Skip to content

- Bugfix - Feature - Code style update (formatting, renaming) - Refactoring (no functional changes, no api changes) - Build related changes - Documentation content changes - #168

Open
ashcoft wants to merge 130 commits into
LibreCodeCoop:mainfrom
ashcoft:main

Conversation

@ashcoft

@ashcoft ashcoft commented Oct 31, 2026

Copy link
Copy Markdown

Pull Request Description

Related Issue

Issue Number:

Pull Request Type

Pull request checklist

  • Did you explain or provide a way of how can we test your code ?
  • If your pull request is related to frontend modifications provide a print of before and after screen
  • Did you provide a general summary of your changes ?
  • Try to limit your pull request to one type, submit multiple pull requests if needed

google-labs-jules Bot and others added 30 commits May 19, 2026 01:44
- Updated appinfo/info.xml with Nextcloud 33 support (min-version 30).
- Replaced internal OC\Files\Filesystem::isFileBlacklisted with OCP\Files\IFilenameValidator.
- Fixed vite.config.js to correctly target src/main.ts.
- Updated @nextcloud npm dependencies to latest compatible versions.
- Verified frontend build and PHP linting.

Co-authored-by: ashcoft <1115854+ashcoft@users.noreply.github.com>
- Updated appinfo/info.xml with Nextcloud 33 support (min-version 30).
- Replaced internal OC\Files\Filesystem::isFileBlacklisted with OCP\Files\IFilenameValidator.
- Fixed vite.config.js to correctly target src/main.ts.
- Updated @nextcloud npm dependencies to latest compatible versions.
- Verified frontend build and PHP linting.

Co-authored-by: ashcoft <1115854+ashcoft@users.noreply.github.com>
- Updated appinfo/info.xml with Nextcloud 33 support (min-version 30).
- Replaced internal OC\Files\Filesystem::isFileBlacklisted with OCP\Files\IFilenameValidator.
- Fixed vite.config.js to correctly target src/main.ts.
- Updated @nextcloud npm dependencies to latest compatible versions.
- Verified frontend build and PHP linting.

Co-authored-by: ashcoft <1115854+ashcoft@users.noreply.github.com>
- Updated appinfo/info.xml with Nextcloud 33 support (min-version 30).
- Replaced internal OC\Files\Filesystem::isFileBlacklisted with OCP\Files\IFilenameValidator.
- Fixed vite.config.js to correctly target src/main.ts.
- Updated @nextcloud npm dependencies to latest compatible versions.
- Verified frontend build and PHP linting.

Co-authored-by: ashcoft <1115854+ashcoft@users.noreply.github.com>
…861883122648452809

Nextcloud 33 Compatibility Update for Extract App
- Update max-version to 34 in info.xml
- Bump version to 3.1.0
- Update CHANGELOG.md

Co-authored-by: openhands <openhands@all-hands.dev>
Update translations from Transifex
…dates

Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.5` | `7.3.5` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.5` | `3.4.12` |
| [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.0` |
| [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.15.3` |
| [rollup](https://github.com/rollup/rollup) | `4.50.0` | `4.62.2` |



Updates `vite` from 7.1.5 to 7.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite)

Updates `dompurify` from 3.4.5 to 3.4.12
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.5...3.4.12)

Updates `form-data` from 4.0.5 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

Updates `js-yaml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.0)

Updates `qs` from 6.14.0 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.15.3)

Updates `rollup` from 4.50.0 to 4.62.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.50.0...v4.62.2)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 7.3.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.62.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
…sues

Vite 7.3.5 with esbuild 0.27 cannot transform destructuring patterns
for older browser targets (Chrome 109, Edge 109, iOS 11). This commit
excludes these older browsers from the browserslist to fix the build
failure in CI.

Co-authored-by: openhands <openhands@all-hands.dev>
…rn-6ef150ff13

chore(deps): Bump the npm_and_yarn group across 1 directory with 6 updates
Bumps the npm_and_yarn group with 1 update in the / directory: [fast-uri](https://github.com/fastify/fast-uri).


Updates `fast-uri` from 3.1.0 to 3.1.3
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.3)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
…rn-85f100c75a

chore(deps-dev): Bump fast-uri from 3.1.0 to 3.1.3 in the npm_and_yarn group across 1 directory
The @nextcloud/vite-config v2 requires vite ^7.1.4, but the
merged PR updated vite to ^8.1.4 causing a peer dependency conflict.

Updated @nextcloud/vite-config to ^3.0.0-beta.0 which supports vite v8.

Co-authored-by: openhands <openhands@all-hands.dev>
fix: update @nextcloud/vite-config to v3 beta to support vite v8
- Update @nextcloud/eslint-config from 9.0.0-rc.5 to 9.0.1 (stable)
- Update @nextcloud/stylelint-config from 3.1.0 to 3.2.2
- Update @nextcloud/browserslist-config from 3.0.1 to 3.1.2
- Update openapi-typescript from 7.9.1 to 7.13.0
- Update Node.js requirement to support ^20 || ^22 || ^24
- Update info.xml max-version to 35 for Nextcloud 35 support

Co-authored-by: openhands <openhands@all-hands.dev>
- Change Nextcloud support from 30-35 to 33-34
- Change Node.js requirement to ^24 only
- Update npm requirement to support npm 10 or 11

Co-authored-by: openhands <openhands@all-hands.dev>
- Update @nextcloud/eslint-config to 9.0.1
- Update @nextcloud/stylelint-config to 3.2.2
- Update @nextcloud/browserslist-config to 3.1.2
- Update openapi-typescript to 7.13.0
- Change Node.js requirement to ^24
- Change Nextcloud support to 33-34
- Update phpVersion in psalm.xml to 8.4
- Fix CI workflow to allow phpVersion >= minimum

Co-authored-by: openhands <openhands@all-hands.dev>
chore: NC 33-34 and Node 24+ support
- Add .releaserc configuration for semantic versioning
- Add GitHub Actions workflow to trigger releases on main branch
- Workflow builds the Nextcloud app and attaches to GitHub release

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: openhands <openhands@all-hands.dev>
feat: add semantic-release workflow for auto releases
fix(l10n): Update translations from Transifex
aviator-app Bot and others added 23 commits October 28, 2026 13:58
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Add cache-primary-key and cache-matched-key as outputs by <a href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1577">actions/setup-node#1577</a></li>
<li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1574">actions/setup-node#1574</a></li>
</ul>
<h3>Bug fixes:</h3>
<ul>
<li>Remove dummy NODE_AUTH_TOKEN export by <a href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1558">actions/setup-node#1558</a></li>
<li>Only use <code>mirrorToken</code> in <code>getManifest</code> if it's provided by <a href="https://github.com/deiga"><code>@​deiga</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li>
</ul>
<h3>Documentation updates:</h3>
<ul>
<li>Add documentation for publishing to npm with Trusted Publisher (OIDC) by <a href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li>
<li>docs: Update restore-only cache documentation by <a href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1550">actions/setup-node#1550</a></li>
<li>docs: Update caching recommendations to mitigate cache poisoning risks by <a href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1567">actions/setup-node#1567</a></li>
</ul>
<h3>Dependency update:</h3>
<ul>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li>
<li><a href="https://github.com/deiga"><code>@​deiga</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v7.0.0">https://github.com/actions/setup-node/compare/v6...v7.0.0</a></p>
<h2>v6.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update <code>@​actions/cache</code> to 5.1.0 and add security overrides for undici and fast-xml-parser by <a href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1579">actions/setup-node#1579</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0">https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0</a></p>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Dependency updates:</h3>
<ul>
<li>Upgrade <a href="https://github.com/actions"><code>@​actions</code></a> dependencies by <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
<li>Update Node.js versions in versions.yml and bump package to v6.4.0  by <a href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p>
<h2>v6.3.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Support parsing <code>devEngines</code> field by <a href="https://github.com/susnux"><code>@​susnux</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1283">actions/setup-node#1283</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1"><code>949feb2</code></a> Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1635">#1635</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/7207c4f1189c7ee83ddf20c7c68bd1af6fdd751c"><code>7207c4f</code></a> chore: update dependencies and add license files (<a href="https://redirect.github.com/actions/setup-node/issues/1642">#1642</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/54337e0d02de9202d0948aaff36ad556375497b9"><code>54337e0</code></a> Bump eslint-plugin-n from 18.1.0 to 18.3.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1638">#1638</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/fb54fa8c14c63410cc752f0ae3b7b3ca6af161fc"><code>fb54fa8</code></a> Bump jest-each from 30.4.1 to 30.5.2 (<a href="https://redirect.github.com/actions/setup-node/issues/1636">#1636</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/7f84f1d52d0c56afb45c62fee31a93b843cea4d6"><code>7f84f1d</code></a> Bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1631">#1631</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/0c54c7b07420dcba69a7d832587f55ebdf771c9e"><code>0c54c7b</code></a> Bump <code>@​typescript-eslint/parser</code> from 8.62.0 to 8.70.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1615">#1615</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/a8294190049a9c296f01b9a432aff41dd83d8284"><code>a829419</code></a> Bump <code>@​types/semver</code> from 7.7.1 to 7.8.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1616">#1616</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/680d1e489b82f1243de15bc7665c0007e3c9a860"><code>680d1e4</code></a> Support absolute paths in node-version-file (<a href="https://redirect.github.com/actions/setup-node/issues/1633">#1633</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/db0fb3a98ed314b69026b6e8c9be26a7e2fe65a8"><code>db0fb3a</code></a> Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (<a href="https://redirect.github.com/actions/setup-node/issues/1629">#1629</a>)</li>
<li><a href="https://github.com/actions/setup-node/commit/94196ee1d15439c1b6651cd87ef14e88ec435966"><code>94196ee</code></a> Bump pnpm/action-setup from 6.0.9 to 6.0.10 (<a href="https://redirect.github.com/actions/setup-node/issues/1602">#1602</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/setup-node/compare/v4...v7">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-node&package-manager=github_actions&previous-version=4&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Bumps `actions/setup-node` from v4 to v7 across all GitHub Actions workflows.

**Migration**
- `actions/setup-node` now uses ESM and is a major-version bump, so verify workflows that rely on the action's previous Node.js runtime behavior.
- New outputs for cache primary and matched keys are available in v7 for workflows that need cache inspection.

<sup>Written for commit abe4f92. Summary will update on new commits.</sup>

<a href="https://cubic.dev/pr/ashcoft/extract/pull/47?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
…0 to 3.0.0 (#45)

Bumps [alexwilson/enable-github-automerge-action](https://github.com/alexwilson/enable-github-automerge-action) from 2.0.0 to 3.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/alexwilson/enable-github-automerge-action/releases">alexwilson/enable-github-automerge-action's releases</a>.</em></p>
<blockquote>
<h2>v3.0.0</h2>
<h2><a href="https://github.com/alexwilson/enable-github-automerge-action/compare/2.0.0...3.0.0">3.0.0</a> (2026-05-23)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>migrate to ESM with rollup and @actions/* v3/v9</li>
</ul>
<h3>Features</h3>
<ul>
<li><strong>ci:</strong> attest build provenance on release (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/6bb2875b092c17e4bd476e68509ef4a802c73a48">6bb2875</a>)</li>
<li>migrate to ESM with rollup and @actions/* v3/v9 (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/95d0983a94144b1d6a44ef382f2fc8945d67eff0">95d0983</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>ci:</strong> move bootstrap-sha to the top level of release-please-config (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/cb08dcd17fea66bd4e018cb09fd542936a9f0bd9">cb08dcd</a>)</li>
<li><strong>ci:</strong> move bootstrap-sha to top level of release-please-config (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/dc82c8698679c81b2c167dd6538cc11d75e60c65">dc82c86</a>)</li>
<li><strong>ci:</strong> pin Release Please bootstrap-sha to the 2.0.0 commit (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/3d8ed7409fb8b138229f185826e10313227dec6c">3d8ed74</a>)</li>
<li><strong>ci:</strong> pin Release Please bootstrap-sha to the v2.0.0 commit (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/3c7bc952b76178169693379583cedad769e536ba">3c7bc95</a>)</li>
<li><strong>deps:</strong> Bump <code>@​actions/github</code> from 6.0.1 to 9.1.1 (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/bae253580b8546fea09032408e56f8b1ab945104">bae2535</a>)</li>
<li><strong>deps:</strong> Bump <code>@​actions/github</code> from 6.0.1 to 9.1.1 (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/834c6751d9b1f3d39bd21c22824f3abd4040f1be">834c675</a>)</li>
<li><strong>deps:</strong> downgrade @actions/{core,github} to v1.x/v6.x (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/3a1c8ea3eabf6d0b156fe89d4bd9c15869962467">3a1c8ea</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>strictly pin NPM dependencies (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/57e1247298577d8a047c21029d4c8899698e25d4">57e1247</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/alexwilson/enable-github-automerge-action/blob/main/CHANGELOG.md">alexwilson/enable-github-automerge-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2><a href="https://github.com/alexwilson/enable-github-automerge-action/compare/2.0.0...3.0.0">3.0.0</a> (2026-05-23)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>migrate to ESM with rollup and @actions/* v3/v9</li>
</ul>
<h3>Features</h3>
<ul>
<li><strong>ci:</strong> attest build provenance on release (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/6bb2875b092c17e4bd476e68509ef4a802c73a48">6bb2875</a>)</li>
<li>migrate to ESM with rollup and @actions/* v3/v9 (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/95d0983a94144b1d6a44ef382f2fc8945d67eff0">95d0983</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>ci:</strong> move bootstrap-sha to the top level of release-please-config (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/cb08dcd17fea66bd4e018cb09fd542936a9f0bd9">cb08dcd</a>)</li>
<li><strong>ci:</strong> move bootstrap-sha to top level of release-please-config (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/dc82c8698679c81b2c167dd6538cc11d75e60c65">dc82c86</a>)</li>
<li><strong>ci:</strong> pin Release Please bootstrap-sha to the 2.0.0 commit (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/3d8ed7409fb8b138229f185826e10313227dec6c">3d8ed74</a>)</li>
<li><strong>ci:</strong> pin Release Please bootstrap-sha to the v2.0.0 commit (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/3c7bc952b76178169693379583cedad769e536ba">3c7bc95</a>)</li>
<li><strong>deps:</strong> Bump <code>@​actions/github</code> from 6.0.1 to 9.1.1 (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/bae253580b8546fea09032408e56f8b1ab945104">bae2535</a>)</li>
<li><strong>deps:</strong> Bump <code>@​actions/github</code> from 6.0.1 to 9.1.1 (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/834c6751d9b1f3d39bd21c22824f3abd4040f1be">834c675</a>)</li>
<li><strong>deps:</strong> downgrade @actions/{core,github} to v1.x/v6.x (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/3a1c8ea3eabf6d0b156fe89d4bd9c15869962467">3a1c8ea</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>strictly pin NPM dependencies (<a href="https://github.com/alexwilson/enable-github-automerge-action/commit/57e1247298577d8a047c21029d4c8899698e25d4">57e1247</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/2c32e18a76e0726ffe7a573bfff2d42a20885126"><code>2c32e18</code></a> Merge pull request <a href="https://redirect.github.com/alexwilson/enable-github-automerge-action/issues/638">#638</a> from alexwilson/release-please--branches--main--compo...</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/4bb2a6a27499886cccf5ecadb92ec9b30f03fb3b"><code>4bb2a6a</code></a> chore(main): release 3.0.0</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/dc82c8698679c81b2c167dd6538cc11d75e60c65"><code>dc82c86</code></a> Merge pull request <a href="https://redirect.github.com/alexwilson/enable-github-automerge-action/issues/641">#641</a> from alexwilson/fix-bootstrap-sha-placement</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/cb08dcd17fea66bd4e018cb09fd542936a9f0bd9"><code>cb08dcd</code></a> fix(ci): move bootstrap-sha to the top level of release-please-config</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/3d8ed7409fb8b138229f185826e10313227dec6c"><code>3d8ed74</code></a> Merge pull request <a href="https://redirect.github.com/alexwilson/enable-github-automerge-action/issues/640">#640</a> from alexwilson/release-please-bootstrap-sha</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/3c7bc952b76178169693379583cedad769e536ba"><code>3c7bc95</code></a> fix(ci): pin Release Please bootstrap-sha to the v2.0.0 commit</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/33f223701a4ab892c664333ec676bcddea700f8b"><code>33f2237</code></a> Merge pull request <a href="https://redirect.github.com/alexwilson/enable-github-automerge-action/issues/639">#639</a> from alexwilson/add-tests-and-provenance</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/6bb2875b092c17e4bd476e68509ef4a802c73a48"><code>6bb2875</code></a> feat(ci): attest build provenance on release</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/981f2fe41b64d648bca72dfaa668fda2bb36dbf8"><code>981f2fe</code></a> test: add vitest with contract tests for EnableGithubAutomergeAction</li>
<li><a href="https://github.com/alexwilson/enable-github-automerge-action/commit/685a6f0ee48f95a62033eb317cdb747471541d01"><code>685a6f0</code></a> Merge pull request <a href="https://redirect.github.com/alexwilson/enable-github-automerge-action/issues/637">#637</a> from alexwilson/migrate-to-esm</li>
<li>Additional commits viewable in <a href="https://github.com/alexwilson/enable-github-automerge-action/compare/56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff...2c32e18a76e0726ffe7a573bfff2d42a20885126">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=alexwilson/enable-github-automerge-action&package-manager=github_actions&previous-version=2.0.0&new-version=3.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Updates the `alexwilson/enable-github-automerge-action` GitHub Action from v2.0.0 to v3.0.0 in the Nextcloud OCP update workflow.

This is a major version bump that migrates the action to ESM and brings breaking changes, so verify the auto-merge step still works as expected.

<sup>Written for commit eab05ef. Summary will update on new commits.</sup>

<a href="https://cubic.dev/pr/ashcoft/extract/pull/45?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p>
<h2>v6.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
<li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v4...v7">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=4&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Updates `actions/checkout` to v7.0.1 across all GitHub Actions workflows, replacing workflows pinned to v4, v5, or v6 with the same SHA-pinned version.

**Breaking changes**
- v7 blocks checking out fork PRs for `pull_request_target` and `workflow_run` triggers by default; set `allow-unsafe-pr-checkout: true` to opt back in.

<sup>Written for commit 6ccec3f. Summary will update on new commits.</sup>

<a href="https://cubic.dev/pr/ashcoft/extract/pull/46?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.2 to 4.0.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p>
<blockquote>
<h2>v4.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update Outputs in readme to account for the 'every' predicate-quantifier by <a href="https://github.com/hintron"><code>@​hintron</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li>
<li>fix: scope base-ignored warning to API path by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/319">dorny/paths-filter#319</a></li>
<li>docs: add contents permission to PR example by <a href="https://github.com/134130"><code>@​134130</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li>
<li>feat: add 'some-with-excludes' predicate quantifier by <a href="https://github.com/arxeiss"><code>@​arxeiss</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li>
<li>Document safe handling of file list outputs in workflows by <a href="https://github.com/dorny"><code>@​dorny</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/326">dorny/paths-filter#326</a></li>
</ul>
<h2>Security</h2>
<ul>
<li>Escape multi-line filenames in list-files shell and csv output] by <a href="https://github.com/ken-matsui"><code>@​ken-matsui</code></a> and <a href="https://github.com/tjswlsgg"><code>@​tjswlsgg</code></a> in <a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">https://github.com/advisories/GHSA-7hc6-8hq5-9q2m</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/hintron"><code>@​hintron</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li>
<li><a href="https://github.com/134130"><code>@​134130</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li>
<li><a href="https://github.com/arxeiss"><code>@​arxeiss</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4...v4.0.3">https://github.com/dorny/paths-filter/compare/v4...v4.0.3</a></p>
<h2>v4.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>fix warning message by <a href="https://github.com/cgundy"><code>@​cgundy</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/282">dorny/paths-filter#282</a></li>
<li>chore: fix GitHub spelling in logs by <a href="https://github.com/squat"><code>@​squat</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/278">dorny/paths-filter#278</a></li>
<li>fix: use rev-parse instead of branch --show-current for older git compat by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/303">dorny/paths-filter#303</a></li>
<li>fix: work around git dubious ownership errors in container jobs by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/317">dorny/paths-filter#317</a></li>
<li>docs: update changelog for v4.0.2 by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/318">dorny/paths-filter#318</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/cgundy"><code>@​cgundy</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/282">dorny/paths-filter#282</a></li>
<li><a href="https://github.com/squat"><code>@​squat</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/278">dorny/paths-filter#278</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2">https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2</a></p>
<h2>v4.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Support merge queue by <a href="https://github.com/masaru-iritani"><code>@​masaru-iritani</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/255">dorny/paths-filter#255</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/masaru-iritani"><code>@​masaru-iritani</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/255">dorny/paths-filter#255</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1">https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1</a></p>
<h2>v4.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: update action runtime to node24 by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/294">dorny/paths-filter#294</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/294">dorny/paths-filter#294</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0">https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v4.0.3</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/326">Document safe handling of file list outputs in workflows</a></li>
<li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/322">Add 'some-with-excludes' predicate quantifier</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/248">Add contents permission to PR example</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/319">Scope base-ignored warning to API path</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/247">Update outputs in readme to account for the 'every' predicate-quantifier</a></li>
</ul>
<h2>v4.0.2</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/317">Work around git dubious ownership errors in container jobs</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/303">Use rev-parse instead of branch --show-current for older git compat</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/282">Fix warning message</a></li>
</ul>
<h2>v4.0.1</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/255">Support merge queue</a></li>
</ul>
<h2>v4.0.0</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li>
</ul>
<h2>v3.0.4</h2>
<ul>
<li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li>
</ul>
<h2>v3.0.3</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li>
</ul>
<h2>v3.0.2</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li>
</ul>
<h2>v3.0.1</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li>
</ul>
<h2>v3.0.0</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li>
</ul>
<h2>v2.11.1</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @​actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li>
</ul>
<h2>v2.11.0</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li>
</ul>
<h2>v2.10.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dorny/paths-filter/commit/ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d"><code>ceb8a2b</code></a> Update CHANGELOG.md for v4.0.3 and v3.0.4 (<a href="https://redirect.github.com/dorny/paths-filter/issues/327">#327</a>)</li>
<li><a href="https://github.com/dorny/paths-filter/commit/ef09b88f3eacdbec6ce135a7c9a193a6849545c1"><code>ef09b88</code></a> Document safe handling of file list outputs in workflows (<a href="https://redirect.github.com/dorny/paths-filter/issues/326">#326</a>)</li>
<li><a href="https://github.com/dorny/paths-filter/commit/44adc5b06dc135dba334efce9bf3cf0624512d2d"><code>44adc5b</code></a> Merge commit from fork</li>
<li><a href="https://github.com/dorny/paths-filter/commit/4711b7a31b4aa89103d8c6ffab2e3b8e7b6381c7"><code>4711b7a</code></a> feat: add 'some-with-excludes' predicate quantifier (<a href="https://redirect.github.com/dorny/paths-filter/issues/322">#322</a>)</li>
<li><a href="https://github.com/dorny/paths-filter/commit/93c889f9e58fca66f35a0c83d8673ac7e88bb70a"><code>93c889f</code></a> fix: escape multi-line filenames in list-files shell and csv output</li>
<li><a href="https://github.com/dorny/paths-filter/commit/b41dfa943b1939b9b646f67753bfe35cf6e4de03"><code>b41dfa9</code></a> docs: add contents permission to PR example (<a href="https://redirect.github.com/dorny/paths-filter/issues/248">#248</a>)</li>
<li><a href="https://github.com/dorny/paths-filter/commit/9af6e5a9d010d1ae8ec570390b3d793e2b70a402"><code>9af6e5a</code></a> fix: scope base-ignored warning to API path (<a href="https://redirect.github.com/dorny/paths-filter/issues/319">#319</a>)</li>
<li><a href="https://github.com/dorny/paths-filter/commit/cae9006b65a1a53044b518c68e13e835c54948a7"><code>cae9006</code></a> docs: update outputs in readme to account for the 'every' predicate-quantifie...</li>
<li><a href="https://github.com/dorny/paths-filter/commit/7b450fff21473bca461d4b92ce414b9d0420d706"><code>7b450ff</code></a> docs: update changelog for v4.0.2 (<a href="https://redirect.github.com/dorny/paths-filter/issues/318">#318</a>)</li>
<li><a href="https://github.com/dorny/paths-filter/commit/928037783a71f24983ea250c6e55290c1b2de54f"><code>9280377</code></a> fix: work around git dubious ownership errors in container jobs (<a href="https://redirect.github.com/dorny/paths-filter/issues/317">#317</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/dorny/paths-filter/compare/de90cc6fb38fc0963ad72b210f1f284cd68cea36...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dorny/paths-filter&package-manager=github_actions&previous-version=3.0.2&new-version=4.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Updates the `dorny/paths-filter` action from v3.0.2 to v4.0.3 in the ESLint lint and Node.js test workflows. This is a major version bump that switches the action runtime to Node.js 24, adds merge queue support, and ships a security fix that escapes multi-line filenames in list-files output. The new 'some-with-excludes' predicate quantifier is also available. No workflow configuration changes are required.

<sup>Written for commit 6cbad69. Summary will update on new commits.</sup>

<a href="https://cubic.dev/pr/ashcoft/extract/pull/48?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
Bumps the github-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [webiny/action-conventional-commits](https://github.com/webiny/action-conventional-commits) | `1.3.0` | `1.4.2` |
| [icewind1991/nextcloud-version-matrix](https://github.com/icewind1991/nextcloud-version-matrix) | `1.3.1` | `1.3.3` |
| [shivammathur/setup-php](https://github.com/shivammathur/setup-php) | `2.35.2` | `2.40.0` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` |
| [andstor/file-existence-action](https://github.com/andstor/file-existence-action) | `3.0.0` | `3.1.0` |

Updates `webiny/action-conventional-commits` from 1.3.0 to 1.4.2
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/7f91b1595ca1951cdb671ddc9f07a49081ec5b69"><code>7f91b15</code></a> fix: allow 'improvement' prefix</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/096eff5dd1a2f7e3a16ae477ffb5f426d6900450"><code>096eff5</code></a> fix: allow 'improvement' prefix</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/b6cc3cc74284fe3f321ba308fa1111d8ca55cd46"><code>b6cc3cc</code></a> docs: update latest version</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/6a05e2b4fcefe644919efae1f24dcadfd2d3324b"><code>6a05e2b</code></a> feat: use node24</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/b34f00be3f9b4cb0a64eec37b96bcacd5c8a2166"><code>b34f00b</code></a> Merge remote-tracking branch 'origin/master'</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/faccb24fc2550dd15c0390d944379d2d8ed9690e"><code>faccb24</code></a> chore: prepare release</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/6026468a068b62aa98d5696b0c5378ae2b7005af"><code>6026468</code></a> feat: refactor commit message validation to use exception list</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/0fecf10b8a64a229b5c09b93e9bf1ff6bfbb423e"><code>0fecf10</code></a> feat: refactor commit message validation to use exception list</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/9ce07774e99cf4d88b2c993fe6f7c8393e3de167"><code>9ce0777</code></a> chore: add reapply as valid commit type</li>
<li><a href="https://github.com/webiny/action-conventional-commits/commit/54c7d1f80e5f26de9ab24968e1c6f3273210f95b"><code>54c7d1f</code></a> Update action.yml</li>
<li>See full diff in <a href="https://github.com/webiny/action-conventional-commits/compare/8bc41ff4e7d423d56fa4905f6ff79209a78776c7...7f91b1595ca1951cdb671ddc9f07a49081ec5b69">compare view</a></li>
</ul>
</details>
<br />

Updates `icewind1991/nextcloud-version-matrix` from 1.3.1 to 1.3.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/icewind1991/nextcloud-version-matrix/releases">icewind1991/nextcloud-version-matrix's releases</a>.</em></p>
<blockquote>
<h2>1.3.3</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: Use node24 instead of node20 by <a href="https://github.com/DerDreschner"><code>@​DerDreschner</code></a> in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/5">icewind1991/nextcloud-version-matrix#5</a></li>
<li>feat: Support optional PHP min/max version property in info.xml by <a href="https://github.com/DerDreschner"><code>@​DerDreschner</code></a> in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/6">icewind1991/nextcloud-version-matrix#6</a></li>
<li>perf(versions): Hardcode known PHP versions and Nextcloud PHP version… by <a href="https://github.com/nickvergessen"><code>@​nickvergessen</code></a> in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/9">icewind1991/nextcloud-version-matrix#9</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/DerDreschner"><code>@​DerDreschner</code></a> made their first contribution in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/5">icewind1991/nextcloud-version-matrix#5</a></li>
<li><a href="https://github.com/nickvergessen"><code>@​nickvergessen</code></a> made their first contribution in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/9">icewind1991/nextcloud-version-matrix#9</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/icewind1991/nextcloud-version-matrix/compare/v1.3.2...v1.3.3">https://github.com/icewind1991/nextcloud-version-matrix/compare/v1.3.2...v1.3.3</a></p>
<h2>1.3.2</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(log): Log why a PHP version was skipped/used by <a href="https://github.com/SystemKeeper"><code>@​SystemKeeper</code></a> in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/2">icewind1991/nextcloud-version-matrix#2</a></li>
<li>feat: Expose PHP version IDs by <a href="https://github.com/provokateurin"><code>@​provokateurin</code></a> in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/3">icewind1991/nextcloud-version-matrix#3</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/SystemKeeper"><code>@​SystemKeeper</code></a> made their first contribution in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/2">icewind1991/nextcloud-version-matrix#2</a></li>
<li><a href="https://github.com/provokateurin"><code>@​provokateurin</code></a> made their first contribution in <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/pull/3">icewind1991/nextcloud-version-matrix#3</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/icewind1991/nextcloud-version-matrix/compare/v1...v1.3.2">https://github.com/icewind1991/nextcloud-version-matrix/compare/v1...v1.3.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/cd0211ffcef1065e2020cd579e4843b8746e7a58"><code>cd0211f</code></a> 1.3.3</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/a4d75922b9ee97af8ad30d5c9ad4c773544787e6"><code>a4d7592</code></a> Merge pull request <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/issues/9">#9</a> from nickvergessen/perf/noid/hard-code-known-released-v...</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/b7b0de6f6bcc660b53a4cac736763ee4f7e045d3"><code>b7b0de6</code></a> perf(versions): Hardcode known PHP versions and Nextcloud PHP version ranges</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/a4b58a294b3626e6f62c7ab6235715ba3893a238"><code>a4b58a2</code></a> Merge pull request <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/issues/8">#8</a> from DerDreschner/chore/update-dependencies</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/25ddaceda212510db542d41b1a98fd5c1bc424e7"><code>25ddace</code></a> feat: Update dependencies to latest version and refactor action to ES6 module</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/0dbaa1807b1980aec194d9fc4ee6a26c3249b3f0"><code>0dbaa18</code></a> Merge pull request <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/issues/7">#7</a> from DerDreschner/chore/update-github-actions</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/40f959f606954e0745e4e6eadd4d9dec4992adf2"><code>40f959f</code></a> Merge pull request <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/issues/6">#6</a> from DerDreschner/feat/support-php-min-max-version</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/a0aa85fc6b46c3c1e2a9317fc37190521d523316"><code>a0aa85f</code></a> chore: Update used GitHub Actions and introduce version pinning</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/7a9036702e376e75b5bb8b74943b5177bb2707ca"><code>7a90367</code></a> feat: Support PHP min/max version property in info.xml</li>
<li><a href="https://github.com/nextcloud-libraries/nextcloud-version-matrix/commit/ca3ece335ebd7c484a0e03c3a77bc573e12a8a14"><code>ca3ece3</code></a> Merge pull request <a href="https://redirect.github.com/icewind1991/nextcloud-version-matrix/issues/5">#5</a> from DerDreschner/feat/use-node24</li>
<li>Additional commits viewable in <a href="https://github.com/icewind1991/nextcloud-version-matrix/compare/58becf3b4bb6dc6cef677b15e2fd8e7d48c0908f...cd0211ffcef1065e2020cd579e4843b8746e7a58">compare view</a></li>
</ul>
</details>
<br />

Updates `shivammathur/setup-php` from 2.35.2 to 2.40.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/shivammathur/setup-php/releases">shivammathur/setup-php's releases</a>.</em></p>
<blockquote>
<h2>2.40.0</h2>
<h2>Changelog</h2>
<ul>
<li>Added support for PHP 8.7 nightly builds. This installs PHP builds from the master branch of <code>php/php-src</code>.</li>
</ul>
<pre lang="yaml"><code>- name: Setup PHP 8.7
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.7'
</code></pre>
<ul>
<li>
<p>Added support for Ubuntu 26.04 (<code>ubuntu-26.04</code>). (<a href="https://redirect.github.com/shivammathur/setup-php/issues/1083">#1083</a>)</p>
</li>
<li>
<p>Added support for pinning tools to SHA-256 and SHA-512 checksums. (<a href="https://redirect.github.com/shivammathur/setup-php/issues/1098">#1098</a>, <a href="https://redirect.github.com/shivammathur/setup-php/issues/1099">#1099</a>)</p>
</li>
</ul>
<pre lang="yml"><code>- name: Setup PHP with tools pinned to checksums
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: &gt;
      composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890,
      phpunit:12.5.0@sha512:76430b433bd57f96e5fbbabaefc0c82e3a5b19b1a366bd836614344c441a7a87575d77faa07e0e58ecec52061af67584b036adc4311f0764bd4414bc62be4684
</code></pre>
<ul>
<li>
<p>Fixed support for Couchbase, Oracle, and IBM extensions on Ubuntu 26.04. (<a href="https://redirect.github.com/shivammathur/setup-php/issues/1123">#1123</a>)</p>
</li>
<li>
<p>Added support for <code>cpx</code>. (<a href="https://redirect.github.com/shivammathur/setup-php/issues/1104">#1104</a>)</p>
</li>
</ul>
<pre lang="yaml"><code>- name: Setup PHP with cpx
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: cpx
</code></pre>
<ul>
<li>Added support for Laravel Cloud CLI. (<a href="https://redirect.github.com/shivammathur/setup-php/issues/1106">#1106</a>)</li>
</ul>
<pre lang="yaml"><code>- name: Setup PHP with Laravel Cloud CLI
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: laravel-cloud
</code></pre>
<ul>
<li>Added configurable verbose logging using the <code>verbose</code> environment variable. Set it to <code>true</code> or <code>v</code> to show command output, or <code>vv</code> or <code>vvv</code> to also enable tracing. Also, deprecated the <code>verbose</code> and <code>more-verbose</code> tags in favor of this environment variable. (<a href="https://redirect.github.com/shivammathur/setup-php/issues/1077">#1077</a>, <a href="https://redirect.github.com/shivammathur/setup-php/issues/1118">#1118</a>, <a href="https://redirect.github.com/shivammathur/setup-php/issues/1119">#1119</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/shivammathur/setup-php/commit/eb7c497e18156a6bbabfef1d3a82760b9eda3962"><code>eb7c497</code></a> Bump version to 2.40.0</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/7d671baa106836ddfdf0815d09c44943ba13c737"><code>7d671ba</code></a> Resolve PHP formula aliases before invoking Homebrew</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/57747c1c10748738c86becc2bc27798b21508566"><code>57747c1</code></a> Allow opt-in builds cache on Blacksmith and Depot runners</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/421f97feafdad867301f2429af811a147575170f"><code>421f97f</code></a> Keep verbose tests in TypeScript</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/dc7811a514f071bf62db5f480e4bb49fa2de20b9"><code>dc7811a</code></a> Bump Node.js dependencies</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/79322934d8802797741a82d782c56e590d7cedf5"><code>7932293</code></a> Bump the github-actions group with 3 updates (<a href="https://redirect.github.com/shivammathur/setup-php/issues/1130">#1130</a>)</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/87d00bde2555f25eb54fedf940384e99cbdc55ef"><code>87d00bd</code></a> Default &quot;Are you willing to submit a PR?&quot; to &quot;No&quot; (<a href="https://redirect.github.com/shivammathur/setup-php/issues/1126">#1126</a>)</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/f458a145e36674941f4e14e29bd6c85e6c76e6d3"><code>f458a14</code></a> Remove macOS 14 from README runner listings</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/bc12f5cef4c73a871331e196ff380d38232ba293"><code>bc12f5c</code></a> Switch to homebrew-extensions for geos on macOS [skip ci]</li>
<li><a href="https://github.com/shivammathur/setup-php/commit/bbf0b638cc0ebcab45364fd1dab7d2a765568805"><code>bbf0b63</code></a> Try Brew extension installs before refreshing Homebrew</li>
<li>Additional commits viewable in <a href="https://github.com/shivammathur/setup-php/compare/2.35.2...eb7c497e18156a6bbabfef1d3a82760b9eda3962">compare view</a></li>
</ul>
</details>
<br />

Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/create-github-app-token/releases">actions/create-github-app-token's releases</a>.</em></p>
<blockquote>
<h2>v3.3.0</h2>
<h2><a href="https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0">3.3.0</a> (2026-10-12)</h2>
<h3>Features</h3>
<ul>
<li>update permission inputs (<a href="https://redirect.github.com/actions/create-github-app-token/issues/399">#399</a>) (<a href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e">a47236f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump nested undici from 6.24.0 to 6.29.0 (<a href="https://redirect.github.com/actions/create-github-app-token/issues/403">#403</a>) (<a href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb">12461a3</a>)</li>
<li><strong>deps:</strong> bump the production-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/create-github-app-token/issues/395">#395</a>) (<a href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807">a69c19d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md">actions/create-github-app-token's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2><a href="https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0">3.3.0</a> (2026-10-12)</h2>
<h3>Features</h3>
<ul>
<li>update permission inputs (<a href="https://redirect.github.com/actions/create-github-app-token/issues/399">#399</a>) (<a href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e">a47236f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump nested undici from 6.24.0 to 6.29.0 (<a href="https://redirect.github.com/actions/create-github-app-token/issues/403">#403</a>) (<a href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb">12461a3</a>)</li>
<li><strong>deps:</strong> bump the production-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/create-github-app-token/issues/395">#395</a>) (<a href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807">a69c19d</a>)</li>
</ul>
<h2><a href="https://github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0">3.2.0</a> (2026-05-12)</h2>
<h3>Features</h3>
<ul>
<li>add support for enterprise-level GitHub Apps (<a href="https://redirect.github.com/actions/create-github-app-token/issues/263">#263</a>) (<a href="https://github.com/actions/create-github-app-token/commit/952a2a7073df6bfa5f49bc469ec895b6ec1acea4">952a2a7</a>)</li>
<li>support full repository names in <code>repositories</code> input (<a href="https://redirect.github.com/actions/create-github-app-token/issues/372">#372</a>) (<a href="https://github.com/actions/create-github-app-token/commit/85eb8dd41472213aed25d1a126460e0069138ab6">85eb8dd</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump <code>@​actions/core</code> from 3.0.0 to 3.0.1 in the production-dependencies group (<a href="https://redirect.github.com/actions/create-github-app-token/issues/364">#364</a>) (<a href="https://github.com/actions/create-github-app-token/commit/43e5c345bfd4d4f3ecea019ad0042001a09dd857">43e5c34</a>)</li>
<li>validate private-key input (<a href="https://redirect.github.com/actions/create-github-app-token/issues/376">#376</a>) (<a href="https://github.com/actions/create-github-app-token/commit/f24bbd89643991c0de27ae823c01791b2c6bafdd">f24bbd8</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/create-github-app-token/commit/64ab729a6294000f5aa4a4bc0b73d1f32bc45510"><code>64ab729</code></a> chore(main): release 3.3.0 (<a href="https://redirect.github.com/actions/create-github-app-token/issues/402">#402</a>)</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/f3a828e4b91180d3a46ac1f4b43fa8384b0dea07"><code>f3a828e</code></a> ci: create signed dist commits in release workflow (<a href="https://redirect.github.com/actions/create-github-app-token/issues/404">#404</a>)</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/655017ffa7c6b0c6e4210729fa6bce35cacd8ca0"><code>655017f</code></a> docs: clarify when owner grants access to all repositories (<a href="https://redirect.github.com/actions/create-github-app-token/issues/378">#378</a>)</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb"><code>12461a3</code></a> fix(deps): bump nested undici from 6.24.0 to 6.29.0 (<a href="https://redirect.github.com/actions/create-github-app-token/issues/403">#403</a>)</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e"><code>a47236f</code></a> feat: update permission inputs (<a href="https://redirect.github.com/actions/create-github-app-token/issues/399">#399</a>)</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807"><code>a69c19d</code></a> fix(deps): bump the production-dependencies group across 1 directory with 3 u...</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/d5cb7ae41d64331820d88810a4878e0942ec992a"><code>d5cb7ae</code></a> build(deps): bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/create-github-app-token/issues/384">#384</a>)</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/575da866bd0a42d7f234a8645831d55573252b09"><code>575da86</code></a> build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/e85f677b44da0d1f08115ce52cdfd8fd2c69874a"><code>e85f677</code></a> test: omit stack traces from snapshots (<a href="https://redirect.github.com/actions/create-github-app-token/issues/401">#401</a>)</li>
<li><a href="https://github.com/actions/create-github-app-token/commit/9419396df4d5672241cfb593dadc19758e54a204"><code>9419396</code></a> build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (<a href="https://redirect.github.com/actions/create-github-app-token/issues/400">#400</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/create-github-app-token/compare/v3.2.0...64ab729a6294000f5aa4a4bc0b73d1f32bc45510">compare view</a></li>
</ul>
</details>
<br />

Updates `andstor/file-existence-action` from 3.0.0 to 3.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/andstor/file-existence-action/releases">andstor/file-existence-action's releases</a>.</em></p>
<blockquote>
<h2>v3.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: Add verbose mode by <a href="https://github.com/ffflorian"><code>@​ffflorian</code></a> in <a href="https://redirect.github.com/andstor/file-existence-action/pull/167">andstor/file-existence-action#167</a></li>
<li>Upgrade to Node 24 by <a href="https://github.com/JordanLongstaff"><code>@​JordanLongstaff</code></a> in <a href="https://redirect.github.com/andstor/file-existence-action/pull/173">andstor/file-existence-action#173</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/ffflorian"><code>@​ffflorian</code></a> made their first contribution in <a href="https://redirect.github.com/andstor/file-existence-action/pull/167">andstor/file-existence-action#167</a></li>
<li><a href="https://github.com/JordanLongstaff"><code>@​JordanLongstaff</code></a> made their first contribution in <a href="https://redirect.github.com/andstor/file-existence-action/pull/173">andstor/file-existence-action#173</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/andstor/file-existence-action/compare/v3...v3.1.0">https://github.com/andstor/file-existence-action/compare/v3...v3.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/andstor/file-existence-action/commit/558493d6c74bf472d87c84eab196434afc2fa029"><code>558493d</code></a> 3.1.0</li>
<li><a href="https://github.com/andstor/file-existence-action/commit/0bc99e9c2f3d23f0df224bb615340860a0f98b30"><code>0bc99e9</code></a> Remove broken link</li>
<li><a href="https://github.com/andstor/file-existence-action/commit/05c781222aaaac471c2d23e7e03a9fbbc05b37ad"><code>05c7812</code></a> Merge pull request <a href="https://redirect.github.com/andstor/file-existence-action/issues/173">#173</a> from JordanLongstaff/node24</li>
<li><a href="https://github.com/andstor/file-existence-action/commit/9d879cb5dcf25143ddb9c182a22f2b0a3c705724"><code>9d879cb</code></a> Upgrade to Node 24</li>
<li><a href="https://github.com/andstor/file-existence-action/commit/4dadd155f3f57f55d6b0d107a63df19fe3d4a5e6"><code>4dadd15</code></a> Merge pull request <a href="https://redirect.github.com/andstor/file-existence-action/issues/167">#167</a> from ffflorian/feat/verbose-mode</li>
<li><a href="https://github.com/andstor/file-existence-action/commit/ef4a23d940c1537decf3cb6643b65f1e771d9d7c"><code>ef4a23d</code></a> add missing input</li>
<li><a href="https://github.com/andstor/file-existence-action/commit/a2408f02805bb2fff9d9f2287d6e166dbe1254cd"><code>a2408f0</code></a> feat: Add verbose mode</li>
<li><a href="https://github.com/andstor/file-existence-action/commit/31a502724c77ada11ba0b3442e34757182ccdbd3"><code>31a5027</code></a> Update README.md</li>
<li>See full diff in <a href="https://github.com/andstor/file-existence-action/compare/076e0072799f4942c8bc574a82233e1e4d13e9d6...558493d6c74bf472d87c84eab196434afc2fa029">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Bumps the `github-actions` group across all workflow files, updating five actions to their latest pinned versions: `webiny/action-conventional-commits`, `icewind1991/nextcloud-version-matrix`, `shivammathur/setup-php`, `actions/create-github-app-token`, and `andstor/file-existence-action`.

All updates are minor or patch releases without breaking changes. Several actions now run on Node 24, which is supported by current GitHub-hosted runners.

<sup>Written for commit 3a0657f. Summary will update on new commits.</sup>

<a href="https://cubic.dev/pr/ashcoft/extract/pull/44?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
The 4 upstream commits (npm-audit-fix and sync-workflow-templates changes) were
already applied to main by content in #39, but they were applied as new commits
rather than by merging upstream's history. GitHub's compare view therefore still
reported main as "behind by 4", because it measures commit ancestry, not content.

This merges upstream/main into main. The merge introduces no file changes: the
tree is byte-identical before and after, which is why git resolved it without
conflicts. It exists purely so upstream/main becomes an ancestor of main and the
compare reads as up to date.

No content from this repository is altered. In particular the action-version
pins that Dependabot raised here (for example create-github-app-token v3.3.0
over upstream's v3.2.0) are preserved, since the merge takes no content from
either side.

Co-authored-by: openhands <openhands@all-hands.dev>
chore(sync): merge upstream LibreCodeCoop/main to close the ancestry gap
## [3.1.2](v3.1.1...v3.1.2) (2026-10-29)

### Bug Fixes

* **ci:** adopt secured LibreCode npm audit workflow ([2c9e0ea](2c9e0ea))
* **ci:** exclude EOL Nextcloud branches from npm audit ([62cd386](62cd386))
The v3.1.2 release failed, so the tag exists but the release has no archives:

  @semantic-release/github -> Failed step "success"
  RequestError [HttpError]: Not Found
  GET https://api.github.com/repos/ashcoft/extract/pulls/165/commits

The success step resolves each released commit to a pull request and fails the
whole release with a 404 when a number cannot be resolved. Merging
LibreCodeCoop/extract's history brought in commits whose messages reference
pull requests that exist only upstream, for example:

  Merge pull request LibreCodeCoop#165 from LibreCodeCoop/fix/manage-npm-audit-through-librcode-catalog

PR LibreCodeCoop#165 does not exist in this repository, so the lookup 404s. That commit is
now permanently part of main, so every future release would fail the same way.

Disable the comment and label side of the success step:

- `successCommentCondition: false` skips the block that performs the PR lookup.
  The condition form is used rather than `successComment: false`, which the
  plugin logs as deprecated.
- `releasedLabels: false` stops the step trying to label those same PRs.

Nothing is lost here: the app is not published to npm and no issue or PR
subscribers depend on release comments.

Co-authored-by: openhands <openhands@all-hands.dev>
"Encryption is not supported yet" was shown for every user as soon as any
encryption module was enabled on the instance, even for archives that were not
encrypted. The check consulted the server-wide flag:

    if ($this->encryptionManager->isEnabled()) { ...refuse... }

That flag only reports whether an encryption module is *available*, not whether
the file being extracted is encrypted, so it blocked a valid use case.

Extraction works with server-side encryption. The archive is read through
Storage::getLocalFile(), and the encryption storage wrapper serves that from a
decrypted temporary file: getLocalFile() calls getCachedFile(), which calls
toTmpFile(), which copies through fopen(). fopen() goes through the wrapper's
decryption path, so the bytes handed to 7za or ZipArchive are already
plaintext. Nothing in the extraction path needs to change.

Remove the refusal, the now-unused OCP\Encryption\IManager constructor
dependency and its import, and add a test asserting the refusal cannot return.
Update the README and appinfo/info.xml, which both advertised the old
limitation.

Password-protected archives remain unsupported; that is a separate limitation
and is still documented.

Co-authored-by: openhands <openhands@all-hands.dev>
fix(release): stop the release failing on upstream pull request numbers
## [3.1.3](v3.1.2...v3.1.3) (2026-10-30)

### Bug Fixes

* **release:** stop the release failing on upstream pull request numbers ([3876977](3876977)), closes [LibreCodeCoop#165](https://github.com/ashcoft/extract/issues/165) [LibreCodeCoop/fix/manage-npm-audit-throu#librcode-catalog](https://github.com/LibreCodeCoop/fix/manage-npm-audit-throu/issues/librcode-catalog) [LibreCodeCoop#165](https://github.com/ashcoft/extract/issues/165)
Follow-up to the previous commit, which removed the encryption refusal. Two
review findings, both confirmed.

cubic P1: removing the refusal made a broken path reachable. The destination is
derived from the archive's local path:

    $dir       = dirname($file);
    $extractTo = $dir . '/' . $fileName;

and postExtract() then expects Nextcloud to see the result there. That holds for
plain local storage, where getLocalFile() returns the file inside the data
directory. It does not hold with server-side encryption enabled or on object
storage: Encryption::getLocalFile() falls through to
LocalTempFileTrait::getCachedFile(), so the path is a TempManager file, $dir
becomes /tmp, and nothing is published. The user would get a success and no
folder.

Guard on Storage::isLocal() instead. That is the actual precondition: false both
when encryption is enabled (Wrapper\Encryption::isLocal() returns false) and for
object storage (Common::isLocal() documents "the common implementation returns a
temporary file by default"). The old encryption check missed object storage
entirely.

sourcery and cubic: the PHP rar path ignored $entry->extract() and returned
success, so a password-protected or damaged entry produced a partial result
reported as complete. It now fails the extraction and logs the entry.

Replace the source-text regression test with behavioural tests that drive
execute(): one asserts a non-local storage is refused before the service is
reached, the other that local storage passes the guard and reaches extraction.

tests/stubs/oc_hooks_emitter.php declared Emitter as a class, but the real type
is an interface, so the OCP interfaces could not be loaded outside a full
Nextcloud checkout. Corrected to an interface and loaded from the bootstrap.

Co-authored-by: openhands <openhands@all-hands.dev>
Codacy's comparison-operator check flags the bare boolean in the new storage
ternary. Compare explicitly, matching the style used elsewhere in this file.

Co-authored-by: openhands <openhands@all-hands.dev>
fix(extraction): allow extraction when server-side encryption is enabled
## [3.1.4](v3.1.3...v3.1.4) (2026-10-30)

### Bug Fixes

* **extraction:** allow extraction when server-side encryption is enabled ([6924cc0](6924cc0))
* **extraction:** guard on local storage, and propagate rar failures ([df4d49b](df4d49b))
…orage

"Extraction is only supported on local storage" was shown for every archive on
object storage (S3, Swift, ...) and whenever server-side encryption was enabled.
The guard added in df4d49b was correct about the symptom but refused the request
instead of fixing it.

The cause is that the extraction unpacks the archive next to the original file
and then relies on Nextcloud seeing the result in the data directory. That only
holds on real local storage, because getLocalFile() then returns a path inside
the data directory. On object storage, or with the encryption storage wrapper,
getLocalFile() returns a temporary copy instead (Encryption::getLocalFile()
falls through to LocalTempFileTrait::getCachedFile(), and Common::isLocal()
documents that "the common implementation returns a temporary file by default").
The destination then resolves to something like /tmp and nothing is published.

Keep the local fast path, and add the import step the old code only documented:
when the destination storage is not local, unpack into a request-owned
temporary directory (ITempManager) and recreate the tree through the Nextcloud
files API. Creating each folder and writing each file with Folder::newFile()
produces the files-cache entries and write hooks as part of the copy, so the
result is published without a storage scan. The temporary directory is removed
after the request, and a failure while publishing is reported as a normal
extraction failure instead of a success the user cannot see.

While extracting the forbidden-name cleanup into its own method, fix the walk
that visited `.` and `..`: the filename validator rejects those, so unlink() was
called on a directory for every folder in the archive.

Co-authored-by: openhands <openhands@all-hands.dev>
## [3.1.5](v3.1.4...v3.1.5) (2026-10-30)

### Bug Fixes

* **extraction:** import the result on object storage and encrypted storage ([4048efb](4048efb))
fix(l10n): Update translations from Transifex
## [3.1.6](v3.1.5...v3.1.6) (2026-10-31)

### Bug Fixes

* **l10n:** Update translations from Transifex ([f92d702](f92d702))
Add repository instructions that every change goes through a pull request and
that nothing may be pushed directly to main. A direct push to main triggers the
automated Release workflow, which publishes a release with no review step.

Co-authored-by: openhands <openhands@all-hands.dev>
The reuse-compliance-check job failed because AGENTS.md carried no copyright or
licence information. Add the standard SPDX comment block used by the other
Markdown files.

Also act on the review feedback:

- Qualify the release warning. release.config.cjs marks maintenance commits
  (chore, docs, ci, refactor, style, test, build, revert) as no-release and the
  workflow is skipped when the head commit contains `skip release`, so not every
  direct push publishes a release. The rule stands because such a push still
  lands on main without review.
- Document the `zlib` requirement: WrappedTarballExtractionTest builds its gzip
  fixtures with Phar::GZ, which needs zlib.
- Say "PHP 8.1 through 8.x" to match the `^8.1` constraint in composer.json.
- Note the REUSE requirement so a new file is not left without headers again.

Co-authored-by: openhands <openhands@all-hands.dev>
docs: record the pull-request-only workflow in AGENTS.md
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 31, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ⚠️ Failed 2026-10-31T04:58:51.021910Z
We couldn’t complete this review. Comment @codex review to try again.
0a7eb3c PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

dependabot Bot and others added 6 commits October 31, 2026 14:25
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.16.1 to 1.16.2.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.1...v1.16.2)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
…directs-1.16.2

chore(deps): Bump follow-redirects from 1.16.1 to 1.16.2
Bumps [fsfe/reuse-action](https://github.com/fsfe/reuse-action) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/fsfe/reuse-action/releases)
- [Commits](fsfe/reuse-action@bb774aa...676e2d5)

---
updated-dependencies:
- dependency-name: fsfe/reuse-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [skjnldsv/read-package-engines-version-actions](https://github.com/skjnldsv/read-package-engines-version-actions) from 3 to 4.
- [Release notes](https://github.com/skjnldsv/read-package-engines-version-actions/releases)
- [Commits](skjnldsv/read-package-engines-version-actions@v3...06d6db4)

---
updated-dependencies:
- dependency-name: skjnldsv/read-package-engines-version-actions
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [fsfe/reuse-action](https://github.com/fsfe/reuse-action) from 5.0.0 to 6.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/fsfe/reuse-action/releases">fsfe/reuse-action's releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<ul>
<li>Bump to v6 #(43)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/fsfe/reuse-action/commit/676e2d560c9a403aa252096d99fcab3e1132b0f5"><code>676e2d5</code></a> Bump to reuse v6</li>
<li>See full diff in <a href="https://github.com/fsfe/reuse-action/compare/bb774aa972c2a89ff34781233d275075cbddf542...676e2d560c9a403aa252096d99fcab3e1132b0f5">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fsfe/reuse-action&package-manager=github_actions&previous-version=5.0.0&new-version=6.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Updates the `fsfe/reuse-action` GitHub Action from v5.0.0 to v6.0.0 in the REUSE compliance check workflow.

- This is a major version bump, so the REUSE compliance check may behave differently.

<sup>Written for commit e76321c. Summary will update on new commits.</sup>

<a href="https://cubic.dev/pr/ashcoft/extract/pull/64?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
…3 to 4 (#65)

Bumps [skjnldsv/read-package-engines-version-actions](https://github.com/skjnldsv/read-package-engines-version-actions) from 3 to 4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/skjnldsv/read-package-engines-version-actions/releases">skjnldsv/read-package-engines-version-actions's releases</a>.</em></p>
<blockquote>
<h2>v4</h2>
<blockquote>
<p>[!WARNING]
The action now runs on Node.js 24 (<code>using: node24</code>). Self-hosted runners and GHES instances need a runner version that supports node24. Stay on <code>@V3</code> until yours does.</p>
</blockquote>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): bump skjnldsv/read-package-engines-version-actions from 2.2 to 3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/167">skjnldsv/read-package-engines-version-actions#167</a></li>
<li>chore(deps): bump actions/checkout from 4.1.1 to 4.1.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/171">skjnldsv/read-package-engines-version-actions#171</a></li>
<li>chore(deps): bump actions/setup-node from 4.0.1 to 4.0.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/157">skjnldsv/read-package-engines-version-actions#157</a></li>
<li>chore(deps): bump actions/checkout from 4.1.4 to 6.0.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/173">skjnldsv/read-package-engines-version-actions#173</a></li>
<li>chore(deps): bump actions/setup-node from 4.0.2 to 6.4.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/174">skjnldsv/read-package-engines-version-actions#174</a></li>
<li>chore(deps): upgrade dependencies by <a href="https://github.com/skjnldsv"><code>@​skjnldsv</code></a> in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/175">skjnldsv/read-package-engines-version-actions#175</a></li>
<li>feat: Use node24 instead of node20 and update all dependencies by <a href="https://github.com/DerDreschner"><code>@​DerDreschner</code></a> in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/177">skjnldsv/read-package-engines-version-actions#177</a></li>
<li>chore: drop redundant lint deps and config leftovers by <a href="https://github.com/skjnldsv"><code>@​skjnldsv</code></a> in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/191">skjnldsv/read-package-engines-version-actions#191</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/DerDreschner"><code>@​DerDreschner</code></a> made their first contribution in <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/pull/177">skjnldsv/read-package-engines-version-actions#177</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/skjnldsv/read-package-engines-version-actions/compare/v3...v4">https://github.com/skjnldsv/read-package-engines-version-actions/compare/v3...v4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/06d6db44aa62f4609ba070f556ec24bc99fb85cb"><code>06d6db4</code></a> Merge pull request <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/issues/191">#191</a> from skjnldsv/fix/tooling-cleanup</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/4d0086a7b228ae8b47b5c1d7cd290487229d86db"><code>4d0086a</code></a> chore: drop redundant lint deps and config leftovers</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/d88fca0900fed6f04ff177e1a512cfab5ba7e081"><code>d88fca0</code></a> Merge pull request <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/issues/177">#177</a> from DerDreschner/main</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/27886ba2b720a619a91cbdd5a8a7df0e88fc72c3"><code>27886ba</code></a> feat: Use node24 instead of node20 and update all dependencies</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/4d14dc255cc4ac6d7237ad1f6af2614b4428e6fe"><code>4d14dc2</code></a> Merge pull request <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/issues/175">#175</a> from skjnldsv/chore/upgrade-dependencies</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/49e6823ac5843b6802b92cf84aafcd433ee0eae6"><code>49e6823</code></a> chore(deps): rebuild dist</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/7f8080ff914739be0995f3ccfa12f750b86ec056"><code>7f8080f</code></a> chore(deps): upgrade dependencies</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/2ea8df84fda064309193ec5fbf377730b39e5110"><code>2ea8df8</code></a> chore: open-pull-requests-limit for Dependabot</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/c660a39caae4cfb30c40c319ebd4da5e106f3af0"><code>c660a39</code></a> Merge pull request <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/issues/174">#174</a> from skjnldsv/dependabot/github_actions/actions/setup...</li>
<li><a href="https://github.com/skjnldsv/read-package-engines-version-actions/commit/b0cb62702175d0eb88b94681e729ab1e73345040"><code>b0cb627</code></a> Merge pull request <a href="https://redirect.github.com/skjnldsv/read-package-engines-version-actions/issues/173">#173</a> from skjnldsv/dependabot/github_actions/actions/check...</li>
<li>Additional commits viewable in <a href="https://github.com/skjnldsv/read-package-engines-version-actions/compare/v3...06d6db44aa62f4609ba070f556ec24bc99fb85cb">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=skjnldsv/read-package-engines-version-actions&package-manager=github_actions&previous-version=3&new-version=4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Updates `skjnldsv/read-package-engines-version-actions` from v3 to v4 in four GitHub Actions workflows. v4 now runs on Node.js 24, so self-hosted runners or GHES instances must support node24; stay on v3 until they do.

<sup>Written for commit f3aadfb. Summary will update on new commits.</sup>

<a href="https://cubic.dev/pr/ashcoft/extract/pull/65?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants