v2 release marked as latest

[ennru]

Just wondering as it first tricked me, why is v2.5.0 marked as the latest release when there is v3.1.0?

https://github.com/actions/checkout/releases

[neilmayhew]

I found this confusing too. I changed my workflow to comply with the GitHub advisory from September 22 and was still getting warnings about the use of Node.js 12. I eventually discovered that the "latest" version of this action (v2.5.0) is still using 12 and there's no information about whether the v3 series is recommended for production use. This makes it look like GitHub isn't following its own advice!

I assume that the v2.5.0 tag was made more recently than the v3.1.0 tag and this causes it to be shown as "latest".

[jku]

I suppose this was clear already but just saying it out loud: Dependabot does not upgrade users who are pinning hashes from v2.5.0 to v3.x.y. I'm not sure if it should (since that's not documented anywhere) but it seems related.

The same issue has been filed before as well: see #831 for an example from June.

[jku]

I suppose this was clear already but just saying it out loud: Dependabot does not upgrade users who are pinning hashes from v2.5.0 to v3.x.y. I'm not sure if it should (since that's not documented anywhere) but it seems related.

Sometime last week dependabot started upgrading actions/checkout to 3.x.y in my projects 🤷 so this was maybe an unrelated dependabot bug fixed in the latest dependabot release?

I'm surprised about the lack of maintainer comments or actions on issues like this. Maybe there is no actions/checkout issue here, but not seeing any communication for 22 days -- even closing the issue as not-a-bug -- is a little worrying.

[neilmayhew]

not seeing any communication for 22 days … is a little worrying.

I agree, especially since this is a very core action — I assume every workflow on GitHub is using it — and since this relates to a security advisory.

I see that there are 291 open issues. That's not a good sign either.

[dgokcin]

I am having the same issue as @jku. Any updates here?

[cory-miller]

Closing since this is outdated. v4.1.0 is now marked as latest