chore(deps): bump the actions group across 1 directory with 4 updates by dependabot[bot] · Pull Request #736 · hyperpolymath/hypatia

dependabot · 2026-08-27T21:13:56Z

Bumps the actions group with 4 updates in the / directory: taiki-e/install-action, dawidd6/action-send-mail, trufflesecurity/trufflehog and actions/setup-java.

Updates taiki-e/install-action from 2.86.5 to 2.86.7

Release notes

Sourced from taiki-e/install-action's releases.

2.86.7

Update tombi@latest to 1.4.1.

Update rafn@latest to 0.1.5.

Update cargo-binstall@latest to 1.22.0.

2.86.6

Update dprint@latest to 0.56.1.

Update cargo-lambda@latest to 1.9.2.

Update biome@latest to 2.5.10.

Changelog

Sourced from taiki-e/install-action's changelog.

[2.86.7] - 2026-08-24

Update tombi@latest to 1.4.1.

Update rafn@latest to 0.1.5.

Update cargo-binstall@latest to 1.22.0.

[2.86.6] - 2026-08-23

Update dprint@latest to 0.56.1.

Update cargo-lambda@latest to 1.9.2.

Update biome@latest to 2.5.10.

Commits

b6ff580 Release 2.86.7
a4b7b62 Update tombi@latest to 1.4.1
7f5d2c4 Update rafn@latest to 0.1.5
0223cb3 Update mise manifest
80434f8 Update kingfisher manifest
45d93f4 Update cargo-zigbuild manifest
7754905 Update cargo-binstall@latest to 1.22.0
6cd1350 Release 2.86.6
0110a1e Update tombi manifest
48a83f9 Update rafn manifest
Additional commits viewable in compare view

Updates dawidd6/action-send-mail from 3.12.0 to 18

Release notes

Sourced from dawidd6/action-send-mail's releases.

v18

What's Changed

build(deps): bump brace-expansion from 5.0.5 to 5.0.6 by @dependabot[bot] in dawidd6/action-send-mail#291

build(deps): bump nodemailer from 8.0.7 to 8.0.8 by @dependabot[bot] in dawidd6/action-send-mail#292

build(deps): bump nodemailer from 8.0.8 to 8.0.9 by @dependabot[bot] in dawidd6/action-send-mail#293

build(deps): bump nodemailer from 8.0.9 to 8.0.10 by @dependabot[bot] in dawidd6/action-send-mail#294

build(deps): bump nodemailer from 8.0.10 to 8.0.11 by @dependabot[bot] in dawidd6/action-send-mail#295

build(deps): bump nodemailer from 8.0.11 to 9.0.0 by @dependabot[bot] in dawidd6/action-send-mail#296

node_modules: update by @dawidd6 in dawidd6/action-send-mail#297

build(deps): bump nodemailer from 9.0.0 to 9.0.1 by @dependabot[bot] in dawidd6/action-send-mail#299

build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in dawidd6/action-send-mail#300

fix: Use extended HELLO with github.com domain by @kroese in dawidd6/action-send-mail#302

Full Changelog: dawidd6/action-send-mail@v17...v18

v17

What's Changed

build(deps): bump nodemailer from 8.0.2 to 8.0.3 by @dependabot[bot] in dawidd6/action-send-mail#278

build(deps): bump nodemailer from 8.0.3 to 8.0.4 by @dependabot[bot] in dawidd6/action-send-mail#280

build(deps): bump nodemailer from 8.0.4 to 8.0.5 by @dependabot[bot] in dawidd6/action-send-mail#282

build(deps): bump brace-expansion from 1.1.12 to 1.1.13 by @dependabot[bot] in dawidd6/action-send-mail#283

build(deps): bump showdown from 1.9.1 to 2.1.0 by @dependabot[bot] in dawidd6/action-send-mail#284

build(deps): bump @actions/core from 3.0.0 to 3.0.1 by @dependabot[bot] in dawidd6/action-send-mail#285

build(deps): bump @actions/glob from 0.6.1 to 0.7.0 by @dependabot[bot] in dawidd6/action-send-mail#286

build(deps): bump nodemailer from 8.0.5 to 8.0.6 by @dependabot[bot] in dawidd6/action-send-mail#288

build(deps): bump nodemailer from 8.0.6 to 8.0.7 by @dependabot[bot] in dawidd6/action-send-mail#289

node_modules: update by @dawidd6 in dawidd6/action-send-mail#290

Full Changelog: dawidd6/action-send-mail@v16...v17

v16

What's Changed

Relax from check by @felfert in dawidd6/action-send-mail#277

Full Changelog: dawidd6/action-send-mail@v15...v16

v15

What's Changed

build(deps): bump undici from 6.23.0 to 6.24.1 by @dependabot[bot] in dawidd6/action-send-mail#275

node_modules: update by @dawidd6 in dawidd6/action-send-mail#276

Full Changelog: dawidd6/action-send-mail@v14...v15

v14

What's Changed

Fix 234 by @felfert in dawidd6/action-send-mail#271

... (truncated)

Commits

94de994 fix: Use extended HELLO with github.com domain (#302)
6e50282 build(deps): bump actions/checkout from 6 to 7 (#300)
1d138f3 build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)
1369c5b node_modules: update (#297)
d86d472 build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)
19dc783 build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)
0dd1be8 build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)
6bf8b9c build(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)
51e2c0d build(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)
076b075 build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)
Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.97.0 to 3.97.1

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.1

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in trufflesecurity/trufflehog#5196

Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in trufflesecurity/trufflehog#4777

docs: add generic config-secret custom detector example by @pgmpofu in trufflesecurity/trufflehog#5195

fix(detectors/docker): don't greedy match in keyPat by @mariduv in trufflesecurity/trufflehog#5214

[SCAN-1020] neon scram pgx by @alafiand in trufflesecurity/trufflehog#5217

Raised MongoDB detector timeout value by @jordanTunstill in trufflesecurity/trufflehog#5222

preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in trufflesecurity/trufflehog#5213

[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in trufflesecurity/trufflehog#5224

Refine SECURITY.md by @bradlarsen in trufflesecurity/trufflehog#5216

Carry GitHub App installation ID on repo units by @bill-rich in trufflesecurity/trufflehog#5215

New Contributors

@pgmpofu made their first contribution in trufflesecurity/trufflehog#5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

Commits

20652fb Carry GitHub App installation ID on repo units (#5215)
3ab759f Refine SECURITY.md (#5216)
2cdb97d [SCAN-101] s3 source accept persisted unit envelopes in UnmarshalSourceUnit (...
4ec7749 preallocate bindings capacity in dockerhub and groq, with unit tests (#5213)
9610306 Doubled timeout, as MongoDB secrets are repeatedly hitting this and failing t...
9d3f5d1 [SCAN-1020] neon scram pgx (#5217)
925c1d0 fix(detectors/docker): don't greedy match in keyPat (#5214)
e12da3c docs: add generic config-secret custom detector example (#5195)
bcbcab2 Fix GHEC with Data Residency (*.ghe.com) base URL (#4777)
bc3a3ae Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] (#5196)
See full diff in compare view

Updates actions/setup-java from 5.7.0 to 6.0.0

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

dist: Migrate from Zulu Discovery API to Azul Metadata API by @jameswald in actions/setup-java#1010

feat: add .mvn/extensions.xml to Maven cache key pattern by @brunoborges with @Copilot in actions/setup-java#1041

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-java#1078

Map Zulu x86 architecture to i686 for Azul Metadata API by @brunoborges in actions/setup-java#1079

Rename jdkFile input to jdk-file with deprecated alias by @brunoborges in actions/setup-java#1083

Infer distribution from asdf .tool-versions vendor prefix by @brunoborges in actions/setup-java#1084

Add Maven compiler problem matcher for javac diagnostics by @brunoborges in actions/setup-java#1086

feat: expose cache-primary-key output (#597) by @brunoborges in actions/setup-java#1088

docs: clarify V6 ESM migration is not a user-facing breaking change by @brunoborges in actions/setup-java#1090

Support multi-field Java versions like 18.0.1.1 by @brunoborges in actions/setup-java#1092

docs: document seeding the Maven cache for plugin dependencies by @brunoborges in actions/setup-java#1094

docs: clarify Maven cache paths and key hash inputs by @brunoborges in actions/setup-java#1096

Support pinning java-version as "latest" by @brunoborges in actions/setup-java#1093

chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @dependabot[bot] in actions/setup-java#1101

chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @dependabot[bot] in actions/setup-java#1103

chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @dependabot[bot] in actions/setup-java#1105

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in actions/setup-java#1106

chore(deps-dev): bump @types/node from 26.1.0 to 26.1.1 by @dependabot[bot] in actions/setup-java#1104

dist: Cover Tencent Kona JDK 25 by @johnshajiang in actions/setup-java#1108

chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in actions/setup-java#1102

Preserve Maven toolchains across repeated setup-java runs (#1099) by @brunoborges in actions/setup-java#1111

dist: Support Liberica NIK (#878) by @asm0dey in actions/setup-java#1112

Fix template injection (zizmor alert #118) in e2e-versions.yml by @brunoborges with @Copilot in actions/setup-java#1114

Fix template injection in e2e-versions.yml (zizmor alert #122) by @brunoborges with @Copilot in actions/setup-java#1120

Disable persisted checkout credentials in e2e workflow by @brunoborges with @Copilot in actions/setup-java#1115

feat: Update recommended configuration for GPG signing by @wetneb in actions/setup-java#608

Cache Maven and Gradle wrapper distributions separately from the dependency cache by @brunoborges in actions/setup-java#1097

Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @brunoborges in actions/setup-java#1124

Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @brunoborges in actions/setup-java#1123

Extract repeated directory-check assertions into check-dir.sh helper by @brunoborges in actions/setup-java#1127

Consolidate duplicate jobs in e2e-versions workflow by @brunoborges in actions/setup-java#1125

Use YAML anchors to reduce boilerplate in e2e-versions workflow by @brunoborges in actions/setup-java#1126

Updated msft json for now by @jmjaffe37 in actions/setup-java#1129

Document missing action inputs in README by @brunoborges in actions/setup-java#1130

chore(deps): bump @actions/cache to 6.2.0 by @philip-gai in actions/setup-java#1128

Add an option to disable Java problem matchers by @brunoborges in actions/setup-java#1133

docs: update setup-java examples by @HarithaVattikuti in actions/setup-java#1131

Clarify credential environment variable inputs by @brunoborges in actions/setup-java#1134

chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 by @dependabot[bot] in actions/setup-java#1135

chore(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in actions/setup-java#1143

chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @dependabot[bot] in actions/setup-java#1142

chore(deps-dev): bump @typescript-eslint/parser from 8.64.0 to 8.65.0 by @dependabot[bot] in actions/setup-java#1138

chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by @dependabot[bot] in actions/setup-java#1136

chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in actions/setup-java#1137

chore(deps): fix npm audited vulnerabilities by @mhoffrog in actions/setup-java#1140

Fix formatting issues in README.md by @brunoborges in actions/setup-java#1144

Remediate npm audit findings and rebuild distributions by @brunoborges with @Copilot in actions/setup-java#1145

Set GRAALVM_HOME for GraalVM distributions by @brunoborges with @Copilot in actions/setup-java#1146

... (truncated)

Commits

dd06d9c Prepare documentation for v6 release (#1253)
59b3450 chore(deps): combine open Dependabot npm updates (#1252)
b96213d Set default signature verification for supported distributions (#1246)
1dbac3c docs: expose contributing guide to GitHub (#1245)
11741d6 ci: constrain cache e2e job modes (#1244)
ff99aa1 Fix Oracle macOS E2E version (#1243)
416c6d1 Add Red Hat Build of OpenJDK support (#1241)
5f75b27 Add Maven dependency-resolution repositories (#1240)
a42a52c Add multiple Maven server credentials (#1239)
fb4abd7 test: cover JDK 26 from SDKMAN (#1238)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

codacy-production · 2026-08-27T21:15:15Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production · 2026-08-27T21:17:06Z

    steps:
      - name: Send push notification email
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@v18


_{🔴 HIGH RISK}

This step handles sensitive SMTP secrets. To protect against credential theft via supply chain compromise, pin the action to a full 40-character commit SHA instead of the v18 tag.

See Issue in Codacy

codacy-production · 2026-08-27T21:17:06Z


      - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@v3.97.0
+        uses: trufflesecurity/trufflehog@v3.97.1


_{🔴 HIGH RISK}

Pinning the secret scanner action to a commit SHA is critical. Since this tool actively scans for credentials, ensuring the code being executed is immutable prevents a scenario where a compromised action harvests the very secrets it is intended to detect.

See Issue in Codacy

codacy-production · 2026-08-27T21:17:06Z


      - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@v2.86.5
+        uses: taiki-e/install-action@v2.86.7


_{🔴 HIGH RISK}

Pinning third-party actions to a specific commit SHA is the only way to guarantee the action's code hasn't been tampered with after the version was released. Tags can be moved by repository owners, whereas a SHA is immutable. For a tool like install-action that fetches binaries, this ensures integrity of the build tools.

See Issue in Codacy

hyperpolymath

Approved by Antigravity

hyperpolymath

Approved by Antigravity

hyperpolymath · 2026-08-30T11:44:33Z

@dependabot rebase

dependabot · 2026-08-30T11:44:37Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code major Load-bearing / requirements-level work labels Aug 27, 2026

codacy-production Bot reviewed Aug 27, 2026

View reviewed changes

github-advanced-security Bot found potential problems Aug 28, 2026

View reviewed changes

hyperpolymath approved these changes Aug 28, 2026

View reviewed changes

hyperpolymath enabled auto-merge (squash) August 28, 2026 06:00

hyperpolymath approved these changes Aug 28, 2026

View reviewed changes

hyperpolymath approved these changes Aug 29, 2026

View reviewed changes

hyperpolymath added 2 commits August 29, 2026 04:05

Merge branch 'main' into dependabot/github_actions/actions-e6b38edb2c

3f1349c

Merge branch 'main' into dependabot/github_actions/actions-e6b38edb2c

c2d4257

Merge branch 'main' into dependabot/github_actions/actions-e6b38edb2c

8c0be32

Navigation Menu

Uh oh!

chore(deps): bump the actions group across 1 directory with 4 updates - #736

chore(deps): bump the actions group across 1 directory with 4 updates#736
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/actions-e6b38edb2c

dependabot Bot commented on behalf of github Aug 27, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented Aug 27, 2026

Uh oh!

codacy-production Bot Aug 27, 2026

Uh oh!

codacy-production Bot Aug 27, 2026

Uh oh!

codacy-production Bot Aug 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hyperpolymath left a comment

Uh oh!

hyperpolymath left a comment

Uh oh!

hyperpolymath commented Aug 30, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.86.7

2.86.6

[2.86.7] - 2026-08-24

[2.86.6] - 2026-08-23

v18

What's Changed

v17

What's Changed

v16

What's Changed

v15

What's Changed

v14

What's Changed

v3.97.1

What's Changed

New Contributors

v6.0.0

What's Changed

Uh oh!

codacy-production Bot commented Aug 27, 2026

Up to standards ✅

Uh oh!

codacy-production Bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hyperpolymath left a comment

Choose a reason for hiding this comment

Uh oh!

hyperpolymath left a comment

Choose a reason for hiding this comment

Uh oh!

hyperpolymath commented Aug 30, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Aug 27, 2026 •

edited

Loading