From 385380dd4139b6ba27719c4f7efbe7178e6cc1df Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 30 Oct 2026 02:18:23 +0000 Subject: [PATCH] build(deps): Bump the actions group across 1 directory with 6 updates Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `8.3.0` | `8.4.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` | | [hyperpolymath/smtp-notify-action](https://github.com/hyperpolymath/smtp-notify-action) | `0.5.0` | `0.5.1` | Updates `SonarSource/sonarqube-scan-action` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/v8.3.0...v8.4.0) Updates `github/codeql-action/init` from 4.38.2 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.38.2 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `hyperpolymath/smtp-notify-action` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/hyperpolymath/smtp-notify-action/releases) - [Changelog](https://github.com/hyperpolymath/smtp-notify-action/blob/main/CHANGELOG.adoc) - [Commits](https://github.com/hyperpolymath/smtp-notify-action/compare/v0.5.0...v0.5.1) --- updated-dependencies: - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: hyperpolymath/smtp-notify-action dependency-version: 0.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/actions.lock | 36 ++++++++++++------------- .github/workflows/build.yml | 2 +- .github/workflows/codeql.yml | 4 +-- .github/workflows/hypatia-scan.yml | 4 +-- .github/workflows/push-email-notify.yml | 2 +- 5 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 3caf71d..daf6f9b 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -1,18 +1,18 @@ # This file is machine-generated by `gh actions-lock`. # Do not edit by hand; run `gh actions-lock` to update. # Docs: https://gh.io/actions-lockfile -version: 'v0.0.2' +version: 'v0.0.3' workflows: '.github/workflows/build.yml': - 'actions/checkout@v7.0.1' - - 'sonarsource/sonarqube-scan-action@v8.3.0' + - 'sonarsource/sonarqube-scan-action@v8.4.0' '.github/workflows/cartridge-schema.yml': - 'actions/checkout@v7.0.1' - 'erlef/setup-beam@v1.24.1' - 'oven-sh/setup-bun@v2.2.0' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2' + - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370' '.github/workflows/foundry.yml': - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': @@ -20,9 +20,9 @@ workflows: '.github/workflows/hypatia-scan.yml': - 'actions/checkout@v7.0.1' - 'actions/github-script@v9.0.0' - - 'actions/upload-artifact@v7.0.1' + - 'actions/upload-artifact@v7.0.2' - 'erlef/setup-beam@v1.24.1' - - 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2' + - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370' '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] '.github/workflows/lock-sync-gate.yml': [] @@ -38,7 +38,7 @@ workflows: - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' '.github/workflows/push-email-notify.yml': - - 'hyperpolymath/smtp-notify-action@v0.3.0' + - 'hyperpolymath/smtp-notify-action@v0.5.1' '.github/workflows/scorecard.yml': - 'hyperpolymath/standards@84355587cb2a1f86e6882de83514a32db2646e7a' '.github/workflows/secret-scanner.yml': @@ -87,9 +87,9 @@ dependencies: commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' owner_id: 44036562 repo_id: 192625955 - 'actions/upload-artifact@v7.0.1': - ref: 'v7.0.1' - commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 'actions/upload-pages-artifact@v5.0.0': @@ -119,9 +119,9 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2': - ref: 'v4.38.2' - commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2' + 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370': + ref: 'v4.39.1' + commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370' owner_id: 9919 repo_id: 259445878 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28': @@ -129,9 +129,9 @@ dependencies: commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' owner_id: 9919 repo_id: 259445878 - 'hyperpolymath/smtp-notify-action@v0.3.0': - ref: 'v0.3.0' - commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be' + 'hyperpolymath/smtp-notify-action@v0.5.1': + ref: 'v0.5.1' + commit: 'sha1-e384daf6167a7a7567642d6a62060106244d2413' owner_id: 6759885 repo_id: 1352485172 'hyperpolymath/standards@84355587cb2a1f86e6882de83514a32db2646e7a': @@ -171,9 +171,9 @@ dependencies: commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' owner_id: 108928776 repo_id: 512644635 - 'sonarsource/sonarqube-scan-action@v8.3.0': - ref: 'v8.3.0' - commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9' + 'sonarsource/sonarqube-scan-action@v8.4.0': + ref: 'v8.4.0' + commit: 'sha1-4d1dc0c91ee400dcf8a6dddf2f705ac36542e304' owner_id: 545988 repo_id: 366408409 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 72aa457..3bd2cd0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -46,6 +46,6 @@ jobs: with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: SonarQube Scan - uses: SonarSource/sonarqube-scan-action@v8.3.0 + uses: SonarSource/sonarqube-scan-action@v8.4.0 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8407632..97c36f8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -44,11 +44,11 @@ jobs: - name: Checkout uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 7e0adb4..92f10a6 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -101,7 +101,7 @@ jobs: echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - name: Upload findings artifact - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@v7.0.2 with: name: hypatia-findings path: hypatia-findings.json @@ -235,7 +235,7 @@ jobs: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork != true) - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: sarif_file: hypatia.sarif # Distinct category so Hypatia results coexist with CodeQL's diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index a4c1ebc..e0f1d22 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -41,7 +41,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: hyperpolymath/smtp-notify-action@v0.5.0 # NOSONAR — pin authority is actions.lock (sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7) + uses: hyperpolymath/smtp-notify-action@v0.5.1 # NOSONAR — pin authority is actions.lock (sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7) with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }}