Conversation
Bumps [Jimver/cuda-toolkit](https://github.com/jimver/cuda-toolkit) from 0.2.35 to 0.2.36. - [Release notes](https://github.com/jimver/cuda-toolkit/releases) - [Commits](Jimver/cuda-toolkit@3d45d15...b8bf9c6) --- updated-dependencies: - dependency-name: Jimver/cuda-toolkit dependency-version: 0.2.36 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
potiuk
left a comment
potiuk
left a comment
There was a problem hiding this comment.
Reviewed. node24 action, v0.2.35 -> v0.2.36. Two red checks, neither introduced by this PR.
verify fails on 1 unverified binary download: src/downloader.ts line 69, await tc.downloadTool(url.toString(), destFilePath) with no checksum or signature check in the file. The already-approved v0.2.35 (3d45d157) has the identical call in the same file, so this is a standing property of the action rather than a regression from 0.2.35 to 0.2.36. Holding the bump would keep us on an older version carrying exactly the same exposure.
Everything else in verify passes: lock file present, no in-tree binaries, compiled JS matches the rebuild.
check_action_tags is a repo-level failure unrelated to this PR. dtolnay/rust-toolchain was annotated tag: stable, a rolling branch that upstream force-pushes, so the pinned SHA stopped being an ancestor of it and the check hard-failed on every open PR. Fixed in #1163.
The download verification is worth pursuing with upstream on its own track; it is not a reason to block this bump.
Approving.
Drafted-by: Claude Opus 5 (1M context) via Claude Code; reviewed by @potiuk before posting
1 participant
Bumps Jimver/cuda-toolkit from 0.2.35 to 0.2.36.
Release notes
Sourced from Jimver/cuda-toolkit's releases.
Commits
b8bf9c6Add update cuda versions skill0ca15bbPrepare 0.2.36 release0024970Update dist38bc2a5Update CUDA URL maps for 2026 patch releases: 13.3.1, 13.3.0, 13.2.2, 13.2.1,...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)