From 830baa14b259be800120bd349f064aeef9cf0977 Mon Sep 17 00:00:00 2001
From: oleibman <10341515+oleibman@users.noreply.github.com>
Date: Sun, 10 Nov 2024 10:55:42 -0800
Subject: [PATCH] Update "Contributing" Notes and One Github Action

Replace one deprecated action, and update "How to release".
---
 .github/workflows/main.yml | 2 +-
 CONTRIBUTING.md            | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4a9c4d22b..e4c0da31a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -210,7 +210,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 67aa525c6..e144a11e2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -4,6 +4,7 @@ If you would like to contribute, here are some notes and guidelines:
 
  - All new development should be on feature/fix branches, which are then merged to the `master` branch once stable and approved; so the `master` branch is always the most up-to-date, working code
  - If you are going to submit a pull request, please fork from `master`, and submit your pull request back as a fix/feature branch referencing the GitHub issue number
+  - Install (development) dependencies by running `composer install` inside your PhpSpreadsheet clone.
  - The code must work with all PHP versions that we support.
    - You can call `composer versions` to test version compatibility. 
  - Code style should be maintained.
@@ -39,7 +40,10 @@ This makes it easier to see exactly what is being tested when reviewing the PR.
     2. Tag subject must be the version number, eg: `1.2.3`
     3. Tag body must be a copy-paste of the changelog entries.
 3. Push the tag with `git push --tags`, GitHub Actions will create a GitHub release automatically, and the release details will automatically be sent to packagist.
-4. Github seems to remove markdown headings in the Release Notes, so you should edit to restore these.
+4. By default, Github remove markdown headings in the Release Notes. You can either edit to restore these, or, probably preferably, change the default comment character on your system - `git config core.commentChar ';'`.
 
-> **Note:** Tagged releases are made from the `master` branch. Only in an emergency should a tagged release be made from the `release` branch. (i.e. cherry-picked hot-fixes.)
+> **Note:** Tagged releases are made from the `master` branch. Only in an emergency should a tagged release be made from the `release` branch. (i.e. cherry-picked hot-fixes.) However, there are 3 branches which have been updated to apply security patches, and those may be tagged if future security updates are needed.
+- release1291
+- release210
+- release222