From 72ab140fc756ccb87bd93849aaa7ac9378a9afee Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 20 May 2026 13:15:12 +0000 Subject: [PATCH] build(deps): bump the github-actions group with 2 updates Bumps the github-actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [pnpm/action-setup](https://github.com/pnpm/action-setup). Updates `github/codeql-action` from 4.35.4 to 4.35.5 - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](https://github.com/github/codeql-action/compare/v4.35.4...v4.35.5) Updates `pnpm/action-setup` from 4.1.0 to 6.0.8 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/a7487c7e89a18df4991f7f222e4898a00d66ddda...0e279bb959325dab635dd2c09392533439d90093) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: pnpm/action-setup dependency-version: 6.0.8 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- .github/workflows/codeql.yml | 6 +++--- .github/workflows/och-self-scan.yml | 2 +- .github/workflows/osv.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/semgrep.yml | 2 +- .github/workflows/verify-global-install.yml | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 04469be3..48e0d2b4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -118,7 +118,7 @@ jobs: --lockfile=pnpm-lock.yaml \ --format=sarif \ --output=osv.sarif || true - - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 + - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4 if: always() with: sarif_file: osv.sarif diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fb831de8..522884c5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,11 +28,11 @@ jobs: language: [javascript-typescript, python] steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 + - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4 with: languages: ${{ matrix.language }} queries: security-and-quality - - uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 - - uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 + - uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4 + - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/och-self-scan.yml b/.github/workflows/och-self-scan.yml index b721676f..ef9cd052 100644 --- a/.github/workflows/och-self-scan.yml +++ b/.github/workflows/och-self-scan.yml @@ -81,7 +81,7 @@ jobs: - name: Upload SARIF to code scanning if: always() - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 + uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4 with: sarif_file: .codehub/scan.sarif category: opencodehub-self diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml index e2f7f493..2a5ff7af 100644 --- a/.github/workflows/osv.yml +++ b/.github/workflows/osv.yml @@ -36,7 +36,7 @@ jobs: --lockfile=pnpm-lock.yaml \ --format=sarif \ --output=osv.sarif || true - - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 + - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4 if: always() with: sarif_file: osv.sarif diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6c455f5b..3ccedabe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -314,7 +314,7 @@ jobs: - name: Upload SARIF to code scanning if: hashFiles('artifacts/och-scan.sarif') != '' - uses: github/codeql-action/upload-sarif@9887d98ae49f1f598651b556d8c8f02f3ea065cb # codeql-bundle-v2.25.4 + uses: github/codeql-action/upload-sarif@f4d0a7abf7b1d0f530e480f564a7e2371488107a # codeql-bundle-v2.25.4 with: sarif_file: artifacts/och-scan.sarif category: opencodehub-release diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ea1ed447..98bc0329 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -32,6 +32,6 @@ jobs: name: SARIF path: results.sarif retention-days: 5 - - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 + - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4 with: sarif_file: results.sarif diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 882541b4..9a2335f2 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -39,7 +39,7 @@ jobs: --config p/owasp-top-ten \ --sarif --output=semgrep.sarif \ --metrics=off || true - - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 + - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4 if: always() with: sarif_file: semgrep.sarif diff --git a/.github/workflows/verify-global-install.yml b/.github/workflows/verify-global-install.yml index 0ebfdc9d..fc0a3e79 100644 --- a/.github/workflows/verify-global-install.yml +++ b/.github/workflows/verify-global-install.yml @@ -170,7 +170,7 @@ jobs: - name: Install pnpm (non-mise / non-volta paths) if: matrix.installer == 'nvm' || matrix.installer == 'homebrew' - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 + uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 with: version: 11.1.0