From e436b8109a7aad36ac295c614710fdc5737ae083 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 00:24:11 +0000 Subject: [PATCH] build(deps): bump the actions-deps group across 1 directory with 6 updates Bumps the actions-deps group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.2` | `3.0.3` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.7` | `4.37.9` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.7` | `4.37.9` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.7.0` | `6.0.0` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.0` | `0.24.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.7` | `4.37.9` | Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/3d0d9888cb7fd7b750713d6e236d1fcb99157228...efb35369e0ad2afab669f228072c1b0d510eae64) Updates `github/codeql-action/init` from 4.37.7 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `github/codeql-action/analyze` from 4.37.7 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `actions/setup-java` from 5.7.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/b6effb05e454b25005698d916606bdc6ffcbf961...dd06d9cba3e5552c54d9f8ea23572deb30010f7c) Updates `anchore/sbom-action` from 0.24.0 to 0.24.2 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: anchore/sbom-action dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps ... Signed-off-by: dependabot[bot] --- .github/workflows/build-macos-app.yml | 2 +- .github/workflows/build-windows-app.yml | 2 +- .github/workflows/codeql.yml | 4 ++-- .github/workflows/maestro.yml | 2 +- .github/workflows/sbom.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- .github/workflows/semgrep.yml | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-macos-app.yml b/.github/workflows/build-macos-app.yml index 5d7acae1..32f0c7ec 100644 --- a/.github/workflows/build-macos-app.yml +++ b/.github/workflows/build-macos-app.yml @@ -201,7 +201,7 @@ jobs: - name: Publish the Release (this repo) if: github.ref_type == 'tag' || inputs.publish - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3 with: tag_name: ${{ steps.rel.outputs.tag }} name: DreamLayer ${{ steps.rel.outputs.tag }} diff --git a/.github/workflows/build-windows-app.yml b/.github/workflows/build-windows-app.yml index 66d7117e..d8294064 100644 --- a/.github/workflows/build-windows-app.yml +++ b/.github/workflows/build-windows-app.yml @@ -195,7 +195,7 @@ jobs: - name: Publish the Release (this repo) if: github.ref_type == 'tag' || inputs.publish - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3 with: tag_name: ${{ steps.rel.outputs.tag }} name: DreamLayer ${{ steps.rel.outputs.tag }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 11c41c21..10c3cd74 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Initialize CodeQL - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: # NOTE: the init input is `languages` (plural). Passing the singular # `language` is silently ignored, which makes CodeQL AUTO-DETECT every @@ -56,6 +56,6 @@ jobs: # one-line diff that quietly stops analysing shipped code. config-file: .github/codeql/config.yml - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/maestro.yml b/.github/workflows/maestro.yml index 12061c8d..4ba7cc7b 100644 --- a/.github/workflows/maestro.yml +++ b/.github/workflows/maestro.yml @@ -25,7 +25,7 @@ jobs: node-version: "22" cache: npm cache-dependency-path: phone-app/package-lock.json - - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: distribution: temurin java-version: "17" diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 80cdc726..170d5102 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -49,7 +49,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Generate CycloneDX SBOM (host-python) - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: host-python/ format: cyclonedx-json @@ -72,7 +72,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Generate CycloneDX SBOM (phone-app) - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: phone-app/ format: cyclonedx-json diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 809b7f53..706b1d91 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -54,7 +54,7 @@ jobs: # contributor trust signal; the run is worthless as a private artifact. publish_results: true - name: Upload SARIF to the Security tab - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: results.sarif category: scorecard diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index de68ad3a..b7106b65 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -99,7 +99,7 @@ jobs: # always(): publish findings even though the scan step above is marked # continue-on-error (and even once it is later made blocking). if: always() - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: semgrep.sarif category: semgrep