's Changed

• docs: update README to include required permissions for action by @​shogo82148 in #​229
• Improve example in readme by @​shogo82148 in #​230
• chore(deps): update reviewdog to 0.21.1 by @​github-actions[bot] in #​231

Full Changelog: reviewdog/action-actionlint@v1.73.4...v1.74.0

v1.73.4

Compare Source

What's Changed

• chore(deps): update docker/setup-qemu-action action to v4.3.0 by @​renovate[bot] in #​227
• chore(deps): update python:3.14.7-alpine3.24 docker digest to c6ead21 by @​renovate[bot] in #​228

Full Changelog: reviewdog/action-actionlint@v1.73.3...v1.73.4

v1.73.3

Compare Source

What's Changed

• chore(deps): update docker/setup-buildx-action action to v4.3.0 by @​renovate[bot] in #​225
• chore(deps): update python:3.14.7-alpine3.24 docker digest to 3f818d6 by @​renovate[bot] in #​226

Full Changelog: reviewdog/action-actionlint@v1.73.2...v1.73.3

v1.73.2

Compare Source

What's Changed

• chore(deps): update shogo82148/actions-create-release action to v1.9.1 by @​renovate[bot] in #​223
• chore(deps): update python:3.14.7-alpine3.24 docker digest to 05b2b8b by @​renovate[bot] in #​224

Full Changelog: reviewdog/action-actionlint@v1.73.1...v1.73.2

v1.73.1

Compare Source

What's Changed

• chore(deps): update python docker tag to v3.14.7 by @​renovate[bot] in #​222

Full Changelog: reviewdog/action-actionlint@v1.73.0...v1.73.1

v1.73.0

Compare Source

What's Changed

• feat: add support for running this action without docker by @​IlyaGulya in #​156
• Install pyflakes to composite action by @​shogo82148 in #​212
• Install shellcheck to dockerless by @​shogo82148 in #​213
• pin the version of pyflakes by @​shogo82148 in #​214
• feat: consolidate installation into a dedicated script by @​shogo82148 in #​215
• chore(deps): update reviewdog to 0.21.0 by @​github-actions[bot] in #​216
• chore(deps): update actionlint to 1.7.12 by @​github-actions[bot] in #​217
• fix: correct version_name typo in depup workflow for shellcheck by @​shogo82148 in #​218
• chore(deps): update shellcheck to 0.11.0 by @​github-actions[bot] in #​219
• GitHub native release note by @​shogo82148 in #​220
• chore: update download URLs for actionlint and reviewdog to specific commits by @​shogo82148 in #​221

New Contributors

• @​IlyaGulya made their first contribution in #​156

Full Changelog: reviewdog/action-actionlint@v1.72.1...v1.73.0

v1.72.1

Compare Source

v1.72.1: PR #​211 - fix: include digest in Docker image reference for action.yml

v1.72.0

Compare Source

v1.72.0: PR #​196 - chore(deps): update actionlint to 1.7.12

v1.71.0

Compare Source

v1.71.0: PR #​193 - chore(deps): update actionlint to 1.7.11

v1.70.0

Compare Source

v1.70.0: PR #​191 - chore(deps): update actionlint to 1.7.10

v1.69.1

Compare Source

v1.69.1: PR #​185 - feat: update action.yml

v1.69.0

Compare Source

v1.69.0: PR #​183 - chore(deps): update actionlint to 1.7.9

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.