This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action | major | `v4.2.2` → `v6.1.0` |
---
### Release Notes
<details>
<summary>actions/checkout (actions/checkout)</summary>
### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0)
[Compare Source](https://github.com/actions/checkout/compare/v6.0.3...v6.1.0)
##### What's Changed
- **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2500](https://github.com/actions/checkout/pull/2500)
- backport fixes to releases-v6 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2527](https://github.com/actions/checkout/pull/2527)
<https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change
**Full Changelog**: <https://github.com/actions/checkout/compare/v6.0.3...v6.1.0>
### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)
[Compare Source](https://github.com/actions/checkout/compare/v6.0.2...v6.0.3)
- Fix checkout init for SHA-256 repositories by [@​yaananth](https://github.com/yaananth) in [#​2439](https://github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@​yaananth](https://github.com/yaananth) in [#​2414](https://github.com/actions/checkout/pull/2414)
### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602)
[Compare Source](https://github.com/actions/checkout/compare/v6.0.1...v6.0.2)
- Fix tag handling: preserve annotations and explicit fetch-tags by [@​ericsciple](https://github.com/ericsciple) in [#​2356](https://github.com/actions/checkout/pull/2356)
### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601)
[Compare Source](https://github.com/actions/checkout/compare/v6...v6.0.1)
- Add worktree support for persist-credentials includeIf by [@​ericsciple](https://github.com/ericsciple) in [#​2327](https://github.com/actions/checkout/pull/2327)
### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600)
[Compare Source](https://github.com/actions/checkout/compare/v6...v6)
- Persist creds to a separate file by [@​ericsciple](https://github.com/ericsciple) in [#​2286](https://github.com/actions/checkout/pull/2286)
- Update README to include Node.js 24 support details and requirements by [@​salmanmkc](https://github.com/salmanmkc) in [#​2248](https://github.com/actions/checkout/pull/2248)
### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)
[Compare Source](https://github.com/actions/checkout/compare/v5.1.0...v6)
- Fix checkout init for SHA-256 repositories by [@​yaananth](https://github.com/yaananth) in [#​2439](https://github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@​yaananth](https://github.com/yaananth) in [#​2414](https://github.com/actions/checkout/pull/2414)
### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0)
[Compare Source](https://github.com/actions/checkout/compare/v5.0.1...v5.1.0)
##### What's Changed
- **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2501](https://github.com/actions/checkout/pull/2501)
- backport fixes to releases-v5 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2523](https://github.com/actions/checkout/pull/2523)
<https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change
**Full Changelog**: <https://github.com/actions/checkout/compare/v5.0.1...v5.1.0>
### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501)
[Compare Source](https://github.com/actions/checkout/compare/v5...v5.0.1)
- Port v6 cleanup to v5 by [@​ericsciple](https://github.com/ericsciple) in [#​2301](https://github.com/actions/checkout/pull/2301)
### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500)
[Compare Source](https://github.com/actions/checkout/compare/v5...v5)
- Update actions checkout to use node 24 by [@​salmanmkc](https://github.com/salmanmkc) in [#​2226](https://github.com/actions/checkout/pull/2226)
### [`v5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501)
[Compare Source](https://github.com/actions/checkout/compare/v4.4.0...v5)
- Port v6 cleanup to v5 by [@​ericsciple](https://github.com/ericsciple) in [#​2301](https://github.com/actions/checkout/pull/2301)
### [`v4.4.0`](https://github.com/actions/checkout/releases/tag/v4.4.0)
[Compare Source](https://github.com/actions/checkout/compare/v4.3.1...v4.4.0)
##### What's Changed
- **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v4 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2502](https://github.com/actions/checkout/pull/2502)
- backport fixes to releases-v4 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2524](https://github.com/actions/checkout/pull/2524)
<https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change
**Full Changelog**: <https://github.com/actions/checkout/compare/v4.3.1...v4.4.0>
### [`v4.3.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v431)
[Compare Source](https://github.com/actions/checkout/compare/v4.3.0...v4.3.1)
- Port v6 cleanup to v4 by [@​ericsciple](https://github.com/ericsciple) in [#​2305](https://github.com/actions/checkout/pull/2305)
### [`v4.3.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v430)
[Compare Source](https://github.com/actions/checkout/compare/v4.2.2...v4.3.0)
- docs: update README.md by [@​motss](https://github.com/motss) in [#​1971](https://github.com/actions/checkout/pull/1971)
- Add internal repos for checking out multiple repositories by [@​mouismail](https://github.com/mouismail) in [#​1977](https://github.com/actions/checkout/pull/1977)
- Documentation update - add recommended permissions to Readme by [@​benwells](https://github.com/benwells) in [#​2043](https://github.com/actions/checkout/pull/2043)
- Adjust positioning of user email note and permissions heading by [@​joshmgross](https://github.com/joshmgross) in [#​2044](https://github.com/actions/checkout/pull/2044)
- Update README.md by [@​nebuk89](https://github.com/nebuk89) in [#​2194](https://github.com/actions/checkout/pull/2194)
- Update CODEOWNERS for actions by [@​TingluoHuang](https://github.com/TingluoHuang) in [#​2224](https://github.com/actions/checkout/pull/2224)
- Update package dependencies by [@​salmanmkc](https://github.com/salmanmkc) in [#​2236](https://github.com/actions/checkout/pull/2236)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zNy4xIiwidXBkYXRlZEluVmVyIjoiNDQuMzcuMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJyZW5vdmF0ZS9hdXRvbWVyZ2UiLCJyZW5vdmF0ZS9naXRodWItYWN0aW9uIl19-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v4.2.2→v6.1.0Release Notes
actions/checkout (actions/checkout)
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v6.1.0
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v5 by @aiqiaoy in #2501https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: https://github.com/actions/checkout/compare/v5.0.1...v5.1.0
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
v4.4.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v4 by @aiqiaoy in #2502https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: https://github.com/actions/checkout/compare/v4.3.1...v4.4.0
v4.3.1Compare Source
v4.3.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
ac3ac9629dto24a40a85c9