chore(deps): bump the github-actions group with 38 updates by dependabot[bot] · Pull Request #907 · dallay/corvus

dependabot · 2026-09-12T01:52:42Z

Updates the requirements on actions/checkout, dtolnay/rust-toolchain, actions/upload-artifact, actions/setup-java, gradle/actions/setup-gradle, actions/download-artifact, docker/setup-qemu-action, docker/setup-buildx-action, docker/login-action, docker/metadata-action, docker/build-push-action, actions/setup-node, pnpm/action-setup, peter-evans/create-pull-request, dallay/common-actions/.github/workflows/cleanup-cache.yml, github/codeql-action, dallay/common-actions/.github/workflows/dependabot-auto-merge.yml, actions/dependency-review-action, actions/upload-pages-artifact, actions/deploy-pages, github/codeql-action/upload-sarif, actions/github-script, dallay/common-actions/.github/workflows/greetings.yml, actions/create-github-app-token, actions/cache, lycheeverse/lychee-action, actions/cache/save, google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml, google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml, dallay/common-actions/.github/workflows/pr-size-labeler.yml, codecov/codecov-action, googleapis/release-please-action, taiki-e/install-action, gradle/actions/dependency-submission, dallay/common-actions/.github/workflows/semantic-pull-request.yml, SonarSource/sonarqube-scan-action, SonarSource/sonarqube-quality-gate-action and dallay/common-actions/.github/workflows/stale.yml to permit the latest version.
Updates actions/checkout from 6.0.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates dtolnay/rust-toolchain to d1031067263f94b142dd6c0ce24c5eb9d02d52a0

Commits

See full diff in compare view

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in actions/upload-artifact#719

fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in actions/upload-artifact#744

prepare release v6.0.0 for Node.js 24 support by @salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
02a8460 Add proxy integration test
b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
e516bc8 docs: correct description of Node.js 24 support in README
Additional commits viewable in compare view

Updates actions/setup-java from 5.2.0 to 6.0.1

Release notes

Sourced from actions/setup-java's releases.

v6.0.1

What's Changed

Fix failing GitHub Actions job for temurin 17 by @brunoborges with @Copilot in actions/setup-java#1259

Fix Temurin EA E2E signature verification by @brunoborges with @Copilot in actions/setup-java#1260

Fix Alpine GPG verification failures and support multiple keys by @brunoborges in actions/setup-java#1262

Fix import-safe checks when scripts are run from a path with symlinks by @otaconix in actions/setup-java#1265

Avoid macOS GPG socket overflow on long runner paths by @brunoborges with @Copilot in actions/setup-java#1266

Complete v6 release highlights in README by @brunoborges in actions/setup-java#1254

Group and slow routine Dependabot updates by @brunoborges in actions/setup-java#1255

chore(deps-dev): update eslint and globals by @dependabot[bot] in actions/setup-java#1256

New Contributors

@otaconix made their first contribution in actions/setup-java#1265

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

v6.0.0

What's Changed

dist: Migrate from Zulu Discovery API to Azul Metadata API by @jameswald in actions/setup-java#1010

feat: add .mvn/extensions.xml to Maven cache key pattern by @brunoborges with @Copilot in actions/setup-java#1041

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-java#1078

Map Zulu x86 architecture to i686 for Azul Metadata API by @brunoborges in actions/setup-java#1079

Rename jdkFile input to jdk-file with deprecated alias by @brunoborges in actions/setup-java#1083

Infer distribution from asdf .tool-versions vendor prefix by @brunoborges in actions/setup-java#1084

Add Maven compiler problem matcher for javac diagnostics by @brunoborges in actions/setup-java#1086

feat: expose cache-primary-key output (#597) by @brunoborges in actions/setup-java#1088

docs: clarify V6 ESM migration is not a user-facing breaking change by @brunoborges in actions/setup-java#1090

Support multi-field Java versions like 18.0.1.1 by @brunoborges in actions/setup-java#1092

docs: document seeding the Maven cache for plugin dependencies by @brunoborges in actions/setup-java#1094

docs: clarify Maven cache paths and key hash inputs by @brunoborges in actions/setup-java#1096

Support pinning java-version as "latest" by @brunoborges in actions/setup-java#1093

chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @dependabot[bot] in actions/setup-java#1101

chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @dependabot[bot] in actions/setup-java#1103

chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @dependabot[bot] in actions/setup-java#1105

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in actions/setup-java#1106

chore(deps-dev): bump @types/node from 26.1.0 to 26.1.1 by @dependabot[bot] in actions/setup-java#1104

dist: Cover Tencent Kona JDK 25 by @johnshajiang in actions/setup-java#1108

chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in actions/setup-java#1102

Preserve Maven toolchains across repeated setup-java runs (#1099) by @brunoborges in actions/setup-java#1111

dist: Support Liberica NIK (#878) by @asm0dey in actions/setup-java#1112

Fix template injection (zizmor alert #118) in e2e-versions.yml by @brunoborges with @Copilot in actions/setup-java#1114

Fix template injection in e2e-versions.yml (zizmor alert #122) by @brunoborges with @Copilot in actions/setup-java#1120

Disable persisted checkout credentials in e2e workflow by @brunoborges with @Copilot in actions/setup-java#1115

feat: Update recommended configuration for GPG signing by @wetneb in actions/setup-java#608

Cache Maven and Gradle wrapper distributions separately from the dependency cache by @brunoborges in actions/setup-java#1097

Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @brunoborges in actions/setup-java#1124

Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @brunoborges in actions/setup-java#1123

Extract repeated directory-check assertions into check-dir.sh helper by @brunoborges in actions/setup-java#1127

Consolidate duplicate jobs in e2e-versions workflow by @brunoborges in actions/setup-java#1125

Use YAML anchors to reduce boilerplate in e2e-versions workflow by @brunoborges in actions/setup-java#1126

... (truncated)

Commits

de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
134912a Fix import-safe checks when scripts are run from a path with symlinks (#1265)
0781fc6 Fix alpine failures by switching default back to only warn on verification fa...
4889c4a Fix Temurin EA E2E signature verification (#1260)
8fd3240 [WIP] Fix failing GitHub Actions job for temurin 17 (#1259)
2732291 chore(deps-dev): update eslint and globals (#1256)
1a8f22b chore: streamline Dependabot updates (#1255)
85030b7 docs: complete v6 release highlights (#1254)
dd06d9c Prepare documentation for v6 release (#1253)
59b3450 chore(deps): combine open Dependabot npm updates (#1252)
Additional commits viewable in compare view

Updates gradle/actions/setup-gradle from 5.0.2 to 6.3.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.3.0

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

Cache entries failed to store at all on Windows.. Every entry failed with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of @actions/glob combined with a silently swallowed require() in the bundle, which left Windows path separators unnormalized.

Cache cleanup deleted instrumented jars that were in use. A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created caches/jars-9 entries as unused and remove them, so the instrumented-jars entry was never saved and every job re-instrumented its classpaths.

Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT] Existing cache entries are invalidated by this release. The cache protocol version was bumped to v2, so the first run after upgrading will be a cache miss and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports (Entry not saved: save failed) in the Job Summary when a cache save fails, rather than reporting success (#1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it (#1025). Thanks to @reinsch82 for the contribution.

Updated defaults

Injected Develocity Gradle plugin: 4.4.2 → 4.5.0

36 new known-good wrapper checksums added for wrapper-validation

What's Changed

Render configuration-cache status in the caching Job Summary by @bigdaz in gradle/actions#989

Update gradle-actions-caching library to v0.8.0 by @bot-githubaction in gradle/actions#993

Support experimental project-entry caching (configuration-cache + build-logic) by @bigdaz in gradle/actions#994

Update gradle-actions-caching library to v0.9.0 by @bot-githubaction in gradle/actions#996

Disable Isolated Projects via promoted property in dependency-submission by @reinsch82 in gradle/actions#1025

Add Windows coverage for caching via a new smoke-test suite by @bigdaz in gradle/actions#1027

... (truncated)

Commits

9c97196 Bump the github-actions group across 2 directories with 9 updates (#1024)
760e4a4 Bump the npm-dependencies group across 1 directory with 2 updates (#1037)
73e4c42 Update gradle-actions-caching library to v1.0.0 (#1029)
a9d1438 Add dependabot ignore rules for TypeScript 7.x and @types/node 25.x/26.x
68f3700 [bot] Update dist directory
5971332 Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...
b5bc804 [bot] Update dist directory
dcbab4e Bump npm-dependencies group with TypeScript 6.0.3, @types/node 24.x, and secu...
ca8d957 Move non-smoke restore-gradle-home tests back to the integ-test suite (#1032)
4318659 [bot] Update dist directory
Additional commits viewable in compare view

Updates actions/download-artifact from 7.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in actions/download-artifact#471

Add a regression test for artifact name + content-type mismatches by @danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in actions/download-artifact#460

Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits

3e5f45b Add regression tests for CJK characters (#471)
e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
f258da9 Add change docs
ccc058e Fix linting issues
bd7976b Add a setting to specify what to do on hash mismatch and default it to error
ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
15999bf Add note about package bumps
974686e Bump the version to v8 and add release notes
fbe48b1 Update test names to make it clearer what they do
Additional commits viewable in compare view

Updates docker/setup-qemu-action from 3.7.0 to 4.3.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.3.0

Bump @docker/actions-toolkit from 0.92.0 to 0.96.0 in docker/setup-qemu-action#336

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-qemu-action#316

Bump brace-expansion from 1.1.15 to 1.1.18 in docker/setup-qemu-action#332

Bump js-yaml from 4.2.0 to 4.3.1 in docker/setup-qemu-action#334

Bump postcss from 8.5.10 to 8.5.25 in docker/setup-qemu-action#331

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-qemu-action#317

Bump undici from 6.27.0 to 6.28.0 in docker/setup-qemu-action#333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-qemu-action#311

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-qemu-action#295

Bump @docker/actions-toolkit from 0.91.0 to 0.92.0 in docker/setup-qemu-action#315

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-qemu-action#312

Bump js-yaml from 4.1.1 to 4.2.0 in docker/setup-qemu-action#310

Bump tmp from 0.2.6 to 0.2.7 in docker/setup-qemu-action#304

Bump undici from 6.26.0 to 6.27.0 in docker/setup-qemu-action#308

Bump vite from 7.3.2 to 7.3.6 in docker/setup-qemu-action#307

Full Changelog: docker/setup-qemu-action@v4.1.0...v4.2.0

v4.1.0

Add reset input to uninstall current emulators by @crazy-max in docker/setup-qemu-action#21

Bump @docker/actions-toolkit from 0.77.0 to 0.91.0 in docker/setup-qemu-action#250 docker/setup-qemu-action#247

Bump brace-expansion from 1.1.12 to 1.1.15 in docker/setup-qemu-action#265

Bump fast-xml-builder from 1.0.0 to 1.2.0 in docker/setup-qemu-action#286

Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/setup-qemu-action#255

Bump flatted from 3.3.3 to 3.4.2 in docker/setup-qemu-action#257

Bump glob from 10.3.15 to 10.5.0 in docker/setup-qemu-action#254

Bump handlebars from 4.7.8 to 4.7.9 in docker/setup-qemu-action#262

Bump lodash from 4.17.23 to 4.18.1 in docker/setup-qemu-action#273

Bump postcss from 8.5.6 to 8.5.10 in docker/setup-qemu-action#285

Bump tar from 6.2.1 to 7.5.15 in docker/setup-qemu-action#287

Bump tmp from 0.2.5 to 0.2.6 in docker/setup-qemu-action#291

Bump undici from 6.23.0 to 6.26.0 in docker/setup-qemu-action#251

Bump vite from 7.3.1 to 7.3.2 in docker/setup-qemu-action#271

Full Changelog: docker/setup-qemu-action@v4.0.0...v4.1.0

v4.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/setup-qemu-action#245

Switch to ESM and update config/test wiring by @crazy-max in docker/setup-qemu-action#241

Bump @actions/core from 1.11.1 to 3.0.0 in docker/setup-qemu-action#244

Bump @docker/actions-toolkit from 0.67.0 to 0.77.0 in docker/setup-qemu-action#243

Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in docker/setup-qemu-action#240

Bump js-yaml from 3.14.1 to 3.14.2 in docker/setup-qemu-action#231

Bump lodash from 4.17.21 to 4.17.23 in docker/setup-qemu-action#238

... (truncated)

Commits

1f40c72 Merge pull request #336 from docker/dependabot/npm_and_yarn/docker/actions-to...
932216e [dependabot skip] chore: update generated content
a39e895 build(deps): bump @docker/actions-toolkit from 0.92.0 to 0.96.0
a98ae9f Merge pull request #333 from docker/dependabot/npm_and_yarn/undici-6.28.0
8ebc9d1 [dependabot skip] chore: update generated content
c41e3fc build(deps): bump undici from 6.27.0 to 6.28.0
5fc60df Merge pull request #332 from docker/dependabot/npm_and_yarn/brace-expansion-1...
a26e892 Merge pull request #328 from docker/dependabot/github_actions/actions/checkou...
aa6d042 Merge pull request #324 from docker/dependabot/github_actions/actions/setup-n...
d381ce5 Merge pull request #317 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.12.0 to 4.3.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.3.0

Bump @docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600

Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585

Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598

Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-buildx-action#572

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-buildx-action#551

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/setup-buildx-action#557 docker/setup-buildx-action#580

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-buildx-action#573

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-buildx-action#576

Bump js-yaml from 4.1.1 to 5.2.0 in docker/setup-buildx-action#562

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-buildx-action#577

Bump tmp from 0.2.5 to 0.2.7 in docker/setup-buildx-action#556

Bump undici from 6.25.0 to 6.27.0 in docker/setup-buildx-action#570

Bump vite from 7.3.2 to 7.3.6 in docker/setup-buildx-action#569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

v4.1.0

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in docker/setup-buildx-action#489

Bump brace-expansion from 1.1.12 to 5.0.6 in docker/setup-buildx-action#547 docker/setup-buildx-action#508

Bump fast-xml-builder from 1.0.0 to 1.2.0 in docker/setup-buildx-action#540

Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/setup-buildx-action#496

Bump flatted from 3.3.3 to 3.4.2 in

Updates the requirements on [actions/checkout](https://github.com/actions/checkout), [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain), [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/setup-java](https://github.com/actions/setup-java), [gradle/actions/setup-gradle](https://github.com/gradle/actions), [actions/download-artifact](https://github.com/actions/download-artifact), [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/login-action](https://github.com/docker/login-action), [docker/metadata-action](https://github.com/docker/metadata-action), [docker/build-push-action](https://github.com/docker/build-push-action), [actions/setup-node](https://github.com/actions/setup-node), [pnpm/action-setup](https://github.com/pnpm/action-setup), [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request), [dallay/common-actions/.github/workflows/cleanup-cache.yml](https://github.com/dallay/common-actions), [github/codeql-action](https://github.com/github/codeql-action), [dallay/common-actions/.github/workflows/dependabot-auto-merge.yml](https://github.com/dallay/common-actions), [actions/dependency-review-action](https://github.com/actions/dependency-review-action), [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact), [actions/deploy-pages](https://github.com/actions/deploy-pages), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action), [actions/github-script](https://github.com/actions/github-script), [dallay/common-actions/.github/workflows/greetings.yml](https://github.com/dallay/common-actions), [actions/create-github-app-token](https://github.com/actions/create-github-app-token), [actions/cache](https://github.com/actions/cache), [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action), [actions/cache/save](https://github.com/actions/cache), [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action), [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action), [dallay/common-actions/.github/workflows/pr-size-labeler.yml](https://github.com/dallay/common-actions), [codecov/codecov-action](https://github.com/codecov/codecov-action), [googleapis/release-please-action](https://github.com/googleapis/release-please-action), [taiki-e/install-action](https://github.com/taiki-e/install-action), [gradle/actions/dependency-submission](https://github.com/gradle/actions), [dallay/common-actions/.github/workflows/semantic-pull-request.yml](https://github.com/dallay/common-actions), [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action), [SonarSource/sonarqube-quality-gate-action](https://github.com/sonarsource/sonarqube-quality-gate-action) and [dallay/common-actions/.github/workflows/stale.yml](https://github.com/dallay/common-actions) to permit the latest version. Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...3d3c42e) Updates `dtolnay/rust-toolchain` to d1031067263f94b142dd6c0ce24c5eb9d02d52a0 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/commits/d1031067263f94b142dd6c0ce24c5eb9d02d52a0) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...043fb46) Updates `actions/setup-java` from 5.2.0 to 6.0.1 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@be666c2...de7274f) Updates `gradle/actions/setup-gradle` from 5.0.2 to 6.3.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@0723195...9c97196) Updates `actions/download-artifact` from 7.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@37930b1...3e5f45b) Updates `docker/setup-qemu-action` from 3.7.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@c7c5346...1f40c72) Updates `docker/setup-buildx-action` from 3.12.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@8d2750c...37fe631) Updates `docker/login-action` from 3.7.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@c94ce9f...dbcb813) Updates `docker/metadata-action` from 5.10.0 to 6.2.0 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@c299e40...dc80280) Updates `docker/build-push-action` from 6.19.2 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@10e90e3...53b7df9) Updates `actions/setup-node` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@53b8394...8207627) Updates `pnpm/action-setup` from 4.2.0 to 6.1.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@41ff726...ea17c68) Updates `peter-evans/create-pull-request` from 8.0.0 to 8.1.1 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@98357b1...5f6978f) Updates `dallay/common-actions/.github/workflows/cleanup-cache.yml` from 2.0.0 to 2.2.4 - [Release notes](https://github.com/dallay/common-actions/releases) - [Commits](dallay/common-actions@6ecd716...6906025) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) Updates `dallay/common-actions/.github/workflows/dependabot-auto-merge.yml` from 2.0.0 to 2.2.4 - [Release notes](https://github.com/dallay/common-actions/releases) - [Commits](dallay/common-actions@v2.0.0...v2.2.4) Updates `actions/dependency-review-action` from 4.8.3 to 5.0.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@05fe457...a1d282b) Updates `actions/upload-pages-artifact` from 4.0.0 to 5.0.0 - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](actions/upload-pages-artifact@7b1f4a7...fc324d3) Updates `actions/deploy-pages` from 4.0.5 to 5.0.1 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](actions/deploy-pages@d6db901...368f825) Updates `github/codeql-action/upload-sarif` from 4.31.10 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdefb33...b96794f) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@ed59741...3a2844b) Updates `dallay/common-actions/.github/workflows/greetings.yml` from 2.0.0 to 2.2.4 - [Release notes](https://github.com/dallay/common-actions/releases) - [Commits](dallay/common-actions@6ecd716...6906025) Updates `actions/create-github-app-token` from 2.2.1 to 3.2.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@v2.2.1...bcd2ba4) Updates `actions/cache` from 4.2.1 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0c907a7...55cc834) Updates `lycheeverse/lychee-action` from 2.8.0 to 2.9.0 - [Release notes](https://github.com/lycheeverse/lychee-action/releases) - [Commits](lycheeverse/lychee-action@8646ba3...e747777) Updates `actions/cache/save` from 4.2.1 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0c907a7...55cc834) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from eb5b619bb565d10623076caba5263750fde3c790 to 8e5cf47b818121e8b405931c82126c2630b0b20d - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@eb5b619...8e5cf47) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml` from eb5b619bb565d10623076caba5263750fde3c790 to 8e5cf47b818121e8b405931c82126c2630b0b20d - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@eb5b619...8e5cf47) Updates `dallay/common-actions/.github/workflows/pr-size-labeler.yml` from 2.0.0 to 2.2.4 - [Release notes](https://github.com/dallay/common-actions/releases) - [Commits](dallay/common-actions@6ecd716...6906025) Updates `codecov/codecov-action` from 5.5.3 to 7.0.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@1af5884...fb8b358) Updates `googleapis/release-please-action` from 4.4.0 to 5.0.0 - [Release notes](https://github.com/googleapis/release-please-action/releases) - [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md) - [Commits](googleapis/release-please-action@16a9c90...45996ed) Updates `taiki-e/install-action` from 2.68.14 to 2.87.9 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Commits](taiki-e/install-action@v2.68.14...v2.87.9) Updates `gradle/actions/dependency-submission` from 5.0.2 to 6.3.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@0723195...9c97196) Updates `dallay/common-actions/.github/workflows/semantic-pull-request.yml` from 2.0.0 to 2.2.4 - [Release notes](https://github.com/dallay/common-actions/releases) - [Commits](dallay/common-actions@v2.0.0...v2.2.4) Updates `SonarSource/sonarqube-scan-action` from 6.0.0 to 8.2.1 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](SonarSource/sonarqube-scan-action@fd88b7d...2291811) Updates `SonarSource/sonarqube-quality-gate-action` from 1.1.0 to 1.2.1 - [Release notes](https://github.com/sonarsource/sonarqube-quality-gate-action/releases) - [Commits](SonarSource/sonarqube-quality-gate-action@d304d05...7a5fffe) Updates `dallay/common-actions/.github/workflows/stale.yml` from 2.0.0 to 2.2.4 - [Release notes](https://github.com/dallay/common-actions/releases) - [Commits](dallay/common-actions@6ecd716...6906025) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dtolnay/rust-toolchain dependency-version: d1031067263f94b142dd6c0ce24c5eb9d02d52a0 dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: gradle/actions/setup-gradle dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/metadata-action dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: pnpm/action-setup dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dallay/common-actions/.github/workflows/cleanup-cache.yml dependency-version: 2.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dallay/common-actions/.github/workflows/dependabot-auto-merge.yml dependency-version: 2.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/dependency-review-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-pages-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/deploy-pages dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dallay/common-actions/.github/workflows/greetings.yml dependency-version: 2.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/create-github-app-token dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: lycheeverse/lychee-action dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/cache/save dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: 8e5cf47b818121e8b405931c82126c2630b0b20d dependency-type: direct:production dependency-group: github-actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml dependency-version: 8e5cf47b818121e8b405931c82126c2630b0b20d dependency-type: direct:production dependency-group: github-actions - dependency-name: dallay/common-actions/.github/workflows/pr-size-labeler.yml dependency-version: 2.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: googleapis/release-please-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.87.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: gradle/actions/dependency-submission dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dallay/common-actions/.github/workflows/semantic-pull-request.yml dependency-version: 2.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.2.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: SonarSource/sonarqube-quality-gate-action dependency-version: 1.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dallay/common-actions/.github/workflows/stale.yml dependency-version: 2.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-09-12T01:52:45Z

Deploying corvus with Cloudflare Pages

Latest commit:	`f89bd42`
Status:	⚡️ Build in progress...

View logs

github-actions · 2026-09-12T01:52:54Z

It seems you edited the limitation files. These files aren't open for contributions. If you think they should be, feel free to reply here.

coderabbitai · 2026-09-12T01:52:54Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a4a7bbd5-a5a4-4368-8aa3-960b3563f659

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-12T01:52:56Z

Thank you for contributing to this project with this PR, welcome to the community and the amazing world of open source!

dependabot · 2026-09-12T01:52:57Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

semgrep-code-dallay · 2026-09-12T01:54:23Z

      - name: 🔍 Run CodeQL Analysis
        if: matrix.language != 'java-kotlin'
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4


Semgrep identified a blocking 🔴 issue in your code:

GitHub Actions step uses mutable tag @v4 instead of a pinned commit SHA, allowing the action owner to silently redirect to malicious code and compromise your CI/CD pipeline.

More details about this

The GitHub Actions workflow is using uses: github/codeql-action/analyze@v4, which pins to a mutable tag (v4) rather than a specific commit SHA. This means the action owner can silently redirect what code runs in your workflow without your knowledge.

Here's how an attacker could exploit this:

Compromise the codeql-action repository: An attacker gains write access to the GitHub repository hosting github/codeql-action (or tricks GitHub into transferring ownership).

Repoint the v4 tag: The attacker updates the v4 tag to point to a malicious commit they've created that includes backdoored code (e.g., code that exfiltrates secrets from the GitHub Actions environment).

Your workflow silently runs the backdoor: The next time your workflow runs, GitHub Actions resolves @v4 to the attacker's malicious commit. Your analyze step now runs arbitrary code with access to secrets and repository data.

Extract sensitive data: The malicious github/codeql-action/analyze could steal environment variables containing API keys, access tokens, or commit credentials that were set up for your repository.

This has happened in the real world—the trivy-action and kics-github-action projects both experienced compromises where tags were repointed to inject malicious code into CI/CD pipelines.

To resolve this comment:

✨ Commit fix suggestion

Replace the mutable reference github/codeql-action/analyze@v4 with a full 40-character commit SHA for the v4 release, for example github/codeql-action/analyze@<full-40-character-sha>.

Update both uses: github/codeql-action/analyze@v4 entries in this workflow so they point to the same pinned commit SHA.

Get the correct SHA from the github/codeql-action repository’s v4 release or tags page, and use the exact commit value instead of the tag name. This prevents the action from changing silently if the tag is moved.

Keep the action name and step conditions the same; only change the part after @, for example uses: github/codeql-action/analyze@8ade135a41bc03ea155e62e844d188df1ea18608.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-dallay · 2026-09-12T01:54:24Z

        if: >
          steps.gradle_build_java_kotlin.outcome == 'success'
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4


Semgrep identified a blocking 🔴 issue in your code:

GitHub Actions step uses mutable version tag (v4) instead of a specific commit, allowing the action owner to silently update it to malicious code.

More details about this

The github/codeql-action/analyze@v4 action is pinned to a mutable tag (v4) rather than a specific commit hash. An attacker who gains control of the GitHub Actions repository could silently update the v4 tag to point to malicious code. When your workflow runs, it would automatically fetch and execute the attacker's version without any warning or visibility into what changed.

Here's how the attack would work:

An attacker compromises the codeql-action repository or its maintainer credentials

The attacker pushes malicious code and repoints the v4 tag to this new commit

On your next workflow run, the uses: github/codeql-action/analyze@v4 line fetches the malicious version

The malicious code runs with access to your repository secrets, source code, and CI environment

The attacker could exfiltrate credentials, inject backdoors into your build artifacts, or compromise downstream users

This same attack pattern was used to compromise real projects like trivy-action and kics-github-action. The vulnerability exists because mutable tags like v4 can be repointed by the action maintainer at any time, and your workflow has no way to detect or prevent this.

To resolve this comment:

✨ Commit fix suggestion

Replace github/codeql-action/analyze@v4 with a full 40-character commit SHA for the exact v4 release you want to use, for both analyze steps.

Keep the readable version in a comment next to the SHA so future updates are easier, for example: uses: github/codeql-action/analyze@<full-40-char-sha> # v4.x.x.

Pin the matching init step the same way if it is still using @v4, so all github/codeql-action steps use immutable references consistently.

Get the correct SHA from the github/codeql-action release or tag page, and make sure it is the commit that the v4 tag currently points to before updating the workflow.

Manually confirm the workflow still runs the same CodeQL action version after the change by checking the action reference shown in the workflow run. Pinning to a commit SHA prevents the action owner from silently moving a tag or branch to different code later.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-dallay · 2026-09-12T01:54:25Z


      - name: ⚙️ Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4


Semgrep identified a blocking 🔴 issue in your code:

GitHub Actions step references mutable version tag @v4 instead of a pinned commit SHA, allowing attackers to silently redirect the action to malicious code and steal repository secrets.

More details about this

The CodeQL action reference uses a mutable version tag (@v4) instead of a pinned commit SHA. An attacker who controls the github/codeql-action repository could silently update the v4 tag to point to malicious code, which would then execute in your workflow with access to your repository secrets and code.

Here's how this could be exploited:

An attacker compromises the github/codeql-action repository or gains control over the v4 tag.

They push malicious code and repoint the v4 tag to a commit containing a backdoor that steals GITHUB_TOKEN or other secrets (stored in secrets.*).

Your workflow runs and automatically pulls the new malicious version at github/codeql-action/init@v4.

The backdoor executes during the "⚙️ Initialize CodeQL" step, exfiltrating secrets or modifying your code before it gets built.

An attacker could then use the stolen GITHUB_TOKEN to push malicious code to your repository or access other workflows.

Similarly, the github/codeql-action/analyze@v4 steps on lines below also use the mutable @v4 tag and face the same risk.

To resolve this comment:

✨ Commit fix suggestion

Replace the mutable ref in the CodeQL init step with a full 40-character commit SHA from the github/codeql-action repository. Change uses: github/codeql-action/init@v4 to uses: github/codeql-action/init@<full-40-character-sha>.

Pin the matching CodeQL analyze steps the same way so the workflow uses one fixed action version consistently. Change uses: github/codeql-action/analyze@v4 to uses: github/codeql-action/analyze@<same-release-full-40-character-sha> if both files come from the same release commit, or to the specific full SHA published for that action entrypoint.

Keep the human-readable version in a comment so future updates are easier to track, for example: uses: github/codeql-action/init@<full-40-character-sha> # v4.x.y. Pinning to a commit SHA prevents a tag like v4 from being silently moved to different code later.

Get the SHA from the official github/codeql-action release you want to trust, then copy that exact commit into the workflow instead of the tag. For example, use the commit shown for the v4 release page or the action's commit URL, not a short SHA.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

dependabot Bot added pr|deps Updates or modifies project dependencies pr|infra Changes to build system, tooling, or CI/CD infrastructure type|dependency-upgrade A dependency upgrade labels Sep 12, 2026

dependabot Bot requested a review from yacosta738 as a code owner September 12, 2026 01:52

dependabot Bot added type|dependency-upgrade A dependency upgrade pr|deps Updates or modifies project dependencies labels Sep 12, 2026

dependabot Bot added the pr|infra Changes to build system, tooling, or CI/CD infrastructure label Sep 12, 2026

github-actions Bot added the close|invalid An issue that we don't feel is valid label Sep 12, 2026

github-actions Bot closed this Sep 12, 2026

github-actions Bot added the size/m Denotes a medium change size label Sep 12, 2026

dependabot Bot deleted the dependabot/github_actions/github-actions-071de8af87 branch September 12, 2026 01:53

semgrep-code-dallay Bot reviewed Sep 12, 2026

View reviewed changes

Navigation Menu

chore(deps): bump the github-actions group with 38 updates - #907

chore(deps): bump the github-actions group with 38 updates#907
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-071de8af87

dependabot Bot commented on behalf of github Sep 12, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 12, 2026

Uh oh!

github-actions Bot commented Sep 12, 2026

Uh oh!

coderabbitai Bot commented Sep 12, 2026

Review skipped

Uh oh!

github-actions Bot commented Sep 12, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 12, 2026

Uh oh!

semgrep-code-dallay Bot Sep 12, 2026

Uh oh!

semgrep-code-dallay Bot Sep 12, 2026

Uh oh!

semgrep-code-dallay Bot Sep 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 12, 2026

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

v6.0.3

What's Changed

New Contributors

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v7.0.1

What's Changed

v7.0.0

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v6.0.0

v6 - What's new

Node.js 24

What's Changed

v5.0.0

What's Changed

v6.0.1

What's Changed

New Contributors

v6.0.0

What's Changed

v6.3.0

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

Basic caching warns instead of failing silently

Dependency submission works with Isolated Projects

Updated defaults

What's Changed

v8.0.1

What's Changed

v8.0.0

v8 - What's new

Direct downloads

Enforced checks (breaking)

ESM

What's Changed

v4.3.0

v4.2.0

v4.1.0

v4.0.0

v4.3.0

v4.2.0

v4.1.0

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 12, 2026

Deploying corvus with Cloudflare Pages

Uh oh!

github-actions Bot commented Sep 12, 2026

Uh oh!

coderabbitai Bot commented Sep 12, 2026

Review skipped

Uh oh!

github-actions Bot commented Sep 12, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 12, 2026

Uh oh!

semgrep-code-dallay Bot Sep 12, 2026