From 31a7da00f183a99a197a4c5530d15e4e47d22640 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 00:38:59 +0000 Subject: [PATCH] ci(deps): bump the actions-minor-and-patch group across 1 directory with 6 updates Bumps the actions-minor-and-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.1` | `4.38.3` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) | `0.24.2` | `0.24.3` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.3` | `7.3.0` | Updates `github/codeql-action/upload-sarif` from 4.38.1 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `anchore/sbom-action/download-syft` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) Updates `goreleaser/goreleaser-action` from 7.2.3 to 7.3.0 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](https://github.com/goreleaser/goreleaser-action/compare/f06c13b6b1a9625abc9e6e439d9c05a8f2190e94...a4f02ab5355a589de60d917a659ce617ed19b3de) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-and-patch - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-and-patch - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-and-patch - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-and-patch - dependency-name: anchore/sbom-action/download-syft dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-and-patch - dependency-name: goreleaser/goreleaser-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-and-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/bun-scanner.yml | 2 +- .github/workflows/demo.yml | 4 ++-- .github/workflows/npm-publish.yml | 2 +- .github/workflows/pnpm-hook.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/selftest.yml | 2 +- action.yml | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/bun-scanner.yml b/.github/workflows/bun-scanner.yml index 8357c91..4753c47 100644 --- a/.github/workflows/bun-scanner.yml +++ b/.github/workflows/bun-scanner.yml @@ -57,7 +57,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" - name: Test the production staging decision and summary with a stub registry diff --git a/.github/workflows/demo.yml b/.github/workflows/demo.yml index 9dfc03f..6ff3b54 100644 --- a/.github/workflows/demo.yml +++ b/.github/workflows/demo.yml @@ -153,7 +153,7 @@ jobs: ls -l docs/demo.gif - name: Upload the recording as an artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: demo path: docs/demo.gif @@ -173,7 +173,7 @@ jobs: with: persist-credentials: true - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: demo path: docs diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index de6f229..9311096 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -108,7 +108,7 @@ jobs: # The same release the bun-scanner test workflow pins. bun-version: "1.4.2" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: # npm 12 asks for ^24.15.0 on the 24 line; setup-node resolves the # newest 24.x, which has been past that since 2026. diff --git a/.github/workflows/pnpm-hook.yml b/.github/workflows/pnpm-hook.yml index 68076af..adcf5cf 100644 --- a/.github/workflows/pnpm-hook.yml +++ b/.github/workflows/pnpm-hook.yml @@ -37,7 +37,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" - name: Install the pinned pnpm test runner outside the integration diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3b6128c..b4a8a01 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -88,7 +88,7 @@ jobs: cosign-release: v3.1.3 - name: Install syft - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: # Newest syft release on 2026-09-09. The action adds it to PATH. syft-version: v1.51.1 @@ -98,7 +98,7 @@ jobs: run: echo "epoch=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT" - name: Build, sign and publish with goreleaser - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: distribution: goreleaser version: v2.18.1 diff --git a/.github/workflows/selftest.yml b/.github/workflows/selftest.yml index 3f4a3b0..bb04b35 100644 --- a/.github/workflows/selftest.yml +++ b/.github/workflows/selftest.yml @@ -129,7 +129,7 @@ jobs: steps.sarif.outputs.found == 'true' && (github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository) - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: trustdiff.sarif # Keeps trustdiff's findings apart from other analyses of the same commit. diff --git a/action.yml b/action.yml index 3c972c8..2e5c77f 100644 --- a/action.yml +++ b/action.yml @@ -444,7 +444,7 @@ runs: steps.run.outputs.report != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: ${{ steps.run.outputs.report }} # Keeps trustdiff's findings apart from other analyses of the same commit.