Skip to content

Commit 6ccede2

Browse files
dependabot[bot]dependabot[bot]
authored
ci: bump the github-actions group across 1 directory with 10 updates (#54)
Bumps the github-actions group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [gradle/actions](https://github.com/gradle/actions) | `6.0.1` | `6.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` | | [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `3.0.0` | `3.1.0` | | [lewagon/wait-on-check-action](https://github.com/lewagon/wait-on-check-action) | `1.6.0` | `1.7.0` | | [googleapis/release-please-action](https://github.com/googleapis/release-please-action) | `4.4.0` | `5.0.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.2.3` | `4.1.0` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.1` | `3.0.0` | | [anchore/scan-action](https://github.com/anchore/scan-action) | `6.5.1` | `7.4.0` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.24.0` | `0.36.0` | Updates `gradle/actions` from 6.0.1 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gradle/actions/releases">gradle/actions's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>New: Basic Cache Provider</h2> <p>A new MIT-licensed <strong>Basic Caching</strong> provider is now available as an alternative to the proprietary <strong>Enhanced Caching</strong> provided by <code>gradle-actions-caching</code>. Choose Basic Caching by setting <code>cache-provider: basic</code> on <code>setup-gradle</code> or <code>dependency-submission</code> actions.</p> <ul> <li>Built on <code>@actions/cache</code> -- fully open source</li> <li>Caches <code>~/.gradle/caches</code> and <code>~/.gradle/wrapper</code> directories</li> <li>Cache key derived from build files (<code>*.gradle*</code>, <code>gradle-wrapper.properties</code>, etc.)</li> <li>Clean cache on build file changes (no restore keys, preventing stale entry accumulation)</li> </ul> <p><strong>Limitations vs Enhanced Caching:</strong> No cache cleanup, no deduplication of cached content, cached content is fixed unless build files change.</p> <h2>Revamped Licensing &amp; Distribution Documentation</h2> <ul> <li>New <strong>DISTRIBUTION.md</strong> documents the licensing of each component (particularly Basic Caching vs Enhanced Caching)</li> <li>Simplified licensing notices in README, docs, and runtime log output</li> <li>Clear usage tiers: Enhanced Caching is free for public repos and in Free Preview for private repos</li> </ul> <h2>What's Changed</h2> <ul> <li>Use a unique cache entry for wrapper-validation test by <a href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/921">gradle/actions#921</a></li> <li>Update Dependencies by <a href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/922">gradle/actions#922</a></li> <li>Update dependencies and resolve npm vulnerabilities by <a href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/933">gradle/actions#933</a></li> <li>Add open-source 'basic' cache provider and revamp licensing documentation by <a href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/930">gradle/actions#930</a></li> <li>Restructure caching documentation for basic and enhanced providers by <a href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/934">gradle/actions#934</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/gradle/actions/compare/v6.0.1...v6.1.0">https://github.com/gradle/actions/compare/v6.0.1...v6.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gradle/actions/commit/50e97c2cd7a37755bbfafc9c5b7cafaece252f6e"><code>50e97c2</code></a> Link to docs for caching providers</li> <li><a href="https://github.com/gradle/actions/commit/f2e6298504c4b1f20294637059e1d0d89422409a"><code>f2e6298</code></a> Restructure caching documentation for basic and enhanced providers (<a href="https://redirect.github.com/gradle/actions/issues/934">#934</a>)</li> <li><a href="https://github.com/gradle/actions/commit/b294b1e2dbcf270bfe835590dedbbc7e2024618c"><code>b294b1e</code></a> Really fix integ-test-full</li> <li><a href="https://github.com/gradle/actions/commit/83d3189aae3332f1b2235b42d8804258f2348213"><code>83d3189</code></a> Revise license details for gradle-actions-caching</li> <li><a href="https://github.com/gradle/actions/commit/1d5db06d2662829845876553d61cf3df3cf997d1"><code>1d5db06</code></a> Update license link for gradle-actions-caching component</li> <li><a href="https://github.com/gradle/actions/commit/1c809615505fae9768e2610dc6dbecdc3a796443"><code>1c80961</code></a> Fix license link for Enhanced Caching component</li> <li><a href="https://github.com/gradle/actions/commit/9e99920b14b9dc5a9bf8c72e94ba47ebf5bbaee6"><code>9e99920</code></a> Fix integ-test-full workflow</li> <li><a href="https://github.com/gradle/actions/commit/bb8aaaf9d56f25afd4a90925425facf294f31fcf"><code>bb8aaaf</code></a> Fix workflow permissions</li> <li><a href="https://github.com/gradle/actions/commit/f5dfb43fc8c99c758ebf2324d102118e5faf6cb6"><code>f5dfb43</code></a> [bot] Update dist directory</li> <li><a href="https://github.com/gradle/actions/commit/ff9ae24c39252301b448088d2c7d9f0a2d8066dd"><code>ff9ae24</code></a> Add open-source 'basic' cache provider and revamp licensing documentation (<a href="https://redirect.github.com/gradle/actions/issues/930">#930</a>)</li> <li>Additional commits viewable in <a href="https://github.com/gradle/actions/compare/39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f...50e97c2cd7a37755bbfafc9c5b7cafaece252f6e">compare view</a></li> </ul> </details> <br /> Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update the readme with direct upload details by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li> <li>Readme: bump all the example versions to v7 by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li> <li>Include changes in typespec/ts-http-runtime 0.3.5 by <a href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a> from actions/yacaovsnc/update-dependency</li> <li><a href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a> Include changes in typespec/ts-http-runtime 0.3.5</li> <li><a href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a> Readme: bump all the example versions to v7 (<a href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a> Update the readme with direct upload details (<a href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li> <li>See full diff in <a href="https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action` from 4.35.1 to 4.35.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.35.2</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.35.2 - 15 Apr 2026</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>4.35.1 - 27 Mar 2026</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>4.35.0 - 27 Mar 2026</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <h2>4.34.1 - 20 Mar 2026</h2> <ul> <li>Downgrade default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a> due to issues with a small percentage of Actions and JavaScript analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li> </ul> <h2>4.34.0 - 20 Mar 2026</h2> <ul> <li>Added an experimental change which disables TRAP caching when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li> <li>We are rolling out improved incremental analysis to C/C++ analyses that use build mode <code>none</code>. We expect this rollout to be complete by the end of April 2026. <a href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li> </ul> <h2>4.33.0 - 16 Mar 2026</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type &quot;True/false&quot;, then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using advanced setup:</strong> Set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> <li> <p>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a &quot;Multi select&quot; repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p> </li> <li> <p>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p> </li> <li> <p>Once <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a> can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. <a href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p> </li> <li> <p>Fixed the retry mechanism for database uploads. Previously this would fail with the error &quot;Response body object should not be disturbed or locked&quot;. <a href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p> </li> <li> <p>A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p> </li> </ul> <h2>4.32.6 - 05 Mar 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/95e58e9a2cdfd71adc6e0353d5c52f41a045d225"><code>95e58e9</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3824">#3824</a> from github/update-v4.35.2-d2e135a73</li> <li><a href="https://github.com/github/codeql-action/commit/6f31bfe060e817d81e938dbec767969d20031e25"><code>6f31bfe</code></a> Update changelog for v4.35.2</li> <li><a href="https://github.com/github/codeql-action/commit/d2e135a73a39154e3a231aeb49163c4661c5b8b1"><code>d2e135a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3823">#3823</a> from github/update-bundle/codeql-bundle-v2.25.2</li> <li><a href="https://github.com/github/codeql-action/commit/60abb65df09fcf213c398e064c8a80db1f15cdaf"><code>60abb65</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/5a0a562209255e956ad8aafcee303294e64eefa2"><code>5a0a562</code></a> Update default bundle to codeql-bundle-v2.25.2</li> <li><a href="https://github.com/github/codeql-action/commit/65216971a11ded447a6b76263d5a144519e5eee1"><code>6521697</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3820">#3820</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/3c45af2dd258e1623af1898da5c86545b514e028"><code>3c45af2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3821">#3821</a> from github/dependabot/npm_and_yarn/npm-minor-345b93...</li> <li><a href="https://github.com/github/codeql-action/commit/f1c339364c12f922998186ed897e45e3b4ae8874"><code>f1c3393</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/1024fc496c87e944a93e98d8cf2c09e2c7602a30"><code>1024fc4</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/9dd4cfed96030ccdfe1af4daf7a7964322704fed"><code>9dd4cfe</code></a> Bump the npm-minor group across 1 directory with 6 updates</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225">compare view</a></li> </ul> </details> <br /> Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dependabot/fetch-metadata/releases">dependabot/fetch-metadata's releases</a>.</em></p> <blockquote> <h2>v3.1.0</h2> <h2>What's Changed</h2> <ul> <li>Add permissions to all workflows by <a href="https://github.com/truggeri"><code>@​truggeri</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/687">dependabot/fetch-metadata#687</a></li> <li>build(deps-dev): bump globals from 16.0.0 to 17.4.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/690">dependabot/fetch-metadata#690</a></li> <li>build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/693">dependabot/fetch-metadata#693</a></li> <li>build(deps-dev): bump <code>@​hono/node-server</code> from 1.19.10 to 1.19.13 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/694">dependabot/fetch-metadata#694</a></li> <li>build(deps-dev): bump hono from 4.12.7 to 4.12.12 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/695">dependabot/fetch-metadata#695</a></li> <li>Dynamically update the tracking tag in action by <a href="https://github.com/truggeri"><code>@​truggeri</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/696">dependabot/fetch-metadata#696</a></li> <li>fix: handle duplicate dependency names in parseMetadataLinks by <a href="https://github.com/devantler"><code>@​devantler</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/700">dependabot/fetch-metadata#700</a></li> <li>fix: remove $ anchor from updateFragment regex to handle pip directory suffixes by <a href="https://github.com/devantler"><code>@​devantler</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/698">dependabot/fetch-metadata#698</a></li> <li>Updates to README for permissions clarification by <a href="https://github.com/truggeri"><code>@​truggeri</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/697">dependabot/fetch-metadata#697</a></li> <li>fix: resolve update-type null for Python, Composer, and Terraform PRs by <a href="https://github.com/vitorsdcs"><code>@​vitorsdcs</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/704">dependabot/fetch-metadata#704</a></li> <li>build(deps-dev): bump globals from 17.4.0 to 17.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/703">dependabot/fetch-metadata#703</a></li> <li>build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/701">dependabot/fetch-metadata#701</a></li> <li>build(deps): bump <code>@​actions/github</code> from 9.0.0 to 9.1.0 in the dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/702">dependabot/fetch-metadata#702</a></li> <li>build(deps-dev): bump hono from 4.12.12 to 4.12.14 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/705">dependabot/fetch-metadata#705</a></li> <li>v3.1.0 by <a href="https://github.com/fetch-metadata-action-automation"><code>@​fetch-metadata-action-automation</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/692">dependabot/fetch-metadata#692</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/devantler"><code>@​devantler</code></a> made their first contribution in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/700">dependabot/fetch-metadata#700</a></li> <li><a href="https://github.com/vitorsdcs"><code>@​vitorsdcs</code></a> made their first contribution in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/704">dependabot/fetch-metadata#704</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dependabot/fetch-metadata/compare/v3...v3.1.0">https://github.com/dependabot/fetch-metadata/compare/v3...v3.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dependabot/fetch-metadata/commit/25dd0e34f4fe68f24cc83900b1fe3fe149efef98"><code>25dd0e3</code></a> v3.1.0 (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/692">#692</a>)</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/e073f50d732cb48d48fb80afedb4fa61361626e9"><code>e073f50</code></a> Merge pull request <a href="https://redirect.github.com/dependabot/fetch-metadata/issues/705">#705</a> from dependabot/dependabot/npm_and_yarn/hono-4.12.14</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/0670e167df1fbee1b0d07121de6a182ddebdd674"><code>0670e16</code></a> build(deps-dev): bump hono from 4.12.12 to 4.12.14</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/7a7fe10a42310e65df80af6c771e9aa5d59842d1"><code>7a7fe10</code></a> Merge pull request <a href="https://redirect.github.com/dependabot/fetch-metadata/issues/702">#702</a> from dependabot/dependabot/npm_and_yarn/dependencies-...</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/5168191cea3d4daa635bff6c796b4f0faeba522d"><code>5168191</code></a> Updating dist build</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/23882e175b2f16bc495c89aa50940399c6a17504"><code>23882e1</code></a> build(deps): bump <code>@​actions/github</code> in the dependencies group</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/1072469591c13fda1d8dba1d1ac2e80187e247d7"><code>1072469</code></a> Merge pull request <a href="https://redirect.github.com/dependabot/fetch-metadata/issues/701">#701</a> from dependabot/dependabot/github_actions/actions/cre...</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/43f8a0055c8e32587be67e097dff89a6823c9752"><code>43f8a00</code></a> build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/b4d904a50935c8ebe744da148ea8a18a43fe72e1"><code>b4d904a</code></a> Merge pull request <a href="https://redirect.github.com/dependabot/fetch-metadata/issues/703">#703</a> from dependabot/dependabot/npm_and_yarn/globals-17.5.0</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/c8046bb877d9989cc848797de1b944bc3e93ef82"><code>c8046bb</code></a> build(deps-dev): bump globals from 17.4.0 to 17.5.0</li> <li>Additional commits viewable in <a href="https://github.com/dependabot/fetch-metadata/compare/ffa630c65fa7e0ecfa0625b5ceda64399aea1b36...25dd0e34f4fe68f24cc83900b1fe3fe149efef98">compare view</a></li> </ul> </details> <br /> Updates `lewagon/wait-on-check-action` from 1.6.0 to 1.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lewagon/wait-on-check-action/releases">lewagon/wait-on-check-action's releases</a>.</em></p> <blockquote> <h2>v1.7.0</h2> <h3>Fixed</h3> <ul> <li>Fix the failure exit codes (<a href="https://redirect.github.com/lewagon/wait-on-check-action/issues/147">#147</a>)</li> </ul> <h2>v1.6.1</h2> <h3>Added</h3> <ul> <li>Pin the <code>ruby/setup-ruby</code> version (<a href="https://redirect.github.com/lewagon/wait-on-check-action/issues/143">#143</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lewagon/wait-on-check-action/blob/master/CHANGELOG.md">lewagon/wait-on-check-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>Unreleased</h2> <h2>v1.7.0 - 2026-04-14</h2> <h3>Fixed</h3> <ul> <li>Fix the failure exit codes</li> </ul> <h2>v1.6.1 - 2026-04-06</h2> <h3>Added</h3> <ul> <li>Pin the <code>ruby/setup-ruby</code> version</li> </ul> <h2>v1.6.0 - 2026-03-29</h2> <h3>Added</h3> <ul> <li>Add <code>checks-discovery-timeout</code> option</li> </ul> <h2>v1.5.0 - 2026-01-25</h2> <h3>Added</h3> <ul> <li>Add <code>fail-on-no-checks</code> option</li> </ul> <h3>Fixed</h3> <ul> <li>Bump <code>rexml</code> to 3.4.2</li> </ul> <h2>v1.4.1 - 2025-09-21</h2> <h3>Fixed</h3> <ul> <li>Linux ARM64 support</li> </ul> <h2>v1.4.0 - 2025-06-27</h2> <h3>Added</h3> <ul> <li>Add class docs</li> <li>Add <code>frozen_string_literal</code> comments</li> </ul> <h3>Removed</h3> <ul> <li>Remove OpenStruct instances</li> <li>Remove Double quotes</li> <li>Remove Double assertions</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lewagon/wait-on-check-action/commit/9312864dfbc9fd208e9c0417843430751c042800"><code>9312864</code></a> Bump version: 1.6.1 → 1.7.0</li> <li><a href="https://github.com/lewagon/wait-on-check-action/commit/51f09d0086cf7d999b3d2832082fa1d51132a229"><code>51f09d0</code></a> Add v1.7.0 changelog notes (<a href="https://redirect.github.com/lewagon/wait-on-check-action/issues/148">#148</a>)</li> <li><a href="https://github.com/lewagon/wait-on-check-action/commit/be22c849d2efb61b32ca0263015cab85c016d0fb"><code>be22c84</code></a> fix: exit with non-zero status when check conclusions are disallowed (<a href="https://redirect.github.com/lewagon/wait-on-check-action/issues/147">#147</a>)</li> <li><a href="https://github.com/lewagon/wait-on-check-action/commit/78dd4dd5d9b337c14c3c81f79e53bf7d222435c1"><code>78dd4dd</code></a> Bump version: 1.6.0 → 1.6.1</li> <li><a href="https://github.com/lewagon/wait-on-check-action/commit/0b3a86ba5893e93383532733bfe337b12dd02312"><code>0b3a86b</code></a> Add v1.6.1 changelog notes (<a href="https://redirect.github.com/lewagon/wait-on-check-action/issues/144">#144</a>)</li> <li><a href="https://github.com/lewagon/wait-on-check-action/commit/b6990d00040802aa083d99c446e0663a9ab27d13"><code>b6990d0</code></a> Pin ruby/setup-ruby to the v1.299.0 sha (<a href="https://redirect.github.com/lewagon/wait-on-check-action/issues/143">#143</a>)</li> <li>See full diff in <a href="https://github.com/lewagon/wait-on-check-action/compare/a08fbe2b86f9336198f33be6ad9c16b96f92799c...9312864dfbc9fd208e9c0417843430751c042800">compare view</a></li> </ul> </details> <br /> Updates `googleapis/release-please-action` from 4.4.0 to 5.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/release-please-action/releases">googleapis/release-please-action's releases</a>.</em></p> <blockquote> <h2>v5.0.0</h2> <h2><a href="https://github.com/googleapis/release-please-action/compare/v4.4.1...v5.0.0">5.0.0</a> (2026-04-22)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>upgrade to node24 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1188">#1188</a>)</li> </ul> <h3>Features</h3> <ul> <li>upgrade to node24 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1188">#1188</a>) (<a href="https://github.com/googleapis/release-please-action/commit/46dfc01594fc6ec99626bc73e479c52bdf554f88">46dfc01</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>bump release-please from 17.3.0 to 17.6.0 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1199">#1199</a>) (<a href="https://github.com/googleapis/release-please-action/commit/f533c26b74c2778db7edc90c96b63a7d08035765">f533c26</a>)</li> </ul> <h2>v4.4.1</h2> <h2><a href="https://github.com/googleapis/release-please-action/compare/v4.4.0...v4.4.1">4.4.1</a> (2026-02-20)</h2> <h3>Bug Fixes</h3> <ul> <li>bump release-please from 17.1.3 to 17.3.0 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1183">#1183</a>) (<a href="https://github.com/googleapis/release-please-action/commit/ef9c2745dbfb629d38ebfafa3347a81ab2d51409">ef9c274</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md">googleapis/release-please-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2><a href="https://github.com/googleapis/release-please-action/compare/v4.4.1...v5.0.0">5.0.0</a> (2026-04-22)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>upgrade to node24 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1188">#1188</a>)</li> </ul> <h3>Features</h3> <ul> <li>upgrade to node24 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1188">#1188</a>) (<a href="https://github.com/googleapis/release-please-action/commit/46dfc01594fc6ec99626bc73e479c52bdf554f88">46dfc01</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>bump release-please from 17.3.0 to 17.6.0 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1199">#1199</a>) (<a href="https://github.com/googleapis/release-please-action/commit/f533c26b74c2778db7edc90c96b63a7d08035765">f533c26</a>)</li> </ul> <h2><a href="https://github.com/googleapis/release-please-action/compare/v4.4.0...v4.4.1">4.4.1</a> (2026-02-20)</h2> <h3>Bug Fixes</h3> <ul> <li>bump release-please from 17.1.3 to 17.3.0 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1183">#1183</a>) (<a href="https://github.com/googleapis/release-please-action/commit/ef9c2745dbfb629d38ebfafa3347a81ab2d51409">ef9c274</a>)</li> </ul> <h2><a href="https://github.com/googleapis/release-please-action/compare/v4.3.0...v4.4.0">4.4.0</a> (2025-10-09)</h2> <h3>Features</h3> <ul> <li>add ability to select versioning-strategy and release-as (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1121">#1121</a>) (<a href="https://github.com/googleapis/release-please-action/commit/ee0f5bae453367755be0c4340193531b3f538374">ee0f5ba</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><code>changelog-host</code> parameter ignored when using manifest configuration (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1151">#1151</a>) (<a href="https://github.com/googleapis/release-please-action/commit/535c4130c1030110bdacd1b3076f98c046c3a227">535c413</a>)</li> <li>bump mocha from 11.7.1 to 11.7.2 in the npm_and_yarn group across 1 directory (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1149">#1149</a>) (<a href="https://github.com/googleapis/release-please-action/commit/3612a99d75bd7a010bb03d6e2ee3e2392b7392fb">3612a99</a>)</li> <li>bump release-please from 17.1.2 to 17.1.3 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1158">#1158</a>) (<a href="https://github.com/googleapis/release-please-action/commit/66fbfe9439cb7a3660ecdc00d42573ef0bd00764">66fbfe9</a>)</li> </ul> <h2><a href="https://github.com/googleapis/release-please-action/compare/v4.2.0...v4.3.0">4.3.0</a> (2025-08-20)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> update release-please to 17.1.2 (<a href="https://github.com/googleapis/release-please-action/commit/f07192c046b10acd083f4665a3d8b6350526f9df">f07192c</a>)</li> </ul> <h2><a href="https://github.com/googleapis/release-please-action/compare/v4.1.5...v4.2.0">4.2.0</a> (2025-03-07)</h2> <h3>Features</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/release-please-action/commit/45996ed1f6d02564a971a2fa1b5860e934307cf7"><code>45996ed</code></a> chore(main): release 5.0.0 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1200">#1200</a>)</li> <li><a href="https://github.com/googleapis/release-please-action/commit/a8121b99c9779b09ad890de46417b7cad74eb3a2"><code>a8121b9</code></a> chore: build dist (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1201">#1201</a>)</li> <li><a href="https://github.com/googleapis/release-please-action/commit/f533c26b74c2778db7edc90c96b63a7d08035765"><code>f533c26</code></a> fix: bump release-please from 17.3.0 to 17.6.0 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1199">#1199</a>)</li> <li><a href="https://github.com/googleapis/release-please-action/commit/46dfc01594fc6ec99626bc73e479c52bdf554f88"><code>46dfc01</code></a> feat!: upgrade to node24 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1188">#1188</a>)</li> <li><a href="https://github.com/googleapis/release-please-action/commit/5c625bfb5d1ff62eadeeb3772007f7f66fdcf071"><code>5c625bf</code></a> chore(main): release 4.4.1 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1187">#1187</a>)</li> <li><a href="https://github.com/googleapis/release-please-action/commit/8bb7a2ed0f90c9802c83129a9488d235a1f31a7c"><code>8bb7a2e</code></a> chore: build dist (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1186">#1186</a>)</li> <li><a href="https://github.com/googleapis/release-please-action/commit/ef9c2745dbfb629d38ebfafa3347a81ab2d51409"><code>ef9c274</code></a> fix: bump release-please from 17.1.3 to 17.3.0 (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1183">#1183</a>)</li> <li><a href="https://github.com/googleapis/release-please-action/commit/64d83e95d898ede84e4555719aba555c3244d469"><code>64d83e9</code></a> docs(README): add missing action inputs + package options (<a href="https://redirect.github.com/googleapis/release-please-action/issues/1176">#1176</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/release-please-action/compare/16a9c90856f42705d54a6fda1823352bdc62cf38...45996ed1f6d02564a971a2fa1b5860e934307cf7">compare view</a></li> </ul> </details> <br /> Updates `actions/attest-build-provenance` from 2.2.3 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/attest-build-provenance/releases">actions/attest-build-provenance's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <blockquote> <p>[!NOTE] As of version 4, <code>actions/attest-build-provenance</code> is simply a wrapper on top of <a href="https://github.com/actions/attest"><code>actions/attest</code></a>.</p> <p>Existing applications may continue to use the <code>attest-build-provenance</code> action, but new implementations should use <code>actions/attest</code> instead.</p> </blockquote> <h2>What's Changed</h2> <ul> <li>Update RELEASE.md docs by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/836">actions/attest-build-provenance#836</a></li> <li>Bump <code>actions/attest</code> from 4.0.0 to 4.1.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/838">actions/attest-build-provenance#838</a> <ul> <li>Bump <code>@actions/attest</code> from 3.0.0 to 3.1.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/362">actions/attest#362</a></li> <li>Bump <code>@actions/attest</code> from 3.1.0 to 3.2.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/365">actions/attest#365</a></li> <li>Add new <code>subject-version</code> input for inclusion in storage record by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/364">actions/attest#364</a></li> <li>Add storage record content to README by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/366">actions/attest#366</a></li> </ul> </li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0">https://github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0</a></p> <h2>v4.0.0</h2> <blockquote> <p>[!NOTE] As of version 4, <code>actions/attest-build-provenance</code> is simply a wrapper on top of <a href="https://github.com/actions/attest"><code>actions/attest</code></a>.</p> <p>Existing applications may continue to use the <code>attest-build-provenance</code> action, but new implementations should use <code>actions/attest</code> instead.</p> </blockquote> <h2>What's Changed</h2> <ul> <li>Prepare v4 release by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/835">actions/attest-build-provenance#835</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0">https://github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0</a></p> <h2>v3.2.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@​actions/core</code> from 1.11.1 to 2.0.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/776">actions/attest-build-provenance#776</a></li> <li>Add more documentation on Artifact Metadata Storage Records by <a href="https://github.com/malancas"><code>@​malancas</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/797">actions/attest-build-provenance#797</a></li> <li>Update actions/attest to latest version v3.2.0 by <a href="https://github.com/malancas"><code>@​malancas</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/812">actions/attest-build-provenance#812</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0">https://github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0</a></p> <h2>v3.1.0</h2> <h2>What's Changed</h2> <ul> <li>Prepare v3 release by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/697">actions/attest-build-provenance#697</a></li> <li>Bump js-yaml from 3.14.1 to 3.14.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/749">actions/attest-build-provenance#749</a></li> <li>Bump tar from 7.5.1 to 7.5.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/753">actions/attest-build-provenance#753</a></li> <li>Bump glob from 10.4.5 to 10.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/754">actions/attest-build-provenance#754</a></li> <li>Bump <code>@​types/node</code> from 24.10.1 to 25.0.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/774">actions/attest-build-provenance#774</a></li> <li>Bump <code>@​actions/attest</code> from 1.6.0 to 2.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/736">actions/attest-build-provenance#736</a></li> <li>Bump <code>@​actions/attest</code> from 2.0.0 to 2.1.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/775">actions/attest-build-provenance#775</a></li> <li>Add support for creating artifact metadata storage records by <a href="https://github.com/malancas"><code>@​malancas</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/779">actions/attest-build-provenance#779</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/attest-build-provenance/commit/a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32"><code>a2bbfa2</code></a> bump actions/attest from 4.0.0 to 4.1.0 (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/838">#838</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/0856891a35570e4ac506b510f0358a4308f82385"><code>0856891</code></a> update RELEASE.md docs (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/836">#836</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/e4d4f7c39adfa4c260fb5c147f0622000aa14b99"><code>e4d4f7c</code></a> prepare v4 release (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/835">#835</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/02a49bdc410a809733602220c6f6275925d6b578"><code>02a49bd</code></a> Bump github/codeql-action in the actions-minor group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/824">#824</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/7c757df4145fcd233331998e58b20b422c833a00"><code>7c757df</code></a> Bump the npm-development group with 2 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/825">#825</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/c44148e5bf178192efd8947e07a0d439a356c60b"><code>c44148e</code></a> Bump github/codeql-action in the actions-minor group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/818">#818</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/32343527f2ec94583cf7b31280de0f60dc9f0bf9"><code>3234352</code></a> Bump <code>@​types/node</code> from 25.0.10 to 25.2.0 in the npm-development group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/819">#819</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/18db12979d4cecda10c1cf295bcb159f3e59866d"><code>18db129</code></a> Bump tar from 7.5.6 to 7.5.7 (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/816">#816</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/90fadfae6ba2e2ef59f8d38e61ec3cf16443a18e"><code>90fadfa</code></a> Bump <code>@​actions/core</code> from 2.0.1 to 2.0.2 in the npm-production group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/799">#799</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/57db8ba356515a4c8608990f2aa27a6972235ccc"><code>57db8ba</code></a> Bump the npm-development group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/808">#808</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/attest-build-provenance/compare/c074443f1aee8d4aeeae555aebba3282517141b2...a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32">compare view</a></li> </ul> </details> <br /> Updates `softprops/action-gh-release` from 2.6.1 to 3.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/releases">softprops/action-gh-release's releases</a>.</em></p> <blockquote> <h2>v3.0.0</h2> <p><code>3.0.0</code> is a major release that moves the action runtime from Node 20 to Node 24. Use <code>v3</code> on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on <code>v2.6.2</code>.</p> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>Move the action runtime and bundle target to Node 24</li> <li>Update <code>@types/node</code> to the Node 24 line and allow future Dependabot updates</li> <li>Keep the floating major tag on <code>v3</code>; <code>v2</code> remains pinned to the latest <code>2.x</code> release</li> </ul> <h2>v2.6.2</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): bump picomatch from 4.0.3 to 4.0.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/775">softprops/action-gh-release#775</a></li> <li>chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/777">softprops/action-gh-release#777</a></li> <li>chore(deps): bump vite from 8.0.0 to 8.0.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/781">softprops/action-gh-release#781</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/softprops/action-gh-release/compare/v2...v2.6.2">https://github.com/softprops/action-gh-release/compare/v2...v2.6.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md">softprops/action-gh-release's changelog</a>.</em></p> <blockquote> <h2>3.0.0</h2> <p><code>3.0.0</code> is a major release that moves the action runtime from Node 20 to Node 24. Use <code>v3</code> on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on <code>v2.6.2</code>.</p> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>Move the action runtime and bundle target to Node 24</li> <li>Update <code>@types/node</code> to the Node 24 line and allow future Dependabot updates</li> <li>Keep the floating major tag on <code>v3</code>; <code>v2</code> remains pinned to the latest <code>2.x</code> release</li> </ul> <h2>2.6.2</h2> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): bump picomatch from 4.0.3 to 4.0.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/775">softprops/action-gh-release#775</a></li> <li>chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/777">softprops/action-gh-release#777</a></li> <li>chore(deps): bump vite from 8.0.0 to 8.0.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/781">softprops/action-gh-release#781</a></li> </ul> <h2>2.6.1</h2> <p><code>2.6.1</code> is a patch release focused on restoring linked discussion thread creation when <code>discussion_category_name</code> is set. It fixes <code>[#764](https://github.com/softprops/action-gh-release/issues/764)</code>, where the draft-first publish flow stopped carrying the discussion category through the final publish step.</p> <p>If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.</p> <h2>What's Changed</h2> <h3>Bug fixes 🐛</h3> <ul> <li>fix: preserve discussion category on publish by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/765">softprops/action-gh-release#765</a></li> </ul> <h2>2.6.0</h2> <p><code>2.6.0</code> is a minor release centered on <code>previous_tag</code> support for <code>generate_release_notes</code>, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a <code>working_directory</code> docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.</p> <p>If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.</p> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/softprops/action-gh-release/commit/b4309332981a82ec1c5618f44dd2e27cc8bfbfda"><code>b430933</code></a> release: cut v3.0.0 for Node 24 upgrade (<a href="https://redirect.github.com/softprops/action-gh-release/issues/670">#670</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/c2e35e05a74208bafbfcbdae5ebc9da7236e980f"><code>c2e35e0</code></a> chore(deps): bump the npm group across 1 directory with 7 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/783">#783</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/3bb12739c298aeb8a4eeaf626c5b8d85266b0e65"><code>3bb1273</code></a> release 2.6.2</li> <li><a href="https://github.com/softprops/action-gh-release/commit/c34030fec99b0db0f2f22ce7806c445dddb6e224"><code>c34030f</code></a> chore: bump node to 24.14.1</li> <li><a href="https://github.com/softprops/action-gh-release/commit/8975bd05c0630603edb0dca2fc7544bf1c77f600"><code>8975bd0</code></a> chore(deps): bump vite from 8.0.0 to 8.0.5 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/781">#781</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/f71937f44d5662ac6eb861431746174a7b46a7b6"><code>f71937f</code></a> chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/777">#777</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/3f0d239d58d5c226738ec0a08d0465b548dc026f"><code>3f0d239</code></a> chore(deps): bump picomatch from 4.0.3 to 4.0.4 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/775">#775</a>)</li> <li>See full diff in <a href="https://github.com/softprops/action-gh-release/compare/153bb8e04406b158c6c84fc1615b65b24149a1fe...b4309332981a82ec1c5618f44dd2e27cc8bfbfda">compare view</a></li> </ul> </details> <br /> Updates `anchore/scan-action` from 6.5.1 to 7.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anchore/scan-action/releases">anchore/scan-action's releases</a>.</em></p> <blockquote> <h2>v7.4.0</h2> <ul> <li>chore: update to node 24 (<a href="https://redirect.github.com/anchore/scan-action/issues/629">#629</a>) [<a href="https://github.com/kzantow"><code>@​kzantow</code></a>]</li> <li>fix(dev): move to esbuild (<a href="https://redirect.github.com/anchore/scan-action/issues/601">#601</a>) [<a href="https://github.com/willmurphyscode"><code>@​willmurphyscode</code></a>]</li> <li>chore: update to ES modules + update <code>@actions/*</code> (<a href="https://redirect.github.com/anchore/scan-action/issues/595">#595</a>) [<a href="https://github.com/kzantow"><code>@​kzantow</code></a>]</li> </ul> <h2>⬆️ Dependencies</h2> <ul> <li>chore(deps): update Grype to v0.110.0 (<a href="https://redirect.github.com/anchore/scan-action/issues/618">#618</a>) [@<a href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>]</li> <li>chore(deps-dev): bump tar 7.5.11 (<a href="https://redirect.github.com/anchore/scan-action/issues/620">#620</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> <li>chore(deps): bump undici 6.24.1 (<a href="https://redirect.github.com/anchore/scan-action/issues/622">#622</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> <li>chore: bump fast-xml-parser 5.5.7 (<a href="https://redirect.github.com/anchore/scan-action/issues/626">#626</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> </ul> <h2>v7.3.2</h2> <ul> <li>feat: add option to specify one or more grype config files (<a href="https://redirect.github.com/anchore/scan-action/issues/589">#589</a>) [<a href="https://github.com/sam-super"><code>@​sam-super</code></a>]</li> </ul> <h2>⬆️ Dependencies</h2> <ul> <li>chore(deps): bump <code>@​actions/cache</code> from 5.0.3 to 5.0.5 (<a href="https://redirect.github.com/anchore/scan-action/issues/592">#592</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> <li>chore(deps): bump <code>@​actions/tool-cache</code> from 3.0.0 to 3.0.1 (<a href="https://redirect.github.com/anchore/scan-action/issues/593">#593</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> <li>chore(deps): update Grype to v0.107.1 (<a href="https://redirect.github.com/anchore/scan-action/issues/594">#594</a>) [@<a href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>]</li> <li>chore(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 (<a href="https://redirect.github.com/anchore/scan-action/issues/590">#590</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> <li>chore(deps): update Grype to v0.107.0 (<a href="https://redirect.github.com/anchore/scan-action/issues/588">#588</a>) [@<a href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>]</li> <li>chore(deps-dev): bump prettier from 3.8.0 to 3.8.1 (<a href="https://redirect.github.com/anchore/scan-action/issues/584">#584</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> <li>chore(deps-dev): bump tar from 7.5.6 to 7.5.7 (<a href="https://redirect.github.com/anchore/scan-action/issues/586">#586</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> </ul> <h2>v7.3.1</h2> <h2>⬆️ Dependencies</h2> <ul> <li>chore(deps): update Grype to v0.106.0 (<a href="https://redirect.github.com/anchore/scan-action/issues/583">#583</a>) [@<a href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>]</li> <li>chore(deps): bump lodash from 4.17.21 to 4.17.23 (<a href="https://redirect.github.com/anchore/scan-action/issues/580">#580</a>) [@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>]</li> </ul> <h2>v7.3.0</h2> <h2>New in scan-action v7.3.0</h2> <h2>⬆️ Dependencies</h2> <ul> <li>chore(deps): bump <code>@​actions/tool-cache</code> from 2.0.2 to 3.0.0 (<a href="https://redirect.github.com/anchore/scan-action/issues/567">#567</a>) [<a href="https://github.com/dependabot"><code>@​dependabot</code></a>]</li> <li>chore(deps): bump <code>@​actions/cache</code> from 5.0.1 to 5.0.2 (<a href="https://redirect.github.com/anchore/scan-action/issues/568">#568</a>) [<a href="https://github.com/dependabot"><code>@​dependabot</code></a>]</li> <li>chore(deps): bump <code>@​actions/core</code> from 2.0.1 to 2.0.2 (<a href="https://redirect.github.com/anchore/scan-action/issues/569">#569</a>) [<a href="https://github.com/dependabot"><code>@​dependabot</code></a>]</li> <li>chore(deps-dev): bump tar from 7.5.2 to 7.5.3 (<a href="https://redirect.github.com/anchore/scan-action/issues/574">#574</a>) [<a href="https://github.com/dependabot"><code>@​dependabot</code></a>]</li> <li>chore(deps): update Grype to v0.105.0 (<a href="https://redirect.github.com/anchore/scan-action/issues/572">#572</a>) [<a href="https://github.com/anchore-actions-token-generator"><code>@​anchore-actions-token-generator</code></a>[bot]]</li> </ul> <h2>v7.2.3</h2> <h2>New in scan-action v7.2.3</h2> <ul> <li>chore(deps): update Grype to v0.104.4 (<a href="https://redirect.github.com/anchore/scan-action/issues/566">#566</a>) [[<a href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>](<a href="https://github.com/%5Banchore-actions-token-generator%5Bbot%5D%5D(https://github.com/apps/anchore-actions-token-generator))%5D">https://github.com/[anchore-actions-token-generator[bot]](https://github.com/apps/anchore-actions-token-generator))]</a></li> <li>chore(deps): bump <code>@​actions/cache</code> from 4.1.0 to 5.0.1 (<a href="https://redirect.github.com/anchore/scan-action/issues/563">#563</a>) [[<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a href="https://github.com/%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot))%5D">https://github.com/[dependabot[bot]](https://github.com/apps/dependabot))]</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anchore/scan-action/commit/e1165082ffb1fe366ebaf02d8526e7c4989ea9d2"><code>e116508</code></a> chore: bump fast-xml-parser from 5.5.6 to 5.5.7 + setup-node (<a href="https://redirect.github.com/anchore/scan-action/issues/631">#631</a>)</li> <li><a href="https://github.com/anchore/scan-action/commit/382a23a5be86412134bdf4a65e1a18943e5d31ac"><code>382a23a</code></a> chore(deps): update Grype to v0.110.0 (<a href="https://redirect.github.com/anchore/scan-action/issues/618">#618</a>)</li> <li><a href="https://github.com/anchore/scan-action/commit/28982132458e82c788c1b254d367e19d69a896a5"><code>2898213</code></a> chore: update to node 24 (<a href="https://redirect.github.com/anchore/scan-action/issues/629">#629</a>)</li> <li><a href="https://github.com/anchore/scan-action/commit/4e1eb5b6d4ff459c3b0ef7f2ea4de674c94d4353"><code>4e1eb5b</code></a> chore: update to modules and bump all deps (required for new <a href="https://github.com/actions"><code>@​actions</code></a> librari...</li> <li><a href="https://github.com/anchore/scan-action/commit/8ed60d1353b11a3d328c30da9f63cacbdd91b37b"><code>8ed60d1</code></a> chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 (<a href="https://redirect.github.com/anchore/scan-action/issues/617">#617</a>)</li> <li><a href="https://github.com/anchore/scan-action/commit/5a271d28d1a95246a5ab1fac675a77692ed468ec"><code>5a271d2</code></a> chore(deps-dev): bump lint-staged from 16.3.1 to 16.3.2 (<a href="https://redirect.github.com/anchore/scan-action/issues/619">#619</a>)</li> <li><a href="https://github.com/anchore/scan-action/commit/6d37af257493532b84fda2c1deeac102db78d1dc"><code>6d37af2</code></a> chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (<a href="https://redirect.github.com/anchore/scan-action/issues/625">#625</a>)</li> <li><a href="https://github.com/anchore/scan-action/commit/50a8160242150b375f887fa9c071755295719cf6"><code>50a8160</code></a> chore(deps-dev): bump tar from 7.5.10 to 7.5.11 (<a href="https://redirect.github.com/anchore/scan-action/issues/620">#620</a>)</li> <li><a href="https://github.com/anchore/scan-action/commit/daeb723982a29db0a021b5fa3af65d08e1f891c8"><code>daeb723</code></a> chore(deps): bump undici from 6.23.0 to 6.24.1 (<a href="https://redirect.github.com/anchore/scan-action/issues/622">#622</a>)</li> <li><a href="https://github.com/anchore/scan-action/commit/6471a7ecdb0c416a386ad58b1064cbc154d0221e"><code>6471a7e</code></a> chore(deps): bump fast-xml-parser from 5.3.6 to 5.5.6 (<a href="https://redirect.github.com/anchore/scan-action/issues/626">#626</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anchore/scan-action/compare/1638637db639e0ade3258b51db49a9a137574c3e...e1165082ffb1fe366ebaf02d8526e7c4989ea9d2">compare view</a></li> </ul> </details> <br /> Updates `aquasecurity/trivy-action` from 0.24.0 to 0.36.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aquasecurity/trivy-action/releases">aquasecurity/trivy-action's releases</a>.</em></p> <blockquote> <h2>v0.36.0</h2> <h2>What's Changed</h2> <ul> <li>chore(ci): update bump-trivy workflow by <a href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/546">aquasecurity/trivy-action#546</a></li> <li>ci: use action.yaml as single source of truth for Trivy version by <a href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/552">aquasecurity/trivy-action#552</a></li> <li>ci: replace peter-evans/create-pull-request with gh CLI by <a href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a href="https://redirect.github.com/aquasecurity/trivy-action/pull/550">aquasecurity/t…
1 parent b9e5e3e commit 6ccede2

7 files changed

Lines changed: 36 additions & 36 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ jobs:
9191
distribution: 'temurin'
9292

9393
- name: Setup Gradle
94-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
94+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
9595

9696
- name: Make gradlew executable
9797
if: runner.os != 'Windows'
@@ -151,7 +151,7 @@ jobs:
151151

152152
- name: Upload SpotBugs Report
153153
if: always()
154-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
154+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
155155
with:
156156
name: spotbugs-report-${{ matrix.os }}-java${{ matrix.java }}
157157
path: freemind/build/reports/spotbugs/
@@ -168,15 +168,15 @@ jobs:
168168

169169
- name: Upload Coverage Report
170170
if: matrix.os == 'ubuntu-24.04' && matrix.java == '21' && always()
171-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
171+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
172172
with:
173173
name: coverage-report
174174
path: freemind/build/reports/jacoco/
175175
retention-days: 14
176176

177177
- name: Upload build artifacts
178178
if: matrix.java == '21'
179-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
179+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
180180
with:
181181
name: build-${{ matrix.os }}
182182
path: |
@@ -207,7 +207,7 @@ jobs:
207207
distribution: 'temurin'
208208

209209
- name: Setup Gradle
210-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
210+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
211211

212212
- name: Make gradlew executable
213213
if: runner.os != 'Windows'
@@ -255,7 +255,7 @@ jobs:
255255

256256
- name: Upload GUI Test Screenshots
257257
if: always()
258-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
258+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
259259
with:
260260
name: gui-test-screenshots-${{ matrix.os }}-java${{ matrix.java }}
261261
path: freemind/build/test-screenshots/
@@ -354,7 +354,7 @@ jobs:
354354
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
355355

356356
- name: Initialize CodeQL
357-
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
357+
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
358358
with:
359359
languages: ${{ matrix.language }}
360360
queries: security-extended
@@ -366,7 +366,7 @@ jobs:
366366
distribution: 'temurin'
367367

368368
- name: Setup Gradle
369-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
369+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
370370

371371
- name: Make gradlew executable
372372
run: chmod +x ./gradlew
@@ -375,6 +375,6 @@ jobs:
375375
run: ./gradlew build -x test --no-daemon --no-configuration-cache
376376

377377
- name: Perform CodeQL Analysis
378-
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4
378+
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
379379
with:
380380
category: "/language:${{ matrix.language }}"

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ jobs:
1919
steps:
2020
- name: Fetch Dependabot metadata
2121
id: metadata
22-
uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v2
22+
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v2
2323
with:
2424
github-token: ${{ secrets.GITHUB_TOKEN }}
2525

2626
- name: Wait for CI checks to pass
27-
uses: lewagon/wait-on-check-action@a08fbe2b86f9336198f33be6ad9c16b96f92799c # v1.6.0
27+
uses: lewagon/wait-on-check-action@9312864dfbc9fd208e9c0417843430751c042800 # v1.7.0
2828
with:
2929
ref: ${{ github.event.pull_request.head.sha }}
3030
repo-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/fuzz.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
distribution: 'temurin'
3030

3131
- name: Setup Gradle
32-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
32+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
3333

3434
- name: Make gradlew executable
3535
run: chmod +x ./gradlew
@@ -46,7 +46,7 @@ jobs:
4646

4747
- name: Upload crash artifacts
4848
if: failure()
49-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
49+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
5050
with:
5151
name: fuzz-crashes
5252
path: |

‎.github/workflows/release-please.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
release_created: ${{ steps.release.outputs.release_created }}
4747
tag_name: ${{ steps.release.outputs.tag_name }}
4848
steps:
49-
- uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
49+
- uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v4
5050
id: release
5151
with:
5252
config-file: release-please-config.json

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040
distribution: 'temurin'
4141

4242
- name: Setup Gradle
43-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
43+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
4444

4545
- name: Make gradlew executable
4646
if: runner.os != 'Windows'
@@ -92,7 +92,7 @@ jobs:
9292
distribution: 'temurin'
9393

9494
- name: Setup Gradle
95-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
95+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
9696

9797
- name: Make gradlew executable
9898
if: runner.os != 'Windows'
@@ -140,7 +140,7 @@ jobs:
140140

141141
- name: Upload GUI Test Screenshots
142142
if: always()
143-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
143+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
144144
with:
145145
name: release-gui-screenshots-${{ matrix.os }}-java${{ matrix.java }}
146146
path: freemind/build/test-screenshots/
@@ -207,7 +207,7 @@ jobs:
207207
distribution: 'temurin'
208208

209209
- name: Setup Gradle
210-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
210+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
211211

212212
- name: Make gradlew executable
213213
run: chmod +x ./gradlew
@@ -225,7 +225,7 @@ jobs:
225225
for f in *.dmg; do [ -f "$f" ] && mv "$f" "FreeMind-CE-${VERSION}-macOS.dmg"; done
226226
227227
- name: Upload packages
228-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
228+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
229229
with:
230230
name: FreeMindCE-macOS
231231
path: freemind/build/jpackage/FreeMind-CE-*
@@ -248,7 +248,7 @@ jobs:
248248
distribution: 'temurin'
249249

250250
- name: Setup Gradle
251-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
251+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
252252

253253
- name: Build
254254
run: .\gradlew.bat build -x test --no-daemon --no-configuration-cache
@@ -356,7 +356,7 @@ jobs:
356356
for f in *.msi; do [ -f "$f" ] && mv "$f" "FreeMind-CE-${VERSION}-Windows.msi"; done
357357
358358
- name: Upload packages
359-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
359+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
360360
with:
361361
name: FreeMindCE-Windows
362362
path: freemind/build/jpackage/FreeMind-CE-*
@@ -379,7 +379,7 @@ jobs:
379379
distribution: 'temurin'
380380

381381
- name: Setup Gradle
382-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
382+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
383383

384384
- name: Make gradlew executable
385385
run: chmod +x ./gradlew
@@ -460,14 +460,14 @@ jobs:
460460
for f in *.rpm; do [ -f "$f" ] && mv "$f" "FreeMind-CE-${VERSION}-Linux.rpm"; done
461461
462462
- name: Upload packages
463-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
463+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
464464
with:
465465
name: FreeMindCE-Linux
466466
path: freemind/build/jpackage/FreeMind-CE-*
467467
if-no-files-found: error
468468

469469
- name: Upload JAR distribution
470-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
470+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
471471
with:
472472
name: FreeMindCE-jar
473473
path: freemind/build/distributions/*
@@ -520,14 +520,14 @@ jobs:
520520
cosign sign-blob --yes SHA256SUMS.txt --output-signature=SHA256SUMS.txt.sig --output-certificate=SHA256SUMS.txt.pem
521521
522522
- name: Attest build provenance
523-
uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
523+
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
524524
with:
525525
subject-path: |
526526
artifacts/FreeMind-CE-*
527527
artifacts/SHA256SUMS.txt
528528
529529
- name: Create Release
530-
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
530+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2
531531
with:
532532
files: artifacts/*
533533
generate_release_notes: true

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,6 @@ jobs:
4242
publish_results: true
4343

4444
- name: Upload Scorecard results
45-
uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4
45+
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
4646
with:
4747
sarif_file: results.sarif

‎.github/workflows/security-scan.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
distribution: 'temurin'
3030

3131
- name: Setup Gradle
32-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
32+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
3333

3434
- name: Make gradlew executable
3535
run: chmod +x ./gradlew
@@ -39,7 +39,7 @@ jobs:
3939
continue-on-error: true
4040

4141
- name: Upload OWASP Report
42-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
42+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
4343
if: always()
4444
with:
4545
name: owasp-dependency-check-report
@@ -57,7 +57,7 @@ jobs:
5757
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5858

5959
- name: Initialize CodeQL
60-
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
60+
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
6161
with:
6262
languages: java-kotlin
6363

@@ -68,7 +68,7 @@ jobs:
6868
distribution: 'temurin'
6969

7070
- name: Setup Gradle
71-
uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
71+
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
7272

7373
- name: Make gradlew executable
7474
run: chmod +x ./gradlew
@@ -77,7 +77,7 @@ jobs:
7777
run: ./gradlew clean build -x test --no-daemon --no-configuration-cache --no-build-cache
7878

7979
- name: Perform CodeQL Analysis
80-
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4
80+
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
8181
with:
8282
category: "/language:java-kotlin"
8383

@@ -93,7 +93,7 @@ jobs:
9393
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
9494

9595
- name: Run Grype scan
96-
uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e # v6
96+
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
9797
id: grype
9898
with:
9999
path: "."
@@ -102,7 +102,7 @@ jobs:
102102
severity-cutoff: high
103103

104104
- name: Upload Grype results to GitHub Security tab
105-
uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4
105+
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
106106
if: always()
107107
with:
108108
sarif_file: ${{ steps.grype.outputs.sarif }}
@@ -120,7 +120,7 @@ jobs:
120120
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
121121

122122
- name: Run Trivy filesystem scan
123-
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.37.0
123+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.37.0
124124
with:
125125
scan-type: 'fs'
126126
scan-ref: '.'
@@ -130,7 +130,7 @@ jobs:
130130
continue-on-error: true
131131

132132
- name: Upload Trivy results to GitHub Security tab
133-
uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4
133+
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
134134
if: always()
135135
with:
136136
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)