fix(deps): update github.com/semaphoreui/semaphore digest to 52268c0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/semaphoreui/semaphore	require	digest	7283631 → 52268c0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cursor]

Stale comment

Security review (automation)

Scope: The PR diff only changes the pinned pseudo-version for github.com/semaphoreui/semaphore in pro/go.mod (from 72836311c5b9 to 588b369).

Assessment: There is no added or modified application logic, configuration of secrets, network endpoints, or dependency on a new third-party module. The module is still the same repository; pro/go.mod continues to use replace github.com/semaphoreui/semaphore => ../, so the resolved source for the main module in this tree remains the local parent directory, not a remote fetch gated solely by this version string in typical workspace builds.

Conclusion: No medium, high, or critical issues were identified from this diff alone with a plausible, PR-specific attack path. Prior automation threads were cleared via cleanup_previous so this assessment is the current one.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review (automation)

Scope: The PR diff only updates pro/go.mod—one line that bumps the github.com/semaphoreui/semaphore module pseudoversion to a digest containing ef202a15.

Assessment: No new medium+ severity issues identified in the changed file. The update pins the pro submodule to a newer build of the same first-party module (no new third-party dependency, no new surface area in this diff). I traced the substantive code change in the target digest (runner "complete match" filter): tag filtering still uses a parameterized EXISTS subquery via runnerHasTagExpr—not an injection or authz regression from this PR.

Slack-style summary: Outcome: clear — no actionable security findings from this change. No top findings; dependency remains the same module with a version bump only.

Threads from earlier automation security-review runs are cleaned up so this assessment is the current one.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review (PR #3811)

Outcome: No medium, high, or critical findings from this change set.

Scope: The diff only updates the require pseudo-version for github.com/semaphoreui/semaphore in pro/go.mod. pro/go.mod contains replace github.com/semaphoreui/semaphore => ../, so builds resolve the core module from the local workspace, not from the registry at the listed digest. This update does not introduce new executable code, routing, or trust boundaries in the diff itself.

Supply chain: Treated as a Renovate version-pin alignment with the monorepo. Without evidence that commit 0b3381658799 is malicious or that the replace is bypassed in a relevant build, there is no plausible new exploit path tied solely to this one-line go.mod change.

Prior threads: Previous automation security-review threads are resolved; this assessment is the current one.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review (automation) — PR #3811

Scope: The diff only updates the require pseudo-version for github.com/semaphoreui/semaphore in pro/go.mod (Renovate digest bump, 52268c0294b8). No other files changed.

Analysis:

• There are no added or modified application routes, auth, SQL, or sinks—nothing to trace from attacker input to a vulnerable call site in this diff.
• The dependency is the first-party Semaphore module (same repository). This is a version pin refresh, not an introduction of a new third-party maintainer or package namespace.
• pro/go.mod uses replace github.com/semaphoreui/semaphore => ../, so local/replace-based builds already resolve to the workspace parent module; the pin mainly affects version metadata and non-replace go resolution.

Verdict: No medium, high, or critical vulnerabilities introduced or exposed by this change with a plausible, diff-grounded attack path. Prior automation threads are addressed via cleanup_previous so this assessment is the current one.

---

Slack-style summary (copy as needed):
PR 3811 security pass: only pro/go.mod first-party module digest bump; no code/sink changes; no new findings; supply-chain change is same-repo version pin, not a new third-party.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the github.com/semaphoreui/semaphore 52268c0 update again.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.