From a624a97699277ab6024979eae46ce533f393df87 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 11 Nov 2026 01:45:24 +0000 Subject: [PATCH] chore(deps): bump the actions-and-hooks group with 2 updates Bumps the actions-and-hooks group with 2 updates: [taiki-e/install-action](https://github.com/taiki-e/install-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `taiki-e/install-action` from 2.88.0 to 2.90.1 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/86f7a0ffb25f40114606501a311ebcfaf882ea32...c509219cf42fba86913069efd0ade2458c59337b) Updates `github/codeql-action/upload-sarif` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066) chore(deps): bump the actions-and-hooks group with 4 updates Bumps the actions-and-hooks group with 4 updates: [https://github.com/fsfe/reuse-tool](https://github.com/fsfe/reuse-tool), [https://github.com/simonvanlierde/jsonvet](https://github.com/simonvanlierde/jsonvet), [https://github.com/zizmorcore/zizmor-pre-commit](https://github.com/zizmorcore/zizmor-pre-commit) and [https://github.com/jdx/jactionlint](https://github.com/jdx/jactionlint). Updates `https://github.com/fsfe/reuse-tool` from v6.2.0 to 6.3.0 - [Release notes](https://github.com/fsfe/reuse-tool/releases) - [Changelog](https://github.com/fsfe/reuse-tool/blob/main/CHANGELOG.md) - [Commits](https://github.com/fsfe/reuse-tool/compare/a1bb792acda6fd0724936b4ebbdbc8eceb9c0459...ea739bff9c6daa1c4c8a5c5dfd069f3fb0374728) Updates `https://github.com/simonvanlierde/jsonvet` from v3.2.0 to 3.3.1 - [Release notes](https://github.com/simonvanlierde/jsonvet/releases) - [Changelog](https://github.com/simonvanlierde/jsonvet/blob/main/CHANGELOG.md) - [Commits](https://github.com/simonvanlierde/jsonvet/compare/022d320d5b971eccb28cfa6ce205152cbb382e53...83df66110a108e0fa4b7d2b2adcef6831f618e05) Updates `https://github.com/zizmorcore/zizmor-pre-commit` from v1.31.1 to 1.32.0 - [Release notes](https://github.com/zizmorcore/zizmor-pre-commit/releases) - [Commits](https://github.com/zizmorcore/zizmor-pre-commit/compare/c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f...06a39750ec31860bb44f2acf67182c40016cd1e7) Updates `https://github.com/jdx/jactionlint` from v2.3.0 to 2.4.0 - [Release notes](https://github.com/jdx/jactionlint/releases) - [Changelog](https://github.com/jdx/jactionlint/blob/main/CHANGELOG.md) - [Commits](https://github.com/jdx/jactionlint/compare/a65ab044e916760429068fe5794b8306abdfcbb9...baa8d685e2b27ff5821558c9eeabb2051c1da61b) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.90.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-and-hooks - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-and-hooks - dependency-name: https://github.com/fsfe/reuse-tool dependency-version: 6.3.0 dependency-type: direct:production dependency-group: actions-and-hooks - dependency-name: https://github.com/simonvanlierde/jsonvet dependency-version: 3.3.1 dependency-type: direct:production dependency-group: actions-and-hooks - dependency-name: https://github.com/zizmorcore/zizmor-pre-commit dependency-version: 1.32.0 dependency-type: direct:production dependency-group: actions-and-hooks - dependency-name: https://github.com/jdx/jactionlint dependency-version: 2.4.0 dependency-type: direct:production dependency-group: actions-and-hooks ... Signed-off-by: dependabot[bot] --- .github/workflows/compose.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .pre-commit-config.yaml | 8 ++++---- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/compose.yml b/.github/workflows/compose.yml index 6d9dd02..23a18fd 100644 --- a/.github/workflows/compose.yml +++ b/.github/workflows/compose.yml @@ -30,7 +30,7 @@ jobs: # `just secrets` scans the git history; a shallow clone would pass vacuously. fetch-depth: 0 persist-credentials: false - - uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0 + - uses: taiki-e/install-action@c509219cf42fba86913069efd0ade2458c59337b # v2.90.1 with: tool: just@1.59.0 # just/local.just adds the secrets, hygiene, infra and test checks. GitHub sets CI, so a diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d5700e7..854ceb0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -35,6 +35,6 @@ jobs: results_file: results.sarif results_format: sarif publish_results: true - - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 with: sarif_file: results.sarif diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 2c6a70d..9aa05dc 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -41,7 +41,7 @@ repos: # Every file has a copyright and license, from REUSE.toml or its own header. - repo: https://github.com/fsfe/reuse-tool - rev: a1bb792acda6fd0724936b4ebbdbc8eceb9c0459 # frozen: v6.2.0 + rev: ea739bff9c6daa1c4c8a5c5dfd069f3fb0374728 # frozen: v6.3.0 hooks: - id: reuse @@ -49,7 +49,7 @@ repos: # .json files are read as JSON5, so comments and trailing commas in tsconfig # and VS Code settings pass; syntax errors and duplicate keys fail. - repo: https://github.com/simonvanlierde/jsonvet - rev: 022d320d5b971eccb28cfa6ce205152cbb382e53 # frozen: v3.2.0 + rev: 83df66110a108e0fa4b7d2b2adcef6831f618e05 # frozen: v3.3.1 hooks: - id: jsonvet @@ -75,7 +75,7 @@ repos: # and impostor commits. Set GH_TOKEN to enable the audits that need the API; # without it only the offline subset runs. - repo: https://github.com/zizmorcore/zizmor-pre-commit - rev: c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f # frozen: v1.31.1 + rev: 06a39750ec31860bb44f2acf67182c40016cd1e7 # frozen: v1.32.0 hooks: - id: zizmor @@ -83,7 +83,7 @@ repos: # and shellcheck over every `run:` when shellcheck is on PATH. jactionlint is a # maintained fork of actionlint that adds release, cache and concurrency checks. - repo: https://github.com/jdx/jactionlint - rev: a65ab044e916760429068fe5794b8306abdfcbb9 # frozen: v2.3.0 + rev: baa8d685e2b27ff5821558c9eeabb2051c1da61b # frozen: v2.4.0 hooks: - id: jactionlint - repo: https://github.com/rvben/rumdl-pre-commit