chore(deps): Bump the actions group with 6 updates (#38)

Bumps the actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.1` |
`6.0.2` |
| [github/codeql-action](https://github.com/github/codeql-action) |
`4.31.9` | `4.35.5` |
| [webfactory/ssh-agent](https://github.com/webfactory/ssh-agent) |
`0.9.1` | `0.10.0` |
| [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) |
`f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561` |
`3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9` |
|
[trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog)
| `3.92.4` | `3.95.3` |
|
[editorconfig-checker/action-editorconfig-checker](https://github.com/editorconfig-checker/action-editorconfig-checker)
| `2.1.0` | `2.2.0` |

Updates `actions/checkout` from 6.0.1 to 6.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>v4.2.0</h2>
<ul>
<li>Add Ref and Commit outputs by <a
href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
<li>Dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
<a
href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
</ul>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
<li>Pin actions/checkout's own workflows to a known, good, stable
version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
</ul>
<h2>v4.1.6</h2>
<ul>
<li>Check platform to set archive extension appropriately by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd"><code>de0fac2</code></a>
Fix tag handling: preserve annotations and explicit fetch-tags (<a
href="https://redirect.github.com/actions/checkout/issues/2356">#2356</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49"><code>064fe7f</code></a>
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is
set (...</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/8e8c483db84b4bee98b60c0593521ed34d9990e8...de0fac2e4500dabe0009e67214ff5f5447ce83dd">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.31.9 to 4.35.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.35.5</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>v4.35.4</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>v4.35.3</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>v4.35.2</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<h2>v4.35.1</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>v4.35.0</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li>
</ul>
<h2>v4.34.1</h2>
<ul>
<li>Downgrade default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>
due to issues with a small percentage of Actions and JavaScript
analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li>
</ul>
<h2>v4.34.0</h2>
<ul>
<li>Added an experimental change which disables TRAP caching when <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> is enabled, since improved incremental analysis
supersedes TRAP caching. This will improve performance and reduce
Actions cache usage. We expect to roll this change out to everyone in
March. <a
href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li>
<li>We are rolling out improved incremental analysis to C/C++ analyses
that use build mode <code>none</code>. We expect this rollout to be
complete by the end of April 2026. <a
href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li>
</ul>
<h2>v4.33.0</h2>
<ul>
<li>
<p>Upcoming change: Starting April 2026, the CodeQL Action will skip
collecting file coverage information on pull requests to improve
analysis performance. File coverage information will still be computed
on non-PR analyses. Pull request analyses will log a warning about this
upcoming change. <a
href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p>
<p>To opt out of this change:</p>
<ul>
<li><strong>Repositories owned by an organization:</strong> Create a
custom repository property with the name
<code>github-codeql-file-coverage-on-prs</code> and the type
&quot;True/false&quot;, then set this property to <code>true</code> in
the repository's settings. For more information, see <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing
custom properties for repositories in your organization</a>.
Alternatively, if you are using an advanced setup workflow, you can set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using default setup:</strong> Switch
to an advanced setup workflow and set the
<code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to
<code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using advanced setup:</strong> Set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
</ul>
</li>
<li>
<p>Fixed <a
href="https://redirect.github.com/github/codeql-action/issues/3555">a
bug</a> which caused the CodeQL Action to fail loading repository
properties if a &quot;Multi select&quot; repository property was
configured for the repository. <a
href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p>
</li>
<li>
<p>The CodeQL Action now loads <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom
repository properties</a> on GitHub Enterprise Server, enabling the
customization of features such as
<code>github-codeql-disable-overlay</code> that was previously only
available on GitHub.com. <a
href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p>
</li>
<li>
<p>Once <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private
package registries</a> can be configured with OIDC-based authentication
for organizations, the CodeQL Action will now be able to accept such
configurations. <a
href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p>
</li>
<li>
<p>Fixed the retry mechanism for database uploads. Previously this would
fail with the error &quot;Response body object should not be disturbed
or locked&quot;. <a
href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p>
</li>
<li>
<p>A warning is now emitted if the CodeQL Action detects a repository
property whose name suggests that it relates to the CodeQL Action, but
which is not one of the properties recognised by the current version of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li>
</ul>
<h2>4.34.1 - 20 Mar 2026</h2>
<ul>
<li>Downgrade default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>
due to issues with a small percentage of Actions and JavaScript
analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li>
</ul>
<h2>4.34.0 - 20 Mar 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/9e0d7b8d25671d64c341c19c0152d693099fb5ba"><code>9e0d7b8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3905">#3905</a>
from github/update-v4.35.5-d4b485515</li>
<li><a
href="https://github.com/github/codeql-action/commit/6d7d59927c0c7336c1d1247c7e159e79edbf7684"><code>6d7d599</code></a>
Add changelog entry for <a
href="https://redirect.github.com/github/codeql-action/issues/3899">#3899</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/51f7e38c69d3cd7966375fe0ffff19669f22bd14"><code>51f7e38</code></a>
Update changelog for v4.35.5</li>
<li><a
href="https://github.com/github/codeql-action/commit/d4b485515e8531d7071a39d526213eb5b2e74a11"><code>d4b4855</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3899">#3899</a>
from github/mbg/esbuild/split</li>
<li><a
href="https://github.com/github/codeql-action/commit/127de8117f134e8809c127d53e940b3ffc1db8e9"><code>127de81</code></a>
Merge remote-tracking branch 'origin/main' into mbg/esbuild/split</li>
<li><a
href="https://github.com/github/codeql-action/commit/7fde13f26ad3f7008e8fe6755cb997b54f7a2f3b"><code>7fde13f</code></a>
Use src + basename in header to avoid issues on Windows</li>
<li><a
href="https://github.com/github/codeql-action/commit/dfa61e7305ed28b74dcc2c68bd665b36751ad933"><code>dfa61e7</code></a>
Improve pattern matching and error handling</li>
<li><a
href="https://github.com/github/codeql-action/commit/52aafec07347933a26e670390c3f894c5c05e64a"><code>52aafec</code></a>
Import and call <code>runWrapper</code> normally in <code>analyze</code>
tests</li>
<li><a
href="https://github.com/github/codeql-action/commit/0d08c01f7874da2f932e4d4e4d42b1c43be88111"><code>0d08c01</code></a>
Auto-generate shared bundle</li>
<li><a
href="https://github.com/github/codeql-action/commit/14085a675cb6d8cddc805b946cc1d51e3232a204"><code>14085a6</code></a>
Auto-generate entry points</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/5d4e8d1aca955e8d8589aabd499c5cae939e33c7...9e0d7b8d25671d64c341c19c0152d693099fb5ba">compare
view</a></li>
</ul>
</details>
<br />

Updates `webfactory/ssh-agent` from 0.9.1 to 0.10.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webfactory/ssh-agent/releases">webfactory/ssh-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.10.0: Upgrade to node-24</h2>
<p>This release upgrades from node 20 to node 24, preparing for Node
20's upcoming EOL and getting rid of the related warning message in
GitHub.</p>
<h2>What's Changed</h2>
<ul>
<li>use node24 by <a
href="https://github.com/jimmymcpeter"><code>@​jimmymcpeter</code></a>
in <a
href="https://redirect.github.com/webfactory/ssh-agent/pull/243">webfactory/ssh-agent#243</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/jimmymcpeter"><code>@​jimmymcpeter</code></a>
made their first contribution in <a
href="https://redirect.github.com/webfactory/ssh-agent/pull/243">webfactory/ssh-agent#243</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/webfactory/ssh-agent/compare/v0.9.1...v0.10.0">https://github.com/webfactory/ssh-agent/compare/v0.9.1...v0.10.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webfactory/ssh-agent/commit/e83874834305fe9a4a2997156cb26c5de65a8555"><code>e838748</code></a>
use node24 (<a
href="https://redirect.github.com/webfactory/ssh-agent/issues/243">#243</a>)</li>
<li>See full diff in <a
href="https://github.com/webfactory/ssh-agent/compare/a6f90b1f127823b31d4d4a8d96047790581349bd...e83874834305fe9a4a2997156cb26c5de65a8555">compare
view</a></li>
</ul>
</details>
<br />

Updates `dtolnay/rust-toolchain` from
f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 to
3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dtolnay/rust-toolchain/commit/3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9"><code>3c5f7ea</code></a>
Add 1.94.1 patch release</li>
<li><a
href="https://github.com/dtolnay/rust-toolchain/commit/efa25f7f19611383d5b0ccf2d1c8914531636bf9"><code>efa25f7</code></a>
Add 1.93.1 patch release</li>
<li>See full diff in <a
href="https://github.com/dtolnay/rust-toolchain/compare/f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561...3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9">compare
view</a></li>
</ul>
</details>
<br />

Updates `trufflesecurity/trufflehog` from 3.92.4 to 3.95.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/trufflesecurity/trufflehog/releases">trufflesecurity/trufflehog's
releases</a>.</em></p>
<blockquote>
<h2>v3.95.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it
consistent with its Analyzer by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4906">trufflesecurity/trufflehog#4906</a></li>
<li>Rename AnalysisInfo field to SecretParts on detectors.Result by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4911">trufflesecurity/trufflehog#4911</a></li>
<li>Document SecretParts contract in detector-authoring docs by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4912">trufflesecurity/trufflehog#4912</a></li>
<li>Add a static check for detectors that don't set SecretParts by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4913">trufflesecurity/trufflehog#4913</a></li>
<li>Populate SecretParts on all detectors by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4919">trufflesecurity/trufflehog#4919</a></li>
<li>Make checksecretparts required in CI by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4921">trufflesecurity/trufflehog#4921</a></li>
<li>Deduplicate concurrent credential verification requests via
singleflight by <a
href="https://github.com/kashifkhan0771"><code>@​kashifkhan0771</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4314">trufflesecurity/trufflehog#4314</a></li>
<li>log non-critical chunk errors at V(2).Info instead of Error by <a
href="https://github.com/johnelliott"><code>@​johnelliott</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4928">trufflesecurity/trufflehog#4928</a></li>
<li>[INS-320] Cloudinary detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4747">trufflesecurity/trufflehog#4747</a></li>
<li>ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth
v3) by <a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4933">trufflesecurity/trufflehog#4933</a></li>
<li>chore: bump golangci-lint-action v7 → v9 (Node 24) by <a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4936">trufflesecurity/trufflehog#4936</a></li>
<li>Add default Content-Type: application/json header for custom
detector verification request by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4947">trufflesecurity/trufflehog#4947</a></li>
<li>Make detector Result.SecretParts initialization stricter by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4948">trufflesecurity/trufflehog#4948</a></li>
<li>Add Pinecone API key detector by <a
href="https://github.com/dylanTruffle"><code>@​dylanTruffle</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4917">trufflesecurity/trufflehog#4917</a></li>
<li>adding customizable successRanges and rotatedRanges to
customDetector by <a
href="https://github.com/jordanTunstill"><code>@​jordanTunstill</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4892">trufflesecurity/trufflehog#4892</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/trufflesecurity/trufflehog/compare/v3.95.2...v3.95.3">https://github.com/trufflesecurity/trufflehog/compare/v3.95.2...v3.95.3</a></p>
<h2>v3.95.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Revert &quot;[INS-397] Fix git version parser panic on non-numeric
patch versions&quot; by <a
href="https://github.com/trufflesteeeve"><code>@​trufflesteeeve</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4903">trufflesecurity/trufflehog#4903</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/trufflesecurity/trufflehog/compare/v3.95.1...v3.95.2">https://github.com/trufflesecurity/trufflehog/compare/v3.95.1...v3.95.2</a></p>
<h2>v3.95.1</h2>
<h2>What's Changed</h2>
<ul>
<li>[INS-444] Fix verification logic in Mesibo detector by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4884">trufflesecurity/trufflehog#4884</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/trufflesecurity/trufflehog/compare/v3.95.0...v3.95.1">https://github.com/trufflesecurity/trufflehog/compare/v3.95.0...v3.95.1</a></p>
<h2>v3.95.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Upgrade golangci-lint in CI runner and Makefile by <a
href="https://github.com/amanfcp"><code>@​amanfcp</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4861">trufflesecurity/trufflehog#4861</a></li>
<li>Deprecate SquareUp Detector by <a
href="https://github.com/nabeelalam"><code>@​nabeelalam</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4855">trufflesecurity/trufflehog#4855</a></li>
<li>[INS-397] Fix git version parser panic on non-numeric patch versions
by <a
href="https://github.com/shahzadhaider1"><code>@​shahzadhaider1</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4882">trufflesecurity/trufflehog#4882</a></li>
<li>Fix Bitbucket line highlighting URLs by <a
href="https://github.com/shahzadhaider1"><code>@​shahzadhaider1</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4854">trufflesecurity/trufflehog#4854</a></li>
<li>[INS-403] Support Custom endpoint config in hashicorpvaultauth
Detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4825">trufflesecurity/trufflehog#4825</a></li>
<li>[INS-398] Added tests to ensure that custom endpoint configuration
works in artifactory detectors by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4832">trufflesecurity/trufflehog#4832</a></li>
<li>Host ldap-verify library in trufflesecurity by <a
href="https://github.com/trufflesteeeve"><code>@​trufflesteeeve</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4859">trufflesecurity/trufflehog#4859</a></li>
<li>Add AnalysisError type and wrap all analyzer error paths by <a
href="https://github.com/johnelliott"><code>@​johnelliott</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4779">trufflesecurity/trufflehog#4779</a></li>
<li>dep-updates: Go 1.25 and dependency refreshes by <a
href="https://github.com/dustin-decker"><code>@​dustin-decker</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4888">trufflesecurity/trufflehog#4888</a></li>
<li>Fix nil pointer panics in GitHub analyzer gist/repo binding
functions by <a
href="https://github.com/shahzadhaider1"><code>@​shahzadhaider1</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4864">trufflesecurity/trufflehog#4864</a></li>
<li>[INS-399] Added Bitbucket data center(on prem) PAT detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4883">trufflesecurity/trufflehog#4883</a></li>
<li>[INS-402] Add Jira Data Center PAT Detector by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4872">trufflesecurity/trufflehog#4872</a></li>
<li>Add man page generation for trufflehog by <a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4894">trufflesecurity/trufflehog#4894</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/37b77001d0174ebec2fcca2bd83ff83a6d45a3ab"><code>37b7700</code></a>
adding customizable successRanges and rotatedRanges to customDetector
(<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4892">#4892</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/ba0a524d6e51744d9d4e306bc57ac5d6ca5173ea"><code>ba0a524</code></a>
Add Pinecone API key detector (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4917">#4917</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/ab5dd03ee012e5f372e2ba82c4813c2ba1331261"><code>ab5dd03</code></a>
Make detector Result.SecretParts initialization stricter (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4948">#4948</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/90ca685b33dd2ad6fe7d287d935f85088260ec90"><code>90ca685</code></a>
Add default Content-Type: application/json header for custom detector
verific...</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/5f47aad1c2df34f7c6230784ce9a5a659922f479"><code>5f47aad</code></a>
chore: bump golangci-lint-action v7 → v9 (Node 24) (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4936">#4936</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/a4e3016d045b88a1a93acf6f9012af7b8158e9f3"><code>a4e3016</code></a>
ci: bump JS actions to Node 24 majors (checkout v6, setup-go v6, codeql
v4, a...</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/8a12e8e2fb6f3c4a4294a8e63b3659af6c08cfe3"><code>8a12e8e</code></a>
[INS-320] Cloudinary detector (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4747">#4747</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/cf31c26af3131bd053d161a3b2155ed0cc47a050"><code>cf31c26</code></a>
Log non-critical chunk errors at V(2).Info instead of Error (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4928">#4928</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/99dc7bd6c06427bcb32f32fe1641d7fb83583915"><code>99dc7bd</code></a>
Deduplicate concurrent credential verification requests via singleflight
(<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4314">#4314</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/3fc0c2aa6648d54242e4af6fbfde0701796e4fb0"><code>3fc0c2a</code></a>
Make checksecretparts required in CI (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4921">#4921</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/trufflesecurity/trufflehog/compare/ef6e76c3c4023279497fab4721ffa071a722fd05...37b77001d0174ebec2fcca2bd83ff83a6d45a3ab">compare
view</a></li>
</ul>
</details>
<br />

Updates `editorconfig-checker/action-editorconfig-checker` from 2.1.0 to
2.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/releases">editorconfig-checker/action-editorconfig-checker's
releases</a>.</em></p>
<blockquote>
<h2>v2.2.0</h2>
<h2>What's Changed</h2>
<ul>
<li>build(deps-dev): bump <code>@​types/node</code> from 24.9.1 to
24.9.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/233">editorconfig-checker/action-editorconfig-checker#233</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 24.9.2 to
24.10.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/234">editorconfig-checker/action-editorconfig-checker#234</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 24.10.0 to
24.10.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/235">editorconfig-checker/action-editorconfig-checker#235</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 24.10.1 to
24.10.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/238">editorconfig-checker/action-editorconfig-checker#238</a></li>
<li>build(deps): bump <code>@​actions/core</code> from 1.11.1 to 2.0.0
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/239">editorconfig-checker/action-editorconfig-checker#239</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 24.10.2 to
25.0.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/240">editorconfig-checker/action-editorconfig-checker#240</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.0 to
25.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/241">editorconfig-checker/action-editorconfig-checker#241</a></li>
<li>build(deps): bump <code>@​actions/core</code> from 2.0.0 to 2.0.1 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/242">editorconfig-checker/action-editorconfig-checker#242</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.1 to
25.0.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/243">editorconfig-checker/action-editorconfig-checker#243</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.2 to
25.0.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/244">editorconfig-checker/action-editorconfig-checker#244</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.3 to
25.0.6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/249">editorconfig-checker/action-editorconfig-checker#249</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.6 to
25.0.7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/250">editorconfig-checker/action-editorconfig-checker#250</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.7 to
25.0.8 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/251">editorconfig-checker/action-editorconfig-checker#251</a></li>
<li>Add pull_request trigger to CI workflow by <a
href="https://github.com/klaernie"><code>@​klaernie</code></a> in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/254">editorconfig-checker/action-editorconfig-checker#254</a></li>
<li>Update Node version to 24 by <a
href="https://github.com/enescakir"><code>@​enescakir</code></a> in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/252">editorconfig-checker/action-editorconfig-checker#252</a></li>
<li>introduce a workflow to regenerate dist after dependabot updated by
<a href="https://github.com/klaernie"><code>@​klaernie</code></a> in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/255">editorconfig-checker/action-editorconfig-checker#255</a></li>
<li>build(deps): bump <code>@​actions/github</code> from 6.0.1 to 7.0.0
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/247">editorconfig-checker/action-editorconfig-checker#247</a></li>
<li>build(deps): bump <code>@​actions/tool-cache</code> from 2.0.2 to
3.0.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/245">editorconfig-checker/action-editorconfig-checker#245</a></li>
<li>Make example workflow in README clearer by <a
href="https://github.com/enescakir"><code>@​enescakir</code></a> in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/253">editorconfig-checker/action-editorconfig-checker#253</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.8 to
25.0.9 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/257">editorconfig-checker/action-editorconfig-checker#257</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.9 to
25.0.10 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/258">editorconfig-checker/action-editorconfig-checker#258</a></li>
<li>build(deps): bump <code>@​actions/tool-cache</code> from 3.0.0 to
3.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/261">editorconfig-checker/action-editorconfig-checker#261</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.0.10 to
25.1.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/264">editorconfig-checker/action-editorconfig-checker#264</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.1.0 to
25.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/266">editorconfig-checker/action-editorconfig-checker#266</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.2.0 to
25.2.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/267">editorconfig-checker/action-editorconfig-checker#267</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.2.1 to
25.2.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/268">editorconfig-checker/action-editorconfig-checker#268</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.2.2 to
25.2.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/269">editorconfig-checker/action-editorconfig-checker#269</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.2.3 to
25.3.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/270">editorconfig-checker/action-editorconfig-checker#270</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.3.0 to
25.3.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/271">editorconfig-checker/action-editorconfig-checker#271</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.3.1 to
25.3.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/272">editorconfig-checker/action-editorconfig-checker#272</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.3.2 to
25.3.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/273">editorconfig-checker/action-editorconfig-checker#273</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.3.3 to
25.3.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/274">editorconfig-checker/action-editorconfig-checker#274</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.3.5 to
25.4.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/275">editorconfig-checker/action-editorconfig-checker#275</a></li>
<li>build(deps-dev): bump <code>@​types/node</code> from 25.4.0 to
25.5.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/276">editorconfig-checker/action-editorconfig-checker#276</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/enescakir"><code>@​enescakir</code></a>
made their first contribution in <a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/pull/252">editorconfig-checker/action-editorconfig-checker#252</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/compare/v2.1.0...v2.2.0">https://github.com/editorconfig-checker/action-editorconfig-checker/compare/v2.1.0...v2.2.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/840e866d93b8e032123c23bac69dece044d4d84c"><code>840e866</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.4.0 to 25.5.0
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/276">#276</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/068409e1d614c857c80a2204ee86239af98f5f22"><code>068409e</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.3.5 to 25.4.0
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/275">#275</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/1a8ea00bde2ec25afe074a2cdc15b1fd7fb60a39"><code>1a8ea00</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.3.3 to 25.3.5
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/274">#274</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/7aeff89970eaa535f475efa5369cc1a7f52cc42f"><code>7aeff89</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.3.2 to 25.3.3
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/273">#273</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/ff2b7f22fb3dfdca5c54339c3ade98b0b3327ae6"><code>ff2b7f2</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.3.1 to 25.3.2
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/272">#272</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/7e2fc7836cd76c27a4f8210398b8fe7127f020b4"><code>7e2fc78</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.3.0 to 25.3.1
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/271">#271</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/fc46e05012a3cb292d4b1e6306f598d74ebd5458"><code>fc46e05</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.2.3 to 25.3.0
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/270">#270</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/b8ff0d8c9ff9f36a2e28674fea1f3dea1aa97cf0"><code>b8ff0d8</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.2.2 to 25.2.3
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/269">#269</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/da93ee0b8b393e1c3916ac5f6b49831ab068446e"><code>da93ee0</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.2.1 to 25.2.2
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/268">#268</a>)</li>
<li><a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/commit/022424cf7fece8e951f8cce2e74f1c890e5e4550"><code>022424c</code></a>
build(deps-dev): bump <code>@​types/node</code> from 25.2.0 to 25.2.1
(<a
href="https://redirect.github.com/editorconfig-checker/action-editorconfig-checker/issues/267">#267</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/editorconfig-checker/action-editorconfig-checker/compare/4b6cd6190d435e7e084fb35e36a096e98506f7b9...840e866d93b8e032123c23bac69dece044d4d84c">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/ada.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up GNAT toolchain
       run: >

.github/workflows/codeql.yml

@@ -26,15 +26,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.28.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.28.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -28,7 +28,7 @@ jobs:
       digests: ${{ steps.hash.outputs.digests }}
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # ========================================================
       #

.github/workflows/guix-nix-policy.yml

@@ -10,7 +10,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Enforce Guix primary / Nix fallback
         run: |
           # Check for package manager files

.github/workflows/mirror.yml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     if: vars.GITLAB_MIRROR_ENABLED == 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           fetch-depth: 0
 
-      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
 
@@ -32,11 +32,11 @@ jobs:
     runs-on: ubuntu-latest
     if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           fetch-depth: 0
 
-      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
 
@@ -50,11 +50,11 @@ jobs:
     runs-on: ubuntu-latest
     if: vars.CODEBERG_MIRROR_ENABLED == 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           fetch-depth: 0
 
-      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
 
@@ -68,11 +68,11 @@ jobs:
     runs-on: ubuntu-latest
     if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           fetch-depth: 0
 
-      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
 
@@ -86,11 +86,11 @@ jobs:
     runs-on: ubuntu-latest
     if: vars.DISROOT_MIRROR_ENABLED == 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           fetch-depth: 0
 
-      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
 
@@ -104,11 +104,11 @@ jobs:
     runs-on: ubuntu-latest
     if: vars.GITEA_MIRROR_ENABLED == 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           fetch-depth: 0
 
-      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
 
@@ -122,12 +122,12 @@ jobs:
     runs-on: ubuntu-latest
     if: vars.RADICLE_MIRROR_ENABLED == 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           fetch-depth: 0
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
           toolchain: stable
 

.github/workflows/npm-bun-blocker.yml

@@ -10,7 +10,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Block npm/bun
         run: |
           if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then

.github/workflows/quality.yml

@@ -11,14 +11,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check file permissions
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3.92.4
+        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -35,15 +35,15 @@ jobs:
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0
+        uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c # v2.2.0
         continue-on-error: true
 
   docs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Check documentation
         run: |
           MISSING=""

.github/workflows/rsr-antipattern.yml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for TypeScript
         run: |

.github/workflows/scorecard-enforcer.yml

@@ -18,7 +18,7 @@ jobs:
       security-events: write
       id-token: write  # For OIDC
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
         with:
           persist-credentials: false
 
@@ -30,7 +30,7 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3
         with:
           sarif_file: results.sarif
 
@@ -53,7 +53,7 @@ jobs:
   check-critical:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 
       - name: Check SECURITY.md exists
         run: |

.github/workflows/scorecard.yml

@@ -16,7 +16,7 @@ jobs:
       security-events: write
       id-token: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -27,6 +27,6 @@ jobs:
           results_format: sarif
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.31.8
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.31.8
         with:
           sarif_file: results.sarif