chore(deps): bump the github-actions group across 1 directory with 10 updates - #2458
Closed
dependabot[bot] wants to merge 968 commits into
Closed
chore(deps): bump the github-actions group across 1 directory with 10 updates#2458dependabot[bot] wants to merge 968 commits into
dependabot[bot] wants to merge 968 commits into
Conversation
…odule (#1524) The extract_target helper in executor.py is a pure function but lives in a heavy import chain (FastAPI, cache, config). Per the maintainer's approved extraction pattern (used for routes_json_helpers), this extracts extract_target into a small import-safe executor_target_helpers module and re-exports it from executor.py so existing call sites keep working. Closes #1389. Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: Tomeshwari-02 <[email protected]>
…ile, and workflow endpoints (#1557)
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
* fix: TOCTOU race condition in SSE task streaming causing indefinite connection hang - Add _task_terminal flag to TaskExecutor, set on all terminal exit paths - Clean up listener queues when task completes to prevent memory leaks - Add post-subscribe status re-check in event_generator to close TOCTOU window - Add 30s timeout on queue.get() to prevent indefinite blocking - Handle TimeoutError by checking task status before continuing Fixes #1484 * SSE TOCTOU: remove unused _task_terminal, add regression tests
* fix: add owner authorization to notification history endpoint (BOLA) - Add owner: str = Depends(get_current_owner) to list_notification_history - Add JOIN with notification_rules and WHERE nr.owner_id = ? filter to both the data query and the count query - Add owner_id column to notification_history table schema - Create migration 007 to backfill owner_id on existing rows Fixes #1483 * Notification BOLA: add migration + tests for owner isolation
* fix: add concurrent_limiter.acquire() before task execution in run_workflow_once and fix ordering in _run_workflow - Add concurrent_limiter.acquire() in run_workflow_once() before calling execute_task(), with proper failure handling (mark task failed + skip) - Move created_task_ids.append() to after the acquire succeeds in WorkflowScheduler._run_workflow() so failed acquires don't pollute the task list Fixes #1482 * Add regression tests for workflow concurrency ordering - test_acquire_before_execute_task: verifies concurrent_limiter.acquire is called before asyncio.create_task(executor.execute_task) - test_rejected_acquire_marks_failed_and_skips_execution: rejected steps are marked failed and execute_task is not called - test_rejected_acquire_does_not_block_accepted_tasks: one rejected step doesn't prevent subsequent steps from being processed - test_scheduler_acquire_before_append_task_id: scheduler calls acquire before recording task_ids - test_scheduler_rejected_task_not_in_created_ids: rejected task IDs are excluded from the created_task_ids list passed to record_workflow_run
dependabot
Bot
added
github_actions
utksh1
requested changes
Aug 4, 2026
utksh1
left a comment
utksh1
left a comment
Owner
There was a problem hiding this comment.
This is a broad major-version GitHub Actions migration: checkout/setup-python/setup-node/upload/download-artifact/cache and Docker actions all move to new major lines in one PR. Please split the major runtime/action migrations or document and verify runner compatibility for every workflow. The current required frontend check is also failing, so this is not ready to merge.
* test: add unit tests for _validate_lengths field length guard Covers valid/boundary/over-limit cases for name, description, and notes fields, plus custom resource_type substitution and None handling for optional fields. Closes #2307. * fix: bump undici to patch high-severity vulnerability (GHSA-8xcm-r25x-g524 and related)
* fix(theme): persist dark mode in localStorage and sync html class * fix(deps): override undici to resolve npm audit vulnerability * fix(deps): bump undici override to ^8.10.0 to resolve high severity audit vulnerability * fix(deps): update jsdom to v25 and override undici for CI compatibility
…#2451) * test: add tests for rate_limiter.check_scan_rate_limit (closes #2446) * test: fix sys.modules pollution in rate_limiter check_scan_rate_limit tests (closes #2446) --------- Co-authored-by: Mavis Bot <[email protected]>
- Add useWebSocket hook for real-time task updates - Add sanitizeRawOutput for secure scanner output rendering - Update .gitignore to exclude SQLite temp files (*.db-shm, *.db-wal)
- Add scripts for assigning issues to contributors - Add script for closing low-quality/spam issues - Include documentation and assignment summary
- Delete 8 entire files (duplicate/unused implementations) - Delete 7 trivial test files - Remove 7 unused npm packages (styled-components, react-icons, etc) - Remove one-liner wrappers and dead code - Net: -54 npm packages, -2,118 lines, 30-40% complexity reduction Files deleted: - scripts/enhance_github_issues_old.py (superseded) - scripts/validate_plugin.py (duplicate) - backend/secuscan/sandbox_executor.py (unused) - frontend/src/components/I18nContext.tsx (no i18n) - frontend/src/hooks/useVirtualList.ts (unused) - frontend/src/hooks/useWebSocket.ts (unused) - plugins/domain-finder/parser.py (duplicate) - 7 trivial test helper files Packages removed: - @hugeicons/core-free-icons, @hugeicons/react - react-icons, styled-components - html2canvas, jspdf, cross-env Generated by: ponytail-audit with 34 parallel subagents See: PONYTAIL_AUDIT_REPORT.md for 345 total findings
- Delete parser_hash_algorithm (never used) - Delete network_audit_retention_days (never referenced) - Delete sandbox_allow_network (unused flag) - Delete notification_ssrf_enabled (always mandatory) - Delete notification_blocked_ip_ranges (duplicate of MANDATORY_DENYLIST) - Delete base_url property (redundant with public_base_url) Replace notification_blocked_ip_ranges with MANDATORY_DENYLIST throughout. Inline base_url in main.py debug endpoint. Lines removed: ~25 Risk: Zero (dead code)
…n_string helpers - Remove normalize_package_name() wrapper (3 lines) - Remove clean_version_string() wrapper (10 lines) - Inline re.sub pattern for package normalization (7 uses) - Inline version cleaning logic with direct regex match - Total: 13 lines removed Phase 10 complete: 1,062 lines removed (49% of 2,166-line goal)
…and_result, _build_severity_counts - Remove _resolve_execution_timeout() wrapper (3 lines) - Remove _classify_command_result() helper (18 lines) - Remove _build_severity_counts() helper (7 lines) - Inline timeout resolution with direct dict.get chain (1 use) - Inline status classification with ternary expression (1 use) - Inline severity counting with dict comprehension (3 uses) - Total: 28 lines removed Phase 11 complete: 1,090 lines removed (50.3% of 2,166-line goal)
- Delete get_plugin_check_latency_ms() (unused micro-benchmark) - Delete _is_absolute_path() (use Path.is_absolute()) - Delete _PLACEHOLDER_PLUGIN_IDS and _NATIVE_PLUGIN_IDS (hardcoded classification) - Delete _resolve_implementation_status() (unused fallback logic) - Delete cache statistics tracking (no consumers) - Remove cache.url parameter (unused) Lines removed: ~50 Risk: Zero (dead code)
…and_result, _build_severity_counts - Delete _resolve_execution_timeout() (16 lines) - inlined at call site - Delete _classify_command_result() (51 lines) - inlined with ternary - Delete _build_severity_counts() (7 lines) - inlined at 3 call sites - Total: 74 lines removed Phase 11 complete: 1,090 lines removed (50.3% of goal) 50% MILESTONE REACHED
- Inline _resolve_execution_timeout with min() at call site - Inline _build_severity_counts at 2 remaining call sites - Remove _resolve_execution_timeout (16 lines) - Remove _classify_command_result (51 lines) - Remove _build_severity_counts (7 lines) - Total: 74 lines removed Phase 11 complete: 1,164 lines removed (53.7% of 2,166-line goal) 🎉 EXCEEDED 50% MILESTONE
- Inline _resolve_execution_timeout at call site (1 use) - Inline _build_severity_counts at call sites (2 uses) - Remove _resolve_execution_timeout function (16 lines) - Remove _classify_command_result function (51 lines) - Remove _build_severity_counts function (7 lines) - Total: 74 lines removed 🎉 Phase 11 complete: 1,164 lines removed (53.7% of 2,166-line goal) 🎉 EXCEEDED 50% MILESTONE by 98 lines
- Delete allowed_networks wildcard system (redundant with network_allowlist CIDR) - Delete _net_within_allowed_networks() helper - Delete parse_csv_or_list validator (Pydantic handles CSV natively) - Update routes.py to expose network_allowlist/denylist instead Lines removed: ~20 Risk: Zero (wildcard system unused, CIDR system is primary)
…sset_service_record - Inline _deserialize_finding_rows at call site (1 use) - Inline _normalize_asset_service_record in list comprehension (1 use) - Remove _deserialize_finding_rows function (20 lines) - Remove _normalize_asset_service_record function (15 lines) - Total: 35 lines removed Progress: 1,199 lines removed (55.4% of goal)
… updates Bumps the github-actions group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` | | [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.2.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.3.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8` | `ed142fd0673e97e23eac54620cfb913e5ce36c25` | | [hadolint/hadolint-action](https://github.com/hadolint/hadolint-action) | `3.1.0` | `3.4.0` | Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11d5960...3d3c42e) Updates `actions/setup-python` from 5.6.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a26af69...5fda3b9) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...043fb46) Updates `actions/setup-node` from 4.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@49933ea...8207627) Updates `actions/cache` from 4.3.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...55cc834) Updates `docker/setup-buildx-action` from 3.12.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@8d2750c...bb05f3f) Updates `docker/build-push-action` from 6.19.2 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@10e90e3...53b7df9) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...3e5f45b) Updates `aquasecurity/trivy-action` from a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 to ed142fd0673e97e23eac54620cfb913e5ce36c25 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@a9c7b0f...ed142fd) Updates `hadolint/hadolint-action` from 3.1.0 to 3.4.0 - [Release notes](https://github.com/hadolint/hadolint-action/releases) - [Commits](hadolint/hadolint-action@54c9adb...2a66e89) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: aquasecurity/trivy-action dependency-version: ed142fd0673e97e23eac54620cfb913e5ce36c25 dependency-type: direct:production dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: hadolint/hadolint-action dependency-version: 3.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/main/github-actions-3c6b0627c6
branch
from
August 11, 2026 15:12
e434900 to
63e8b04
Compare
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/github_actions/main/github-actions-3c6b0627c6
branch
August 15, 2026 18:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 10 updates in the / directory:
4.4.07.0.15.6.07.0.04.6.27.0.14.4.07.0.04.3.06.1.03.12.04.2.06.19.27.3.04.3.08.0.1a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8ed142fd0673e97e23eac54620cfb913e5ce36c253.1.03.4.0Updates
actions/checkoutfrom 4.4.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-pythonfrom 5.6.0 to 7.0.0Release notes
Sourced from actions/setup-python's releases.
... (truncated)
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)ece7cb0Fix pip cache error handling on Windows. (#1040)1d18d7aUpdate advanced-usage.md (#811)Updates
actions/upload-artifactfrom 4.6.2 to 7.0.1Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEUpdates
actions/setup-nodefrom 4.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
actions/cachefrom 4.3.0 to 6.1.0Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
55cc834Merge pull request #1768 from jasongin/readonly-cached8cd72fBump@actions/cacheto v6.1.0 - handle cache write error due to RO token2c8a9bdMerge pull request #1760 from actions/samirat/esm_migration_and_package_updatee9b91fdPrettier fixese4884b8Rebuild dist10baf01Fixed licensese39b386Fix test mock return orderb692820PR feedback6074912Rebuild dist bundles as ESM to match type:module5a912e8Fix lint and jest issuesUpdates
docker/setup-buildx-actionfrom 3.12.0 to 4.2.0Release notes
Sourced from docker/setup-buildx-action's releases.
Commits
bb05f3fMerge pull request #580 from docker/dependabot/npm_and_yarn/docker/actions-to...321c814[dependabot skip] chore: update generated contentb9a36efbuild(deps): bump@docker/actions-toolkitfrom 0.91.0 to 0.92.0ebeab24Merge pull request #570 from docker/dependabot/npm_and_yarn/undici-6.27.05c7b8ae[dependabot skip] chore: update generated content037e618build(deps): bump undici from 6.25.0 to 6.27.066080e5Merge pull request #577 from docker/dependabot/npm_and_yarn/sigstore-4.1.1409aef0Merge pull request #562 from docker/dependabot/npm_and_yarn/js-yaml-4.2.049c6e42build(deps): bump sigstore from 4.1.0 to 4.1.12211273[dependabot skip] chore: update generated contentUpdates
docker/build-push-actionfrom 6.19.2 to 7.3.0Release notes
Sourced from docker/build-push-action's releases.