From 3a6674993294e522faa0f269ef9d1d8835206730 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 22 Sep 2026 00:13:01 +0000 Subject: [PATCH] build(deps): bump the actions-deps group with 5 updates Bumps the actions-deps group with 5 updates: | Package | From | To | | --- | --- | --- | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.321.0` | `1.324.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.38.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.38.1` | | [actions/setup-java](https://github.com/actions/setup-java) | `6.0.0` | `6.0.1` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.9` | `4.38.1` | Updates `ruby/setup-ruby` from 1.321.0 to 1.324.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/95ef2b042f9d7a56d8268cba8559e2842e2ad01b...a0102e0972be65f351c307e2d64b9314a57c8073) Updates `github/codeql-action/init` from 4.37.9 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...1c5b675653bb5c22dbe9b12b556ec555138e09fd) Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...1c5b675653bb5c22dbe9b12b556ec555138e09fd) Updates `actions/setup-java` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/dd06d9cba3e5552c54d9f8ea23572deb30010f7c...de7274f081f381c8f8158605e0321c36c376e2e6) Updates `github/codeql-action/upload-sarif` from 4.37.9 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...1c5b675653bb5c22dbe9b12b556ec555138e09fd) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.324.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: github/codeql-action/init dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: github/codeql-action/analyze dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: actions/setup-java dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps ... Signed-off-by: dependabot[bot] --- .github/workflows/appstore-metadata.yml | 2 +- .github/workflows/codeql.yml | 4 ++-- .github/workflows/maestro.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/semgrep.yml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/appstore-metadata.yml b/.github/workflows/appstore-metadata.yml index 300787b3..dfefff65 100644 --- a/.github/workflows/appstore-metadata.yml +++ b/.github/workflows/appstore-metadata.yml @@ -59,7 +59,7 @@ jobs: with: node-version: "22" - - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1 + - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1 if: steps.gate.outputs.ok == 'true' with: ruby-version: "3.3" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 10c3cd74..b1e08c92 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: # NOTE: the init input is `languages` (plural). Passing the singular # `language` is silently ignored, which makes CodeQL AUTO-DETECT every @@ -56,6 +56,6 @@ jobs: # one-line diff that quietly stops analysing shipped code. config-file: .github/codeql/config.yml - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/maestro.yml b/.github/workflows/maestro.yml index 4ba7cc7b..eaf2dc1b 100644 --- a/.github/workflows/maestro.yml +++ b/.github/workflows/maestro.yml @@ -25,7 +25,7 @@ jobs: node-version: "22" cache: npm cache-dependency-path: phone-app/package-lock.json - - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 + - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: "17" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 706b1d91..6bc7e7bb 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -54,7 +54,7 @@ jobs: # contributor trust signal; the run is worthless as a private artifact. publish_results: true - name: Upload SARIF to the Security tab - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: sarif_file: results.sarif category: scorecard diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index b7106b65..216bfa1a 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -99,7 +99,7 @@ jobs: # always(): publish findings even though the scan step above is marked # continue-on-error (and even once it is later made blocking). if: always() - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: sarif_file: semgrep.sarif category: semgrep