chore(deps): bump the actions group across 1 directory with 5 updates by dependabot[bot] · Pull Request #972 · hyperpolymath/hypatia

dependabot · 2026-10-27T02:27:27Z

Bumps the actions group with 5 updates in the / directory:

Package	From	To
taiki-e/install-action	`2.87.29`	`2.87.31`
hyperpolymath/smtp-notify-action	`0.5.0`	`0.5.1`
ruby/setup-ruby	`1.331.0`	`1.335.0`
docker/login-action	`4.6.0`	`4.7.0`
trufflesecurity/trufflehog	`3.99.3`	`3.99.7`

Updates taiki-e/install-action from 2.87.29 to 2.87.31

Release notes

Sourced from taiki-e/install-action's releases.

2.87.31

Downgrade cargo-sort@latest to 2.1.3.

Update vacuum@latest to 0.35.0.

Update xh@latest to 0.26.3.

Update uv@latest to 0.13.5.

Update ubi@latest to 0.13.0.

Update trivy@latest to 0.76.1.

Update tombi@latest to 1.9.0.

Update release-plz@latest to 0.3.174.

Update prek@latest to 0.5.7.

Update mise@latest to 2026.10.17.

Update jaq@latest to 3.1.2.

Update espup@latest to 0.17.1.

Update cargo-zigbuild@latest to 0.24.0.

Update cargo-nextest@latest to 0.9.149.

Update biome@latest to 2.6.2.

2.87.30

Update zizmor@latest to 1.31.1.

Update wasmtime@latest to 50.0.0.

Update vacuum@latest to 0.33.2.

Update uv@latest to 0.13.4.

Update trunk@latest to 0.22.0.

Update tombi@latest to 1.8.9.

Update syft@latest to 1.55.0.

Update release-plz@latest to 0.3.173.

Update prek@latest to 0.5.6.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.31] - 2026-10-23

Downgrade cargo-sort@latest to 2.1.3.

Update vacuum@latest to 0.35.0.

Update xh@latest to 0.26.3.

Update uv@latest to 0.13.5.

Update ubi@latest to 0.13.0.

Update trivy@latest to 0.76.1.

Update tombi@latest to 1.9.0.

Update release-plz@latest to 0.3.174.

Update prek@latest to 0.5.7.

Update mise@latest to 2026.10.17.

Update jaq@latest to 3.1.2.

Update espup@latest to 0.17.1.

Update cargo-zigbuild@latest to 0.24.0.

Update cargo-nextest@latest to 0.9.149.

Update biome@latest to 2.6.2.

[2.87.30] - 2026-10-21

Update zizmor@latest to 1.31.1.

Update wasmtime@latest to 50.0.0.

Update vacuum@latest to 0.33.2.

Update uv@latest to 0.13.4.

Update trunk@latest to 0.22.0.

Update tombi@latest to 1.8.9.

Update syft@latest to 1.55.0.

Update release-plz@latest to 0.3.173.

... (truncated)

Commits

1e29709 Release 2.87.31
30fbbdf Update cargo-sort@latest to 2.1.3
bce00a3 Update vacuum@latest to 0.35.0
dce055e Update tombi manifest
28b8d62 Update release-plz manifest
44d13e3 Update mise manifest
510b77d Update xh@latest to 0.26.3
601130d Update vacuum manifest
8e70b88 Update uv@latest to 0.13.5
9092880 Update ubi@latest to 0.13.0
Additional commits viewable in compare view

Updates hyperpolymath/smtp-notify-action from 0.5.0 to 0.5.1

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.5.1

Protocol-neutral server_address metadata

server_address is the host input for both SMTP and NNTP, and remained the only input in action.yml still described as SMTP-only ('SMTP server host name'). It now reads:
description: 'Server host name (SMTP or NNTP, per protocol: `protocol`)'
The secure and diagnose folded scalar descriptions were also rewrapped to line width (Reports → reports after the colon in diagnose), and the download URL in action.yml now points to v0.5.1.

Because workflow editors, consumers, and GitHub Marketplace read action.yml from the release tag — and tags are immutable here — this ships as v0.5.1 rather than moving v0.5.0. v0.5.0 remains supported in SECURITY.md since the binary and input surface are unchanged.

For the full NNTP posting (protocol: nntp, newsgroups) and Marketplace readiness notes introduced in the 0.5 series, see v0.5.0 and CHANGELOG.adoc.

Provenance

Zero Zig or Idris2 source files changed between v0.5.0 and v0.5.1. CI rebuilt both static musl binaries from this tag and verified they hash byte-identically to the unchanged SHA-256 pins inside action.yml before publishing. SHA256SUMS is attached:
2683da8f619dd5f310c9f6884da39e825c807c2c86a6319c19aba39b27f9c5c9  smtp-notify-x86_64-linux-musl
a58138308fb9832e1ceb551a12f1b04e591dc38ba5fd336c9acfb3f263161f29  smtp-notify-aarch64-linux-musl

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

== v0.5.1 — 2026-10-24

A metadata correction, and the release to publish the Marketplace listing from. The binary is byte-identical to v0.5.0's — the two SHA-256 pins are unchanged and re-verified by the release workflow — so v0.5.0 remains supported and correct for anyone already pinned to it. A new tag rather than an edit of the existing one because a tag is immutable here: consumers pin SHAs, and GitHub reads action.yml from the tag, which is the same property that made v0.5.0 necessary in the first place.

NOTE: The v0.5.0 heading below carries a note that the tag had to be pushed immediately after its merge. That was done, and the release published the same day; the note is left in place because it describes a property of the release process, not a pending task.

=== Fixed

server_address is no longer described as SMTP-only. The field is the host for both protocols, and the description said 'SMTP server host name' — the last input description that still read as if the news transport did not exist. It now reads 'Server host name (SMTP or NNTP, per protocol: protocol)'. Cosmetic, but workflow editors and consumers read action.yml from the release ref, which is why it ships as a new tag rather than a main-only edit.

=== Changed

The asset URL names v0.5.1. The pins do not move: the binary did not change.

The secure and diagnose input descriptions were rewrapped to the file's line width (and Reports lowercased after the colon in diagnose).

README.adoc's three pinned examples and .github/SECURITY.md's supported-versions table follow the current release.

Commits

e384daf fix(action): protocol-neutral server_address wording (needs tag v0.5.1) (#28)
See full diff in compare view

Updates ruby/setup-ruby from 1.331.0 to 1.335.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.335.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#959

Full Changelog: ruby/setup-ruby@v1.334.0...v1.335.0

v1.334.0

What's Changed

Add ruby-3.3.13,ruby-3.4.12,ruby-4.0.9 by @ruby-builder-bot in ruby/setup-ruby#956

Full Changelog: ruby/setup-ruby@v1.333.0...v1.334.0

v1.333.0

What's Changed

Add ruby-4.0.8 by @ruby-builder-bot in ruby/setup-ruby#955

Full Changelog: ruby/setup-ruby@v1.332.0...v1.333.0

v1.332.0

What's Changed

Update CRuby releases on Windows (CVE-2026-111943) by @ruby-builder-bot in ruby/setup-ruby#952

Full Changelog: ruby/setup-ruby@v1.331.0...v1.332.0

Commits

7f79781 Update CRuby releases on Windows
26e5b7d Add ruby-3.3.13,ruby-3.4.12,ruby-4.0.9
e1bd614 Add ruby-4.0.8
b1da480 Update CRuby releases on Windows
See full diff in compare view

Updates docker/login-action from 4.6.0 to 4.7.0

Release notes

Sourced from docker/login-action's releases.

v4.7.0

Preserve explicit ECR settings in registry-auth by @crazy-max in docker/login-action#1089

Use registry hosts for scoped credentials by @crazy-max in docker/login-action#1088

Raise Docker Hub OIDC max expiry to 6 hours by @crazy-max in docker/login-action#1068

Log Docker Hub OIDC token exchange progress by @crazy-max in docker/login-action#1061

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1154.0 in docker/login-action#1093

Bump @docker/actions-toolkit from 0.94.0 to 0.107.0 in docker/login-action#1100

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/login-action#1077

Bump csv-parse from 7.0.1 to 7.0.3 in docker/login-action#1078

Bump handlebars from 4.7.9 to 4.7.10 in docker/login-action#1091

Bump js-yaml from 5.2.2 to 5.5.0 in docker/login-action#1066

Bump postcss from 8.5.22 to 8.5.26 in docker/login-action#1071

Bump postcss-selector-parser from 7.1.1 to 7.1.6 in docker/login-action#1092

Bump source-map-js from 1.2.1 to 1.2.2 in docker/login-action#1090

Bump undici from 6.27.0 to 6.29.1 in docker/login-action#1085

Bump uuid from 14.0.1 to 14.0.3 in docker/login-action#1096

Full Changelog: docker/login-action@v4.6.0...v4.7.0

Commits

81c6f93 Merge pull request #1100 from docker/dependabot/npm_and_yarn/docker/actions-t...
1b16c8d Merge pull request #1096 from docker/dependabot/npm_and_yarn/uuid-14.0.3
ac86b5e [dependabot skip] chore: update generated content
1476d84 build(deps): bump @docker/actions-toolkit from 0.94.0 to 0.107.0
503cee6 Merge pull request #1095 from docker/dependabot/github_actions/actions/create...
f093535 Merge pull request #1099 from docker/dependabot/github_actions/codecov/codeco...
d5ae7f1 Merge pull request #1098 from docker/dependabot/github_actions/docker/bake-ac...
6f97507 Merge pull request #1097 from docker/dependabot/github_actions/docker/bake-ac...
006d61f Merge pull request #1094 from docker/dependabot/github_actions/codeql-actions...
93f5f52 Merge pull request #1093 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.99.3 to 3.99.7

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.7

What's Changed

Fix --include-wikis help typo and huggingface README description by @protonnegativo in trufflesecurity/trufflehog#5471

fix(detectors/anypointoauth2): stop treating HTTP 422 as verified by @jamesgol in trufflesecurity/trufflehog#5386

Add xAI analyzer by @serval-frenchie in trufflesecurity/trufflehog#5456

ci(lint): pin the semgrep container image by digest by @Portll in trufflesecurity/trufflehog#5245

feat(detectors): add Fireworks AI API key detector by @sudo-a-man in trufflesecurity/trufflehog#5447

feat(detectors): add Infisical service token detector by @Varshith-Kali in trufflesecurity/trufflehog#5445

Fix 7z and rar panics in the archive handler and log recovered panic stacks by @dustin-decker in trufflesecurity/trufflehog#5474

New Contributors

@protonnegativo made their first contribution in trufflesecurity/trufflehog#5471

@serval-frenchie made their first contribution in trufflesecurity/trufflehog#5456

@Portll made their first contribution in trufflesecurity/trufflehog#5245

@sudo-a-man made their first contribution in trufflesecurity/trufflehog#5447

@Varshith-Kali made their first contribution in trufflesecurity/trufflehog#5445

Full Changelog: trufflesecurity/trufflehog@v3.99.6...v3.99.7

v3.99.6

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

Update github-actions by @renovate[bot] in trufflesecurity/trufflehog#5414

Prefer nearest client/tenant IDs for Azure SP secrets by @kashifkhan0771 in trufflesecurity/trufflehog#5449

Clean up Filesystem source logging for per-source debug by @kashifkhan0771 in trufflesecurity/trufflehog#5465

security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) by @dustin-decker in trufflesecurity/trufflehog#5472

Keep GoReleaser temp files off the tmpfs /tmp in releases by @dustin-decker in trufflesecurity/trufflehog#5473

Full Changelog: trufflesecurity/trufflehog@v3.99.4...v3.99.6

v3.99.4

What's Changed

Add per-source debug option and hide sensitive data in debug logs by @kashifkhan0771 in trufflesecurity/trufflehog#5446

Mark results whose verification was skipped by @unsmith in trufflesecurity/trufflehog#5448

Clean up Git source logging for per-source debug by @kashifkhan0771 in trufflesecurity/trufflehog#5451

Add Lambda Cloud API key detector by @lukem-ts in trufflesecurity/trufflehog#5435

Update github.com/trufflesecurity/ldap-verify digest to 4a15faf by @renovate[bot] in trufflesecurity/trufflehog#5441

Update dependency trufflesecurity/.github to v1.0.5 by @renovate[bot] in trufflesecurity/trufflehog#5442

Update module golang.org/x/crypto to v0.56.0 [SECURITY] by @renovate[bot] in trufflesecurity/trufflehog#5462

Update module golang.org/x/net to v0.60.0 [SECURITY] by @renovate[bot] in trufflesecurity/trufflehog#5464

Update module github.com/yuin/goldmark to v1.7.17 [SECURITY] by @renovate[bot] in trufflesecurity/trufflehog#5460

github: check App installation grants before listing comments by @unsmith in trufflesecurity/trufflehog#5454

Full Changelog: trufflesecurity/trufflehog@v3.99.3...v3.99.4

Commits

31ce31e Fix 7z and rar panics in the archive handler and log recovered panic stacks (...
50bc667 feat(detectors): add Infisical service token detector (#5445)
4723140 feat(detectors): add Fireworks AI API key detector (#5447)
8276bc4 ci(lint): pin the semgrep container image by digest (#5245)
f6984be Add xAI analyzer (#5456)
282085c fix(detectors/anypointoauth2): stop treating HTTP 422 as verified (#5386)
b1bb823 Fix --include-wikis help typo and huggingface README description (#5471)
fd43a88 Keep GoReleaser temp files off the tmpfs /tmp in releases (#5473)
3bd461f security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) (#5472)
d6ea4a5 Clean up Filesystem source logging for per-source debug (#5465)
Additional commits viewable in compare view

coderabbitai · 2026-10-27T02:27:36Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 509d64db-00e1-42fd-b496-3a9bce40ec60

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-27T02:27:38Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T02:28:41.364052Z	`f4863e2`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.29` | `2.87.31` | | [hyperpolymath/smtp-notify-action](https://github.com/hyperpolymath/smtp-notify-action) | `0.5.0` | `0.5.1` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.331.0` | `1.335.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.99.3` | `3.99.7` | Updates `taiki-e/install-action` from 2.87.29 to 2.87.31 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@v2.87.29...v2.87.31) Updates `hyperpolymath/smtp-notify-action` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/hyperpolymath/smtp-notify-action/releases) - [Changelog](https://github.com/hyperpolymath/smtp-notify-action/blob/main/CHANGELOG.adoc) - [Commits](hyperpolymath/smtp-notify-action@v0.5.0...v0.5.1) Updates `ruby/setup-ruby` from 1.331.0 to 1.335.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@v1.331.0...v1.335.0) Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4.6.0...v4.7.0) Updates `trufflesecurity/trufflehog` from 3.99.3 to 3.99.7 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@v3.99.3...v3.99.7) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: hyperpolymath/smtp-notify-action dependency-version: 0.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: ruby/setup-ruby dependency-version: 1.335.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.87.31 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 27, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-74ca841d39 branch 2 times, most recently from 40d2ce3 to f687c45 Compare October 27, 2026 03:51

dependabot Bot force-pushed the dependabot/github_actions/actions-74ca841d39 branch from f687c45 to 958c414 Compare October 27, 2026 04:56

Navigation Menu

Repository navigation

chore(deps): bump the actions group across 1 directory with 5 updates - #972

chore(deps): bump the actions group across 1 directory with 5 updates#972
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-74ca841d39

dependabot Bot commented on behalf of github Oct 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 27, 2026 •

edited

Loading

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.87.31

2.87.30

[2.87.31] - 2026-10-23

[2.87.30] - 2026-10-21

v0.5.1

Protocol-neutral server_address metadata

Provenance

v1.335.0

What's Changed

v1.334.0

What's Changed

v1.333.0

What's Changed

v1.332.0

What's Changed

v4.7.0

v3.99.7

What's Changed

New Contributors

v3.99.6

What's Changed

v3.99.4

What's Changed

Uh oh!

coderabbitai Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 27, 2026 •

edited

Loading

Protocol-neutral `server_address` metadata

coderabbitai Bot commented Oct 27, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 27, 2026 •

edited

Loading