Skip to content

Chore(deps): Bump dorny/paths-filter from 3.0.2 to 4.0.1#552

Merged
ModeSevenIndustrialSolutions merged 1 commit intomainfrom
dependabot/github_actions/dorny/paths-filter-4.0.1
Mar 20, 2026
Merged

Chore(deps): Bump dorny/paths-filter from 3.0.2 to 4.0.1#552
ModeSevenIndustrialSolutions merged 1 commit intomainfrom
dependabot/github_actions/dorny/paths-filter-4.0.1

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 16, 2026

Bumps dorny/paths-filter from 3.0.2 to 4.0.1.

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.0

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3.0.3...v4.0.0

v3.0.3

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3...v3.0.3

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.0

v3.0.3

v3.0.2

v3.0.1

v3.0.0

v2.11.1

v2.11.0

v2.10.2

v2.10.1

v2.10.0

v2.9.3

v2.9.2

v2.9.1

v2.9.0

... (truncated)

Commits
  • fbd0ab8 feat: add merge_group event support
  • efb1da7 feat: add dist/ freshness check to PR workflow
  • d8f7b06 Merge pull request #302 from dorny/issue-299
  • addbc14 Update README for v4
  • 9d7afb8 Update CHANGELOG for v4.0.0
  • 782470c Merge branch 'releases/v3'
  • d1c1ffe Update CHANGELOG for v3.0.3
  • ce10459 Merge pull request #294 from saschabratton/master
  • 5f40380 feat: update action runtime to node24
  • 668c092 Merge pull request #279 from wardpeet/patch-1
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Chore(deps): Bump dorny/paths-filter from 3.0.2 to 4.0.1
2b95a36 
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.2 to 4.0.1.
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](dorny/paths-filter@de90cc6...fbd0ab8)

---
updated-dependencies:
- dependency-name: dorny/paths-filter
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 16, 2026
@ModeSevenIndustrialSolutions
Copy link
Contributor

ModeSevenIndustrialSolutions commented Mar 20, 2026

PR #552 Evaluation: Bump dorny/paths-filter from 3.0.2 to 4.0.1

Summary: ✅ Safe to merge

This is a straightforward, low-risk dependency bump. The PR changes a single line in one file — the pinned SHA for dorny/paths-filter.

What the diff does

The only change is in .github/workflows/compose-packer-verify.yaml at line 85:

- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+ uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1

Release notes between v3.0.2 → v4.0.1

Three releases span this bump:

Version Changes
v3.0.3 Bugfix: Add missing predicate-quantifier support (was documented but not wired up)
v4.0.0 Breaking (runtime only): Update action runtime from Node 20 → Node 24
v4.0.1 Feature: Add merge_group event support

API / Syntax compatibility check

I compared the action.yml for v4.0.1 against the inputs used in your workflow. Here's what the workflow uses:

Input used in workflow Still supported in v4? Notes
base: ${{ inputs.GERRIT_BRANCH }} ✅ Yes Unchanged — same description, same behavior
ref: ${{ inputs.GERRIT_PATCHSET_REVISION }} ✅ Yes Unchanged
filters: (inline YAML) ✅ Yes Unchanged — still required: true

And the outputs:

Output used in workflow Still supported in v4? Notes
steps.changes.outputs.src == 'true' ✅ Yes Boolean filter outputs still work identically
changes (JSON array output) ✅ Yes Still documented in action.yml outputs

No inputs were added, removed, renamed, or had their defaults changed between v3 and v4. The full set of inputs (token, working-directory, ref, base, filters, list-files, initial-fetch-depth, predicate-quantifier) is identical.

What actually changed under the hood

  1. Node 24 runtime (v4.0.0): The action.yml now specifies using: 'node24' instead of node20. This is an internal GitHub Actions runner change — it requires no workflow syntax changes. GitHub runners already support Node 24. This is why it's a major version bump (v3 → v4).

  2. Merge queue support (v4.0.1): Adds support for merge_group events, with base and ref defaulting to event commit hashes. This is additive and doesn't affect your workflow, which is triggered by workflow_call.

  3. Predicate-quantifier bugfix (v3.0.3): Fixed a bug where predicate-quantifier wasn't properly wired up. Your workflow doesn't use this parameter (it relies on the default 'some'), so this is a no-op for you.

Risk assessment

  • Breaking changes to your usage: None. The only breaking change in the entire v3→v4 jump is the Node runtime version, which is transparent to workflow consumers.
  • Input/output contract: Fully backward compatible — identical parameter names, types, defaults, and output format.
  • SHA pinning: ✅ The commit SHA fbd0ab8f3e69293af611ebaee6363fc25e6d187d correctly corresponds to the v4.0.1 tag.

Recommendation

Approve and merge. No workflow syntax changes are needed. The bump is purely a runtime upgrade (Node 20 → 24) plus a bugfix and an additive feature. Your specific usage of base, ref, filters, and the src boolean output is fully compatible.

@ModeSevenIndustrialSolutions ModeSevenIndustrialSolutions merged commit aed2d06 into main Mar 20, 2026
10 checks passed
@ModeSevenIndustrialSolutions ModeSevenIndustrialSolutions deleted the dependabot/github_actions/dorny/paths-filter-4.0.1 branch March 20, 2026 12:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ModeSevenIndustrialSolutions ModeSevenIndustrialSolutions ModeSevenIndustrialSolutions approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ModeSevenIndustrialSolutions