Skip to content

Bump actions/upload-artifact from 4 to 6#2

Closed
dependabot[bot] wants to merge 62 commits into
mainfrom
dependabot/github_actions/actions/upload-artifact-6
Closed

Bump actions/upload-artifact from 4 to 6#2
dependabot[bot] wants to merge 62 commits into
mainfrom
dependabot/github_actions/actions/upload-artifact-6

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Jan 18, 2026

Bumps actions/upload-artifact from 4 to 6.

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/upload-artifact@v4...v5.0.0

v4.6.2

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

What's Changed

... (truncated)

Commits
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • ddc45ed docs: update README to correct action name for Node.js 24 support
  • 615b319 chore: release v6.0.0 for Node.js 24 support
  • 017748b Merge pull request #744 from actions/fix-storage-blob
  • 38d4c79 chore: rebuild dist
  • 7d27270 chore: add missing license cache files for @​actions/core, @​actions/io, and mi...
  • 5f643d3 chore: update license files for @​actions/artifact@​5.0.1 dependencies
  • 1df1684 chore: update package-lock.json with @​actions/artifact@​5.0.1
  • b5b1a91 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Implement a simple todo app demonstrating Turbo 8's
broadcasts_refreshes_to for real-time updates with View
Transitions API animations.

- Devise authentication for users
- List and Item models with nested resources
- Bootstrap 5 styling via CDN
- View Transitions for item add/remove animations
- Turbo morphing with scroll preservation
Prevents form input from being cleared when another user's
broadcast triggers a page morph.
data-turbo-permanent preserves the form during morphs but
also blocks Turbo Stream replacements. Use client-side reset
on turbo:submit-end to clear input after successful submit.
- Display validation errors via Turbo Stream updates
- Use 303 status for all non-GET redirects per Turbo guidelines
- Replace reset_form_controller with form_controller that
  only clears on success and toggles validation classes
- Add title presence validation to Item model
Blog post covering the implementation challenges and solutions
for real-time updates with smooth animations, including:
- broadcasts_refreshes_to for WebSocket updates
- View Transitions API for enter/exit animations
- data-turbo-permanent for form protection
- Request-id deduplication behavior
- Stimulus for conditional form clearing
Use custom data-turbo-broadcast-refresh-permanent attribute to protect
forms during broadcast morphs while allowing navigation morphs through.
This eliminates the need for Stimulus to clear forms after submission.

- Add turbo:before-stream-render listener to detect broadcast refreshes
- Block turbo:before-morph-element only during broadcasts
- Move validation errors inline in form partial
- Remove Stimulus form controller and separate errors partial
- Update journey.md with final solution documentation
Rails wraps fields with errors in a div.field_with_errors wrapper,
which breaks Bootstrap's input-group flexbox layout. Fixed by making
the wrapper a flex container that grows to fill available space.
Add appendix explaining how turbo_stream.refresh(request_id: nil)
can bypass request-id deduplication, while noting that the redirect
approach remains the preferred solution for its simplicity and
standard Rails conventions.
More accurate name: describes the mechanism (stream-delivered refresh)
rather than assuming a use case (broadcasts).
- Remove Devise from tech stack (not needed for demo)
- Use 'stream-delivered refresh' consistently instead of 'broadcast'
- Simplify form example to match actual implementation
Add section showing how the same data-turbo-stream-refresh-permanent
pattern works for inline edit forms.
- Add cheatsheet.md with step-by-step implementation guide
- Document why background-color doesn't work for highlights
- Use box-shadow for visible highlight animations
- Add jQuery timing defaults reference
Replace single delete button with Done/Undo, Edit, Delete btn-group.
Use link_to with data-turbo-method for proper btn-group styling.
- Use flash animations (box-shadow) instead of slide animations
- Document that deletes are excluded by default due to visual issues
- Add section about btn-group requiring link_to instead of button_to
- Add turbo_prefetch tip for preventing hover flash on links
- Update CSS examples to match actual implementation
- Fix incorrect claim about item-* wildcard selector
Add documentation for the new feature that flashes protected edit forms
when broadcasts arrive from other users. This signals "data changed
elsewhere" without losing form state.

Key additions:
- recentlySubmitted flag to distinguish submitter from other clients
- data-view-transition-animation-class attribute for configurable flash
- .flash-yellow CSS class
- Updated Quick Reference table
- New troubleshooting section
Allows elements to specify their own View Transition animation class,
overriding the default green/yellow flash. Uses View Transitions Level 2
view-transition-class property (Baseline Newly Available Oct 2025).

Usage:
  <div data-view-transition-id="item-1"
       data-view-transition-class="slide-in">

CSS targeting:
  ::view-transition-new(*.slide-in):only-child {
    animation: slide-in 400ms ease-in-out;
  }
Replace View Transitions API documentation with simpler CSS
class-based animation approach. Document form protection,
delete animations, and content comparison strategies.
Replace data-turbo-refresh-content (field-by-field comparison) with
data-turbo-refresh-version (timestamp-based comparison using updated_at).

- Update library to use version comparison
- Update happy_refresh app to use class-based animations
- Add turbo-refresh-animations as separate library package
- Update all documentation
Major simplification:
- Use id attribute by default (no data-turbo-refresh-id needed)
- Default animation classes: turbo-refresh-enter/update/exit
- Track page state to skip animations on initial navigation
- Use Idiomorph events for update/delete detection
- Use DOM comparison for create detection (same-page only)

Minimal setup is now just:
  <div id="<%= dom_id(item) %>">content</div>
- Change from automatic (all IDs) to opt-in via data-turbo-refresh-animate
- Add data-turbo-stream-refresh-permanent for form protection during broadcasts
- Add data-turbo-refresh-version for change detection on protected elements
- Preserve non-blank inputs during navigation
- Allow submitted forms to clear while protecting others
- Simplify CSS to just the three core animation classes
- Update README with accurate documentation
JS changes:
- Use event.preventDefault() + event.detail.resume() to animate
  deletions before morphing prevents position jumping
- Rename turbo-refresh-update to turbo-refresh-change
- Fix version comparison for protected element detection

CSS changes:
- Simplify to background-color fades with CSS variable overrides
- Enter: green 1.2s, Exit: red 0.6s fade, Change: yellow 1.2s
- CSS: Use inherit instead of transparent so animations work on
  elements with background colors
- README: Add opt-out documentation and box-shadow glow examples
Safer approach that doesn't overwrite element's own box-shadow or z-index.
Elements only get position: relative for overlay positioning.
CSS:
- Replace complex ::after glow overlays with simple fade in/out
- Change animation uses yellow background flash
- Much simpler CSS (42 lines vs 103)

JS:
- Replace data-turbo-refresh-{type}-off attributes with
  data-turbo-refresh-animate="enter,exit,change" syntax
- Empty value still enables all animations

README:
- Update CSS variables documentation
- Document new animation selection syntax
- Remove redundant fade example (now the default)
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 18, 2026
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 18, 2026
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Jan 18, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/github_actions/actions/upload-artifact-6 branch January 18, 2026 02:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant