[dependabot]

Bumps the actions-and-hooks group with 2 updates: taiki-e/install-action and github/codeql-action/upload-sarif.

Updates taiki-e/install-action from 2.88.0 to 2.90.1

Release notes

Sourced from taiki-e/install-action's releases.

2.90.1

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

2.90.0

• Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

• Update vacuum@latest to 0.36.2.

• Update release-plz@latest to 0.4.3.

• Update bpf-linker@latest to 0.13.0.

2.89.1

• Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

• Update parse-dockerfile@latest to 0.1.9.

• Update parse-changelog@latest to 0.6.18.

• Update cargo-minimal-versions@latest to 0.1.38.

• Update cargo-hack@latest to 0.6.46.

2.89.0

• Support yq. (#2036, thanks @​FirelightFlagboy)

• Support mold. (#2044, thanks @​FirelightFlagboy)

• Fix an error when old cargo-binstall had already been installed at non-standard location. (#2048)

• Update wasm-tools@latest to 1.263.0.

• Update wasm-pack@latest to 0.15.1.

• Update wasm-bindgen@latest to 0.2.130.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.3] - 2026-11-08

• Update yq@latest to 4.54.2.

• Update vacuum@latest to 0.39.3.

• Update syft@latest to 1.57.0.

• Update rclone@latest to 1.76.0.

• Update protoc-gen-connect-openapi@latest to 0.30.0.

• Update mise@latest to 2026.11.3.

• Update kingfisher@latest to 2.17.0.

• Update biome@latest to 2.6.6.

[2.90.2] - 2026-11-06

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

[2.90.1] - 2026-11-04

... (truncated)

Commits

• c509219 Release 2.90.1
• 4809658 codegen: kache 2.0.0 split binaries
• 2f5a77a Update zizmor@latest to 1.32.0
• 44e3ac1 Update uv@latest to 0.13.7
• 91480af Update typos@latest to 1.52.0
• 1886998 Update tombi@latest to 1.9.9
• d66493d Update syft@latest to 1.56.0
• ae0b89b Update prek manifest
• 773fb6f Update mise@latest to 2026.11.0
• 0a95b08 Update kache@latest to 2.0.0
• Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.39.1 to 4.39.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.3

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

• 33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
• 24393f8 Update changelog for v4.39.3
• 064910b Merge pull request #4297 from github/mbg/update-glob
• f532ac5 Update glob to 14.0.3
• 8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
• cea289b Return different exit code when a language is not recognised
• 7287bb3 Remove exclude entry that's no longer needed
• 8eb7cdf Use normal .editorconfig pattern
• 160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
• 913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
• Additional commits viewable in compare view

Bumps the actions-and-hooks group with 4 updates: https://github.com/fsfe/reuse-tool, https://github.com/simonvanlierde/jsonvet, https://github.com/zizmorcore/zizmor-pre-commit and https://github.com/jdx/jactionlint.

Updates https://github.com/fsfe/reuse-tool from v6.2.0 to 6.3.0

Changelog

Sourced from https://github.com/fsfe/reuse-tool's changelog.

Change log

This change log follows the Keep a Changelog spec. Every release contains the following sections:

• Added for new features.
• Changed for changes in existing functionality.
• Deprecated for soon-to-be removed features.
• Removed for now removed features.
• Fixed for any bug fixes.
• Security in case of vulnerabilities.

The versions follow semantic versioning for the reuse CLI command and its behaviour. There are no guarantees of stability for the reuse Python library.

v6.3.0 - 2026-10-30

This release fixes a broken reuse download. The URL from which licenses are downloaded is stored internally in the code, but the URL was changed. Without an update to this release of reuse or without a patch, reuse download will not work correctly. Maintainers: You can find the relevant patch in commit 605b27f.

Added

• Added new file extensions and files:
  • .plx, .pm, .psgi, and .xs Perl files (#1379)
  • .odin (#1353)
  • .pas, .dpr, and .dpk Pascal and Delphi files (#1354)
  • .python-version (#1334)
  • .slnx (#1270)
  • Bazel/Buck2/Copybara: .bxl, BUCK, BUILD, .sky, .star (#1340)
  • tsconfig.json (#1366)
  • .twig (#1360)
  • .zon (#1271)
  • .cr Crystal files (#1333)
• Added lower case (c) copyright prefix. (#1274)

... (truncated)

Commits

• ea739bf Fix up change log
• 989ad0d In Makefile, run wheel via poetry
• 4fe3a8a Add change log entry for .whl change
• 11d4044 Add a warning if msgfmt is not installed
• 0dfe248 Install wheel dependency
• bf75ede Rename .whl as part of building/publishing
• cf049cc Undo change where VCS logic is disabled when the project root does not match ...
• abf86cc Move file extensions into separate bullet under 'Added'
• f17d34e Install additional system dependencies for lint test
• db0c3a0 Fix windows path handling in tests
• Additional commits viewable in compare view

Updates https://github.com/simonvanlierde/jsonvet from v3.2.0 to 3.3.1

Release notes

Sourced from https://github.com/simonvanlierde/jsonvet's releases.

v3.3.1

Fixed

• --fix on standard input with --format json or sarif no longer adds the fixed N problems line after the report on standard error, so standard error parses as JSON (fixing).
• The GitHub Action's description is short enough for the GitHub Marketplace again, so the release is listed there.

Changelog

Sourced from https://github.com/simonvanlierde/jsonvet's changelog.

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning. Bump the minor version for a new option or output, the patch version for a fix.

[Unreleased]

[3.4.0] - 2026-11-11

Added

• per-file-format overrides indent, width, JSON5 normalization and bracket spacing for files matching a glob. Matching entries apply after [format] in file order, in both jsonvet fmt and the editor (format settings).

• --schema-catalog selects schemas by file name from SchemaStore. It enables HTTPS downloads explicitly, caches them for seven days, and warns when an offline run uses stale cached data. Local schema choices still win. Only SchemaStore-hosted, self-contained schemas are supported (catalog).

• In JSONC, JWCC and JSON5, a comment such as // jsonvet-ignore duplicate-key turns a rule off for the next line that starts with a token. Name more rules with commas, and give a reason after --: // jsonvet-ignore duplicate-key -- kept for the old client. The new unused-suppression rule, a warning in those dialects, reports a suppression that hides nothing, names an unknown rule, names a rule that is always an error or is about the whole file, or repeats a rule for the same line, so stale ones don't pile up (unused-suppression). With --fix --unsafe-fixes, a duplicate key keeps all its copies when one of them is suppressed, or when dropping one would change a line a suppression applies to. jsonvet fmt leaves a file unchanged when formatting would change which problems a suppression hides (formatting).

• per-file-rules in jsonvet.toml sets rule severities for the files a glob matches, such as per-file-rules = [{ files = "legacy/*.json", duplicate-key = "ignore" }]. It works in every dialect, also JSON, I-JSON and JSON Lines, where no comment can turn a rule off. Matching entries apply after rules and in order, and the command line still wins (configuration file).

• JSON reports have an optional top-level notes array, and SARIF reports list the same notices as tool notifications: a missing schema, or a stale or unwritable catalog cache (JSON, SARIF).

• jsonvet lsp runs a language server on standard input and output. It shows each open file's problems as you type, checked with the settings and schema a jsonvet run would use for that file, offers the safe fixes as quick fixes and as one source.fixAll.jsonvet action, and formats a file as jsonvet fmt does. Formatting a selection changes only the text inside it. It works in any editor with a Language Server Protocol client; editors shows VS Code, Neovim and Helix.

• A VS Code extension in editors/vscode, a thin client for jsonvet lsp. It runs jsonvet from PATH or the jsonvet.path setting. In JSON and JSONC files it leaves syntax errors and duplicate keys to VS Code's own JSON validation while that is on, so none shows twice (extension README). It adds the JSON5 and JWCC languages, which VS

... (truncated)

Commits

• 83df661 chore: release 3.3.1 (#204)
• f36f337 fix(cli): keep the fixed count out of a JSON report on standard error (#202)
• fc23bd1 build: add a just major recipe that moves the v3 tag after a release (#203)
• 938ada4 fix(action): keep the description under the Marketplace's 125 characters (#201)
• a9998d5 docs: bring the mutants shard counts and playground notes up to date (#200)
• a0f84b2 docs(changelog): mention the playground theme toggle (#199)
• 6aadecb test: kill the mutants the full run left alive (#198)
• d33d05e docs: add rust to the citation and PyPI keywords (#197)
• 6347d96 feat(playground): add a theme toggle and copy icons on the snippets (#196)
• ee37306 fix(playground): apply a note's fix at the end of the text and for every copy...
• Additional commits viewable in compare view

Updates https://github.com/zizmorcore/zizmor-pre-commit from v1.31.1 to 1.32.0

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.32.0

Sponsorship is appreciated!

New Features 🌈🔗

• zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱🔗

• zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the input collection documentation for more information. (#2454)

• zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

• zizmor's LSP now audits pre-commit inputs (#2485)

• zizmor now provides Windows ARM64 wheels on PyPI (#2424)

  Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛🔗

• Fixed a bug where the bot-conditions audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

• Fixed a bug where the obfuscation audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

• Fixed a class of bugs in the obfuscation audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

• Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

• Fixed a bug where zizmor would not honor some ignore comments for the stale-action-refs audit (#2494)

• Fixed a bug where zizmor would not honor some ignore comments for the ref-version-mismatch audit (#2494)

Commits

• 06a3975 Mirror: 1.32.0
• See full diff in compare view

Updates https://github.com/jdx/jactionlint from v2.3.0 to 2.4.0

Release notes

Sourced from https://github.com/jdx/jactionlint's releases.

v2.4.0: Private Use Area detection and fixes for artipacked, Dependabot groups and SARIF uploads

jactionlint 2.4.0 extends invisible-characters to report Private Use Area characters. It also fixes false positives in artipacked and dependabot-syntax, and stops the "inconsistent fingerprint" warnings when you upload SARIF to code scanning.

Added

• invisible-characters reports Private Use Area characters (U+E000–U+F8FF and the two supplementary private-use planes). Most fonts have no glyph for these characters, so they can hide a payload that a script decodes at run time, the same way variation selectors can. The message calls them PRIVATE USE CHARACTER. The rule ID, profile, level and the fix that removes the character have not changed. If you use Nerd Font or Powerline icons on purpose, write them as escape sequences before you apply the fix. Otherwise the fix removes them. (#311, @​jdx)

Fixed

• artipacked no longer reports actions/checkout v6 and later. Starting with v6, checkout stores the credential in a file under $RUNNER_TEMP instead of the workspace, so uploading the workspace doesn't publish it. The rule skips v6+ tag refs, and also commit pins whose version comment says v6 or later. v5 and earlier are still reported. (#308, @​jdx)
• dependabot-syntax no longer reports an update with multi-ecosystem-group as a duplicate of the regular update for the same ecosystem and directory. Two updates are now duplicates only when they match on ecosystem, directory, target branch and group. Two ungrouped updates, or two updates in the same group, are still reported. (#314, @​jdx)
• SARIF output no longer writes primaryLocationLineHash. github/codeql-action/upload-sarif computes this value itself and logs an "inconsistent fingerprint" warning when a file supplies a different one. The fingerprint value is unchanged and is now stored under jactionlint/contextHash/v1 in partialFingerprints. If your tools read jactionlint's fingerprint from primaryLocationLineHash, switch them to the new key. (#307, @​jdx)

Full Changelog: jdx/jactionlint@v2.3.0...v2.4.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.

Changelog

Sourced from https://github.com/jdx/jactionlint's changelog.

Changelog

2.5.0 (2026-11-04)

Features

• run: add jactionlint run --list (#316) (f1f877e)
• run: add the OS sandbox that steps run in (Landlock, seccomp, Seatbelt) (#319) (443b4c1)
• run: container jobs, services, Docker actions, --container, --parallel, --dry-run (#323) (27dae22)
• run: evaluate workflow expressions in jactionlint run --list (#317) (f4267f7)
• run: local actions cache, --net=proxy and jactionlint cache (#322) (b51ca88)
• run: run actions and reusable workflows (#321) (782e8f9)
• run: run workflow steps in the sandbox (#320) (65614de)
• unreachable-required-check: report required checks that never report (#331) (a4f08e3)

Bug Fixes

• dependabot-syntax: support apm package ecosystem (#333) (c7eafd3)
• unpinned-images: only count images built in the same job (#329) (a09969d)
• unpinned-images: treat images of drop-in forks of docker/build-push-action as local (#328) (4d0fcf6)

2.4.0 (2026-10-28)

Features

• invisible-characters: report Private Use Area characters (#311) (b4a8d08)

Bug Fixes

• artipacked: skip actions/checkout v6 and later (#308) (7a5eb59)
• dependabot-syntax: don't report a multi-ecosystem group update as a duplicate (#314) (1950126)
• sarif: stop writing primaryLocationLineHash (#307) (beecbca)

2.3.0 (2026-10-21)

Features

• config: add allow-unused to durable ignores (#297) (69311d3)
• upstream: catch workflow analyzer gaps earlier (#288) (439e97d)

Bug Fixes

• build with Go 1.27.3 to reject compromised eMudhra certificates (#301) (cca9bb8)
• workflow-call-permissions: grant id-token to a silent caller under the permissive default (#299) (493a916)

... (truncated)

Commits

• baa8d68 chore(main): release 2.4.0 (#309)
• 1950126 fix(dependabot-syntax): don't report a multi-ecosystem group update as a dupl...
• b4a8d08 feat(invisible-characters): report Private Use Area characters (#311)
• beecbca fix(sarif): stop writing primaryLocationLineHash (#307)
• 7a5eb59 fix(artipacked): skip actions/checkout v6 and later (#308)
• 09478a8 test(schema): pin the latest actions/runner schemas (#306)
• 556be51 update version to 2.3.0 in download-jactionlint.bash and the action examples
• 426f1a2 Brew cask update for jactionlint version v2.3.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions