Merge 8c5626a6bb into 3d3c42e5aa

prep v7.0.1 release (#2531 )
* prep v7.0.1 release * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-07-17 18:46:20 +00:00 · 2026-07-17 14:45:11 -04:00 · 2026-07-17 13:44:40 -04:00 · 2026-07-13 14:00:12 +00:00
5 changed files with 30 additions and 15 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,5 +1,18 @@
 # Changelog

+## v7.0.1
+* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475
+* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477
+* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478
+* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479
+* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488
+* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476
+* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474
+* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499
+* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
+* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
+* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
+
 ## v7.0.0
 * Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454
 * Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458
--- a/dist/index.js
+++ b/dist/index.js
@ -35913,7 +35913,7 @@ class GitCommandManager {
        else {
            args.push(globalConfig ? '--global' : '--local');
        }
-        args.push('--unset', configKey, configValue);
+        args.push('--unset', configKey, regexp_helper_escape(configValue));
        const output = await this.execGit(args, true);
        return output.exitCode === 0;
    }
--- a/package-lock.json
+++ b/package-lock.json
@ -1,12 +1,12 @@
 {
  "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "checkout",
-      "version": "7.0.0",
+      "version": "7.0.1",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^3.0.1",
@ -17,7 +17,7 @@
      },
      "devDependencies": {
        "@types/jest": "^29.5.12",
-        "@types/node": "^24.1.0",
+        "@types/node": "^26.1.1",
        "@typescript-eslint/eslint-plugin": "^8.54.0",
        "@typescript-eslint/parser": "^8.54.0",
        "@vercel/ncc": "^0.44.0",
@ -1661,12 +1661,13 @@
      "license": "MIT"
    },
    "node_modules/@types/node": {
-      "version": "24.1.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.1.0.tgz",
-      "integrity": "sha512-ut5FthK5moxFKH2T1CUOC6ctR67rQRvvHdFLCD2Ql6KXmMuCrjsSsRI9UsLCm9M18BMwClv4pn327UvB7eeO1w==",
+      "version": "26.1.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
+      "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
      "dev": true,
+      "license": "MIT",
      "dependencies": {
-        "undici-types": "~7.8.0"
+        "undici-types": "~8.3.0"
      }
    },
    "node_modules/@types/stack-utils": {
@ -7823,10 +7824,11 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.8.0.tgz",
-      "integrity": "sha512-9UJ2xGDvQ43tYyVMpuHlsgApydB8ZKfVYTsLDhXkFL/6gfkp+U8xTGdh8pMJv1SpZna0zxG1DwsKZsreLbXBxw==",
-      "dev": true
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "dev": true,
+      "license": "MIT"
    },
    "node_modules/universal-user-agent": {
      "version": "7.0.3",
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
  "description": "checkout action",
  "type": "module",
  "main": "lib/main.js",
@ -40,7 +40,7 @@
  },
  "devDependencies": {
    "@types/jest": "^29.5.12",
-    "@types/node": "^24.1.0",
+    "@types/node": "^26.1.1",
    "@typescript-eslint/eslint-plugin": "^8.54.0",
    "@typescript-eslint/parser": "^8.54.0",
    "@vercel/ncc": "^0.44.0",
--- a/src/git-command-manager.ts
+++ b/src/git-command-manager.ts
@ -510,7 +510,7 @@ class GitCommandManager {
    } else {
      args.push(globalConfig ? '--global' : '--local')
    }
-    args.push('--unset', configKey, configValue)
+    args.push('--unset', configKey, regexpHelper.escape(configValue))

    const output = await this.execGit(args, true)
    return output.exitCode === 0
Author	SHA1	Message	Date
dependabot[bot]	ab15c524ae	Merge `8c5626a6bb` into `3d3c42e5aa`	2026-07-17 18:46:20 +00:00
Aiqiao Yan	3d3c42e5aa	prep v7.0.1 release (#2531 ) * prep v7.0.1 release * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-17 14:45:11 -04:00
Aiqiao Yan	28802689a1	escape values passed to --unset (#2530 )	2026-07-17 13:44:40 -04:00
dependabot[bot]	8c5626a6bb	Bump @types/node from 24.1.0 to 26.1.1 --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-13 14:00:12 +00:00