dependabot[bot] and GitHub
d1d84ea8f9
chore(deps): bump github/codeql-action/autobuild from 4.37.6 to 4.38.2
...
Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action ) from 4.37.6 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 )
---
updated-dependencies:
- dependency-name: github/codeql-action/autobuild
dependency-version: 4.38.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-11-05 04:44:45 +00:00
602b80b240
chore(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.4 ( #436 )
...
Bumps
[zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action )
from 0.6.0 to 0.6.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zizmorcore/zizmor-action/releases ">zizmorcore/zizmor-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.4</h2>
<p><a href="https://github.com/sponsors/woodruffw/ ">Sponsorship is
appreciated!</a></p>
<p>zizmor 1.30.1 is now the default version.</p>
<p>Release notes: <a
href="https://docs.zizmor.sh/release-notes/%5B#1301%5D(https://redirect.github.com/zizmorcore/zizmor-action/issues/1301) ">zizmorcore/zizmor-action#1301</a></p>
<h2>v0.6.3</h2>
<p>zizmor 1.30.0 is now the default version.</p>
<p>Release notes: <a
href="https://docs.zizmor.sh/release-notes/%5B#1300%5D(https://redirect.github.com/zizmorcore/zizmor-action/issues/1300) ">zizmorcore/zizmor-action#1300</a></p>
<h2>v0.6.2</h2>
<p>zizmor 1.29.0 is now the default version.</p>
<h2>v0.6.1</h2>
<p>zizmor 1.28.0 is now the default version used by the action.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/cc914d7f3750a2d13d75c7f184a1060aa0e9d482 "><code>cc914d7</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/166 ">#166</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/bae72b71bc270806f906e8e2a1f5985a26effaa2 "><code>bae72b7</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/165 ">#165</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/27604f9eef072d6456e69fc10ee36629710fa6f6 "><code>27604f9</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/164 ">#164</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/c41d66537b2d733801baec1e31ffc22aa2051a8f "><code>c41d665</code></a>
README: bump pins (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/163 ">#163</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/70fb788f84895a7701f5643d103d587e460b5c99 "><code>70fb788</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/162 ">#162</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/7999d8c8ac51dbd3bd44e6e35e7cd015b5dcdc82 "><code>7999d8c</code></a>
chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to
4.37.7 in ...</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/2ae1ce9c6b7248fdfc5a4f47f3527240521f79b9 "><code>2ae1ce9</code></a>
chore(deps): bump github/codeql-action/upload-sarif (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/160 ">#160</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/951a5eef1c3d7669c20934ceca759fdf8dbd153e "><code>951a5ee</code></a>
Skip prerelease versions in sync-zizmor-versions workflow (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/158 ">#158</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/79f019101434ac77d41ed24f93c6bdc8676bd355 "><code>79f0191</code></a>
chore(deps): bump github/codeql-action/upload-sarif (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/156 ">#156</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/26a3ae6758a68e521bfe592f503410eb61b699bb "><code>26a3ae6</code></a>
sync-zizmor-versions: retry up to 5 times (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/155 ">#155</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/zizmorcore/zizmor-action/compare/6599ee8b7a49aef6a770f63d261d214911a7ce02...cc914d7f3750a2d13d75c7f184a1060aa0e9d482 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-04 09:16:32 +01:00
af7afd2955
chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 ( #438 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.2
to 7.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases ">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518 ">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521 ">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530 ">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1 ">https://github.com/actions/checkout/compare/v7...v7.0.1 </a></p>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454 ">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458 ">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460 ">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461 ">actions/checkout#2461</a></li>
<li>Bump <code>@actions/core</code> and
<code>@actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459 ">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463 ">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462 ">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464 ">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467 ">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454 ">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0 ">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0 </a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport
<code>allow-unsafe-pr-checkout</code> to v6 by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2500 ">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2527 ">actions/checkout#2527</a></li>
</ul>
<p><a
href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ ">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ </a>
for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0 ">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0 </a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357 ">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth "><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414 ">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth "><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439 ">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth "><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446 ">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth "><code>@yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414 ">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3 ">https://github.com/actions/checkout/compare/v6...v6.0.3 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md ">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518 ">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521 ">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530 ">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454 ">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth "><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439 ">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth "><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414 ">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356 ">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327 ">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286 ">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc "><code>@salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248 ">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301 ">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc "><code>@salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226 ">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305 ">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss "><code>@motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971 ">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail "><code>@mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977 ">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells "><code>@benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043 ">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross "><code>@joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044 ">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89 "><code>@nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194 ">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang "><code>@TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224 ">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc "><code>@salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236 ">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3 "><code>@jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941 ">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3 "><code>@jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946 ">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy "><code>@orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924 ">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1 "><code>3d3c42e</code></a>
prep v7.0.1 release (<a
href="https://redirect.github.com/actions/checkout/issues/2531 ">#2531</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07 "><code>2880268</code></a>
escape values passed to --unset (<a
href="https://redirect.github.com/actions/checkout/issues/2530 ">#2530</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1 "><code>12cd223</code></a>
trim only ascii whitespace for branch (<a
href="https://redirect.github.com/actions/checkout/issues/2521 ">#2521</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541 "><code>62661c4</code></a>
skip running unsafe pr check if input is default (<a
href="https://redirect.github.com/actions/checkout/issues/2518 ">#2518</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f "><code>e8d4307</code></a>
Bump the minor-actions-dependencies group with 2 updates (<a
href="https://redirect.github.com/actions/checkout/issues/2499 ">#2499</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87 "><code>631c942</code></a>
eslint 9 (<a
href="https://redirect.github.com/actions/checkout/issues/2474 ">#2474</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e "><code>4f1f4ae</code></a>
Bump actions/upload-artifact from 4 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2476 ">#2476</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92 "><code>ba09753</code></a>
Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2488 ">#2488</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22 "><code>b9e0990</code></a>
Bump docker/login-action from 3.3.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2479 ">#2479</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2 "><code>e8cb398</code></a>
Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2478 ">#2478</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...3d3c42e5aac5ba805825da76410c181273ba90b1 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-04 09:15:59 +01:00
William Woodruff and GitHub
7013188d81
Run demudhra first on macOS ( #447 )
2026-11-03 19:04:05 +00:00
a9506688fc
chore: update known checksums for 0.17.3 ( #446 )
...
chore: update known checksums for 0.17.3
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-10-27 11:53:05 +01:00
2acb44a1c3
chore: update known checksums for 0.17.2 ( #445 )
...
chore: update known checksums for 0.17.2
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-10-26 09:18:11 +01:00
Alex Waygood and GitHub
665801e39d
Update esbuild to 0.28.2 ( #435 )
...
Update `esbuild` from `0.27.4` to `0.28.2` and regenerate the checked-in
action bundles with the updated version. This addresses [Dependabot
alert
#28 ](https://github.com/astral-sh/ruff-action/security/dependabot/28 ).
2026-10-21 11:19:10 -07:00
Alex Waygood and GitHub
5226eeb6a9
Update smol-toml to 1.9.1 ( #434 )
...
Update the locked `smol-toml` dependency from `1.6.1` to `1.9.1` in
`package-lock.json`. This addresses Dependabot alerts
[#75 ](https://github.com/astral-sh/ruff-action/security/dependabot/75 )
and
[#60 ](https://github.com/astral-sh/ruff-action/security/dependabot/60 ).
The checked-in action bundle includes the updated dependency.
2026-10-21 11:18:55 -07:00
Alex Waygood and GitHub
ea181cb604
Update undici to 6.29.0 ( #431 )
...
Update the locked `undici` dependency from `6.24.1` to `6.29.0` in
`package-lock.json`. This addresses Dependabot alert
[#64 ](https://github.com/astral-sh/ruff-action/security/dependabot/64 ),
among other alerts for this dependency. The checked-in action bundles
include the updated dependency.
2026-10-21 11:18:43 -07:00
Alex Waygood and GitHub
107126dd4d
Update @babel/core to 7.29.7 ( #433 )
...
Update the locked `@babel/core` dependency from `7.28.6` to `7.29.7` in
`package-lock.json`. This addresses Dependabot alert
[#36 ](https://github.com/astral-sh/ruff-action/security/dependabot/36 ).
The update also addresses alerts for
[browserslist](https://github.com/astral-sh/ruff-action/security/dependabot/57 )
and
[baseline-browser-mapping](https://github.com/astral-sh/ruff-action/security/dependabot/59 ).
2026-10-21 11:18:29 -07:00
Alex Waygood and GitHub
280e92ea43
Update brace-expansion dependencies ( #432 )
...
Update the locked `brace-expansion` dependencies to `1.1.21`, `2.1.7`,
and `5.0.12` in `package-lock.json`. This addresses Dependabot alerts
[#73 ](https://github.com/astral-sh/ruff-action/security/dependabot/73 ),
[#72 ](https://github.com/astral-sh/ruff-action/security/dependabot/72 ),
and
[#71 ](https://github.com/astral-sh/ruff-action/security/dependabot/71 ),
among other alerts for this dependency.
2026-10-21 11:18:16 -07:00
Alex Waygood and GitHub
be1f93951f
Update js-yaml dependencies ( #430 )
...
Update the locked `js-yaml` dependencies to `3.15.2` and `4.3.2` in
`package-lock.json`. This addresses Dependabot alerts
[#62 ](https://github.com/astral-sh/ruff-action/security/dependabot/62 )
and
[#61 ](https://github.com/astral-sh/ruff-action/security/dependabot/61 ),
among other alerts for this dependency.
2026-10-21 11:17:34 -07:00
Alex Waygood and GitHub
747ffb9220
Update handlebars to 4.7.10 ( #429 )
...
Update the locked `handlebars` dependency from `4.7.9` to `4.7.10` in
`package-lock.json`. This addresses Dependabot alerts
[#79 ](https://github.com/astral-sh/ruff-action/security/dependabot/79 ),
[#78 ](https://github.com/astral-sh/ruff-action/security/dependabot/78 ),
and
[#77 ](https://github.com/astral-sh/ruff-action/security/dependabot/77 ).
2026-10-21 11:17:02 -07:00
Kevin Stillhammer and GitHub
70c5336f5b
chore(deps): roll up dependency updates ( #428 )
...
## Summary
- Update CodeQL init, autobuild, and analyze to 4.37.6 (#417 , #418 ,
#419 ).
- Update actions/setup-node to 7.0.0 (#403 ).
- Update @actions/core to 3.0.1 (#405 ) and @types/node to 26.1.1 (#407 ).
- No changes needed for #354 , #317 , or #316 : their updates are already
represented on main.
- Exclude TypeScript #406 : TypeScript 7 breaks the current ts-jest,
which requires TypeScript <6.
## Validation
- `npm run all` passed: build, Biome, packaging, and all 99 tests across
7 suites.
- No generated bundle changes.
- `git diff --check` passed.
Refs: pi-session 01a15ec4-888a-73e1-9f84-da48940488a6
2026-10-21 14:13:48 +00:00
22ba4f8560
chore: update known checksums for 0.17.1 ( #427 )
...
chore: update known checksums for 0.17.1
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-10-16 09:13:49 +02:00
f2f46687ac
Verify npm dependency signatures before builds ( #426 )
...
## Summary
Supersedes #402 with its changes rebased onto current `main` and the
merge conflict resolved. The original PR is left unchanged.
- Run `npm audit signatures` after installation and before `npm run all`
in the test and checksum-update workflows.
- Preserve the current JSON checksum manifest path
(`src/download/checksum/known-checksums.json`).
- Verify registry signatures and available provenance attestations
without requiring every dependency to publish provenance.
Related: astral-sh/setup-uv#1027 adds the same verification; #401
separately hardens npm installation defaults.
## Validation
Using Node 24.19.0 (matching `.nvmrc`) and npm 11.10.0:
- `npm ci --ignore-scripts` passed (reports existing dependency
vulnerabilities; dependency files are unchanged).
- `npm audit signatures` passed: 547 registry signatures and 97
attestations verified.
- `npm run all` passed: 7 suites, 99 tests; no generated or formatting
changes.
- `actionlint` passed.
- `zizmor` reports the same 26 low-severity findings on this branch and
`main`, with no new findings.
- `git diff --check` passed.
Refs: pi-session 01a1399e-1a99-7314-9573-9a982ea1bb3f
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com >
2026-10-14 11:05:12 +02:00
a737711ea8
chore: update known checksums for 0.17.0 ( #425 )
...
chore: update known checksums for 0.17.0
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-10-10 06:50:00 +00:00
Charlie Marsh and GitHub
4307b3970e
Use macOS 15 runners for tests ( #424 )
...
We move the latest-version and specific-version test matrices from
`macos-14` to `macos-15` ahead of GitHub’s [October 5 brownout and
November 2, 2026
retirement](https://github.com/actions/runner-images/issues/13518 ).
2026-10-02 15:16:05 -05:00
8fc297008d
chore: update known checksums for 0.16.9/0.16.10 ( #423 )
...
chore: update known checksums for 0.16.10
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-10-02 08:47:15 +02:00
6776b96909
test: fix Windows path assertions ( #422 )
...
Amp-Thread-ID:
https://ampcode.com/threads/T-01a0af62-d8be-7209-b38b-950badf6ef76
Closes : #394
Co-authored-by: Amp <amp@ampcode.com >
2026-09-17 13:32:54 +00:00
cc56f639e4
chore: update known checksums for 0.16.8 ( #421 )
...
chore: update known checksums for 0.16.8
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-09-17 05:53:43 +00:00
3906fcf994
chore: update known checksums for 0.16.7 ( #420 )
...
chore: update known checksums for 0.16.7
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-09-11 06:31:56 +00:00
c890b57484
chore: update known checksums for 0.16.6 ( #416 )
...
chore: update known checksums for 0.16.6
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-09-04 07:37:34 +00:00
6f8f9a9d5f
chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.6.0 ( #404 )
...
Bumps
[release-drafter/release-drafter](https://github.com/release-drafter/release-drafter )
from 7.3.0 to 7.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/release-drafter/release-drafter/releases ">release-drafter/release-drafter's
releases</a>.</em></p>
<blockquote>
<h2>v7.6.0</h2>
<h1>What's Changed</h1>
<h2>New</h2>
<ul>
<li>feat: resolve release commitish refs to commit SHAs (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1649 ">#1649</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>feat: add new contributors list (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1645 ">#1645</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>feat: support pull request co-authors (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1646 ">#1646</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>feat: support per-key merge strategies in <code>_extends</code> (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1642 ">#1642</a>)
<a
href="https://github.com/ReneWerner87 "><code>@ReneWerner87</code></a>,
<a href="https://github.com/cchanche "><code>@cchanche</code></a>, <a
href="https://github.com/jetersen "><code>@jetersen</code></a></li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>fix: .github in legacy <code>_extends</code> refs (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1650 ">#1650</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>fix: normalize release target branch refs (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1648 ">#1648</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>fix: duplicate and skipped release contributors (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1644 ">#1644</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
</ul>
<h2>Maintenance</h2>
<ul>
<li>chore(deps): update dependency typescript to 7.0.2 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1667 ">#1667</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>ci(deps): update github/codeql-action digest to 7188fc3 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1654 ">#1654</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>ci(deps): update actions/stale digest to 1e223db (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1653 ">#1653</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update dependency <code>@types/node</code> to 24.13.3
(<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1661 ">#1661</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update vitest to 4.1.10 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1656 ">#1656</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update graphql-codegen (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1663 ">#1663</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update dependency vite to 8.1.4 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1662 ">#1662</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>chore(deps): update dependency nock to 14.0.16 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1655 ">#1655</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update dependency <code>@biomejs/biome</code> to 2.5.3
(<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1660 ">#1660</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>ci(deps): update actions/checkout action to v7.0.0 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1669 ">#1669</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>ci(deps): update actions/setup-node action to v7.0.0 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1670 ">#1670</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore: update generated GraphQL types (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1641 ">#1641</a>)
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a>,
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>fix(deps): update dependency graphql to 16.14.2 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1657 ">#1657</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>fix(deps): update dependency yaml to 2.9.0 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1666 ">#1666</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>fix(deps): update dependency semver to 7.8.5 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1659 ">#1659</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>fix(deps): update dependency ignore to 7.0.6 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1658 ">#1658</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>chore(deps): update dependency <code>@biomejs/biome</code> to 2.5.3
(<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1660 ">#1660</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/ReneWerner87 "><code>@ReneWerner87</code></a>
made their first contribution in <a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1642 ">#1642</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/release-drafter/release-drafter/compare/v7.5.1...v7.6.0 ">https://github.com/release-drafter/release-drafter/compare/v7.5.1...v7.6.0 </a></p>
<h2>v7.5.1</h2>
<h1>What's Changed</h1>
<h2>Bug Fixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/eada3c96a64734dd381cfbda23511034e328ddb0 "><code>eada3c9</code></a>
chore: release v7.6.0</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/4621843980a0844866eefbe4d5f92e680fce5d81 "><code>4621843</code></a>
migrate biome config</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/e9aeda788e59684f9fe90b4ca1a32f60f0b3bf29 "><code>e9aeda7</code></a>
chore(deps): update dependency typescript to 7.0.2 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1667 ">#1667</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/c943e7c8b72b3d6c5fab33cfd024317893d5c320 "><code>c943e7c</code></a>
fix(deps): update dependency graphql to 16.14.2 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1657 ">#1657</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/b9af92564053e016d0bf080da7c24704c159ee4e "><code>b9af925</code></a>
fix(deps): update dependency yaml to 2.9.0 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1666 ">#1666</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/f4aa1589c4bd889abd152b42a03071c0695716b8 "><code>f4aa158</code></a>
ci(deps): update github/codeql-action digest to 7188fc3 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1654 ">#1654</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/93973850c385e1ad1901d254003cf654b2fb7f4a "><code>9397385</code></a>
ci(deps): update actions/stale digest to 1e223db (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1653 ">#1653</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/5dd9f212bc0430df55c6f9b360720a2d08ddc157 "><code>5dd9f21</code></a>
chore(deps): update dependency <code>@types/node</code> to 24.13.3 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1661 ">#1661</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/903a9a10909a48b47c20e26c545bac26676d69cd "><code>903a9a1</code></a>
chore(deps): update vitest to 4.1.10 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1656 ">#1656</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/2796d1b6a0ad34872845939207b3af9aac1b346f "><code>2796d1b</code></a>
fix(deps): update dependency semver to 7.8.5 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1659 ">#1659</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/release-drafter/release-drafter/compare/c2e2804cc59f45f57076a99af580d0fedb697927...eada3c96a64734dd381cfbda23511034e328ddb0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 16:43:22 +05:30
eifinger-bot and GitHub
127e6a115e
Use JSON for known checksums ( #415 )
...
Ports the hardening from astral-sh/setup-uv#1025 to ruff-action.\n\nThis
stores generated checksums as JSON data behind a small typed TypeScript
wrapper, preventing values sourced from release metadata from being
mixed into generated executable code. It also updates the checksum
workflow and packaged action artifacts, and adds a regression test for
code-like keys and escaped checksum values.\n\nTests: npm run build, npm
run check, npm test, npm run package
2026-08-28 16:15:05 -04:00
6d5deb5cee
chore: update known checksums for 0.16.4/0.16.5 ( #412 )
...
chore: update known checksums for 0.16.5
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-08-28 07:54:42 +00:00
46b5b9699e
Enforce the npm version floor with legacy clients ( #411 )
...
`devEngines` is ignored by npm releases such as `10.8.2`, so those
clients can install dependencies without applying the seven-day
`min-release-age` setting added in #401 . Declare the same minimum in
`engines.npm` and enable `engine-strict` to make that legacy installer
requirement fatal. Keep `devEngines` for its earlier checks on newer npm
versions, and pin the build and checksum workflows to Node.js `24.19.0`
so their bundled `npm` supports the policy.
Related: astral-sh/setup-uv#1026 and astral-sh/ruff#27844 enforce the
same legacy-aware `npm` version floor. astral-sh/ruff-action#400 covers
Dependabot's update cooldown, and astral-sh/ruff-action#402 separately
verifies registry signatures and available provenance.
---------
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com >
2026-08-20 17:36:55 +02:00
848ccd1cb2
chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.6.0 ( #408 )
...
Bumps
[zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action )
from 0.5.6 to 0.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zizmorcore/zizmor-action/releases ">zizmorcore/zizmor-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.0</h2>
<p>zizmor 1.27.0 is now the default version used by the action.</p>
<h2>What's Changed</h2>
<ul>
<li>Fold Docker image pull output into a collapsed Actions log group by
<a href="https://github.com/woodruffw "><code>@woodruffw</code></a> with
<a href="https://github.com/Copilot "><code>@Copilot</code></a> in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/132 ">zizmorcore/zizmor-action#132</a></li>
<li>Readme: document missing inputs by <a
href="https://github.com/staabm "><code>@staabm</code></a> in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/130 ">zizmorcore/zizmor-action#130</a></li>
<li>ci: block version sync workflow on forks by <a
href="https://github.com/shaanmajid "><code>@shaanmajid</code></a> in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/129 ">zizmorcore/zizmor-action#129</a></li>
<li>Sync zizmor versions by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/137 ">zizmorcore/zizmor-action#137</a></li>
<li>Add <code>collect</code> input by <a
href="https://github.com/woodruffw "><code>@woodruffw</code></a> in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/139 ">zizmorcore/zizmor-action#139</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/woodruffw "><code>@woodruffw</code></a>
with <a href="https://github.com/Copilot "><code>@Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/132 ">zizmorcore/zizmor-action#132</a></li>
<li><a href="https://github.com/staabm "><code>@staabm</code></a> made
their first contribution in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/130 ">zizmorcore/zizmor-action#130</a></li>
<li><a
href="https://github.com/shaanmajid "><code>@shaanmajid</code></a> made
their first contribution in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/129 ">zizmorcore/zizmor-action#129</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/zizmorcore/zizmor-action/compare/v0.5.7...v0.6.0 ">https://github.com/zizmorcore/zizmor-action/compare/v0.5.7...v0.6.0 </a></p>
<h2>v0.5.7</h2>
<p>1.26.1 is now available via the action
1.26.1 is now the default version of zizmor used by the action</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/6599ee8b7a49aef6a770f63d261d214911a7ce02 "><code>6599ee8</code></a>
Add <code>collect</code> input (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/139 ">#139</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/bec05c80b8586b8cbc030450e4fa4e82b83a9427 "><code>bec05c8</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/137 ">#137</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/cf5954948fbc9d5b9460b774e281e3387b989ea6 "><code>cf59549</code></a>
Add issue templates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/135 ">#135</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/f72bf176f67e8007f87b16d80f9880ece648aa65 "><code>f72bf17</code></a>
chore(deps): bump github/codeql-action/upload-sarif (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/134 ">#134</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/b2a6fac1a76b42abf3794cd06cef23af2f13e590 "><code>b2a6fac</code></a>
ci: block version sync workflow on forks (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/129 ">#129</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/2d88f441dcd818e199d649f55e9a347196a52262 "><code>2d88f44</code></a>
Readme: document missing inputs (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/130 ">#130</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/d81e2769a6bdcb1d076bf52b5e7e663c881f94e7 "><code>d81e276</code></a>
Fold Docker image pull output into a collapsed Actions log group (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/132 ">#132</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/8c13c5382c13a16f7ece1f965891708b819d28b2 "><code>8c13c53</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/133 ">#133</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/2f8e9c6f609a49998258063502592a555c964847 "><code>2f8e9c6</code></a>
README: bump versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/128 ">#128</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/192e21d79ab29983730a13d1382995c2307fbcaa "><code>192e21d</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/127 ">#127</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/zizmorcore/zizmor-action/compare/5f14fd08f7cf1cb1609c1e344975f152c7ee938d...6599ee8b7a49aef6a770f63d261d214911a7ce02 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-20 09:02:44 +02:00
1f30a84c67
Harden npm install defaults ( #401 )
...
CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Add `.npmrc` defaults that disable those
scripts and apply the same seven-day `min-release-age` policy used by
`setup-uv`. Require npm `11.10.0` or newer through `devEngines` so older
versions cannot silently ignore the age setting. Explicit project
commands such as `npm run package` remain available.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com >
2026-08-18 19:12:36 +02:00
d3ef2489b0
Add a 30-day Dependabot cooldown ( #400 )
...
The repository has no explicit Dependabot cooldown, so routine updates
do not follow the 30-day policy used by `setup-uv`. Add
`cooldown.default-days: 30` for npm and GitHub Actions while retaining
the daily schedule. Dependabot security updates remain outside the
cooldown.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com >
2026-08-18 19:08:54 +02:00
81a72f25c9
chore: update known checksums for 0.16.3 ( #399 )
...
chore: update known checksums for 0.16.3
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-08-14 05:36:13 +00:00
2ce112e5ca
chore: update known checksums for 0.16.2 ( #398 )
...
chore: update known checksums for 0.16.2
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-08-09 08:26:38 +00:00
28ec38735d
chore: update known checksums for 0.16.1 ( #397 )
...
chore: update known checksums for 0.16.1
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-07-31 09:11:18 +02:00
project516 and GitHub
2957f9e73d
docs: unify ruff-action versions in README ( #396 )
2026-07-24 18:20:31 +00:00
5b168050b9
chore: update known checksums for 0.16.0 ( #395 )
...
chore: update known checksums for 0.16.0
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-07-24 06:30:28 +00:00
3bb5cd7c3c
chore: update known checksums for 0.15.22 ( #393 )
...
chore: update known checksums for 0.15.22
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-07-17 06:19:01 +00:00
8d2a42ddf5
chore: update known checksums for 0.15.21 ( #391 )
...
chore: update known checksums for 0.15.21
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-07-13 09:04:22 +02:00
Kevin Stillhammer and GitHub
278981a28c
Add option to skip Astral mirror downloads ( #387 )
...
## Summary
- add `download-from-astral-mirror` input defaulting to `true`
- skip mirror URL rewriting and download directly from GitHub Releases
when disabled
- document the input and add unit coverage
Fixes #384
Refs: pi-session 019f31bc-bd1c-7276-9b4e-9734fa0aa367
## Testing
- npm run build
- npm run check
- npm run test:unit
2026-07-05 10:17:44 +00:00
Kevin Stillhammer and GitHub
c35f46c92b
chore: roll up Dependabot updates ( #386 )
...
## Summary
- roll up remaining open Dependabot npm updates for @octokit/core and
@octokit/plugin-rest-endpoint-methods
- roll up remaining GitHub Actions pin updates for CodeQL, zizmor,
release-drafter, setup-node, and create-pull-request
- regenerate bundled dist files
## Validation
- npm run all
Refs: pi-session 019f31b8-93d9-7f9b-b3e9-5aaac6bab959
2026-07-05 12:04:11 +02:00
somaz and GitHub
f3db229c84
feat: support uv.lock as version-file ( #379 )
...
Adds `uv.lock` as a supported `version-file` format, alongside the
existing
`pyproject.toml` and `requirements.txt`. A `uv.lock` pins the exact
resolved
ruff version, so reading it gives a reproducible install that matches
the
project's lockfile — the single source of truth — instead of the
lower-bound /
range typically declared in `pyproject.toml`.
The parser reads the `[[package]]` entry whose `name` is `ruff` and
returns its
`version`. If ruff is absent or the file cannot be parsed, the action
warns and
falls back to `latest` (same behaviour as the other formats).
Validation:
- `npm run all` — tsc typecheck clean, biome clean, dist rebuilt, jest
65/65 pass
- Added unit tests (`__tests__/version/file-parser.test.ts`) + a
`uv.lock` fixture
- Added an integration job (`test-default-version-from-uv-lock`) that
runs the
action against the fixture and asserts ruff 0.9.5 is installed
closes #375
2026-07-05 11:56:05 +02:00
Kevin Stillhammer and GitHub
270e80dfe7
Fix wildcard src input ( #368 )
...
Fixes : #355
2026-07-05 11:55:02 +02:00
Kevin Stillhammer and GitHub
5fedeebdb3
Add Dependabot rollup skill ( #385 )
...
## Summary
- add the dependabot-pr-rollup skill copied from setup-uv
- adapt the workflow notes for ruff-action's npm and GitHub Actions
Dependabot updates
## Testing
- npm run all
Refs: pi-session 019f317d-08f2-7aac-a6d5-56a44288d94c
2026-07-05 11:49:16 +02:00
99fe79f472
chore: update known checksums for 0.15.20 ( #383 )
...
chore: update known checksums for 0.15.20
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-26 08:39:54 +02:00
32ad1b993e
chore: update known checksums for 0.15.19 ( #382 )
...
chore: update known checksums for 0.15.19
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-24 07:16:05 +00:00
f78e087041
chore: update known checksums for 0.15.18 ( #381 )
...
chore: update known checksums for 0.15.18
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-19 05:45:18 +00:00
2f88679623
chore: update known checksums for 0.15.17 ( #380 )
...
chore: update known checksums for 0.15.17
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-12 05:57:40 +00:00
b79a7ac759
chore: update known checksums for 0.15.16 ( #378 )
...
chore: update known checksums for 0.15.16
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-05 06:27:01 +00:00
30c0929868
chore: update known checksums for 0.15.15 ( #377 )
...
chore: update known checksums for 0.15.15
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-05-29 09:11:56 +00:00
b4bf7655a0
chore: update known checksums for 0.15.14 ( #376 )
...
chore: update known checksums for 0.15.14
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-05-22 05:57:48 +00:00
Frederick Wagner and GitHub
7f78e88b21
Use v4.0.0 in README.md ( #371 )
...
This change should reduce confusion from `@4` not working.
2026-05-20 13:18:52 +02:00
