chore(deps): Bump github.com/automa-saga/automa from 0.11.0 to 0.11.1

[dependabot]

Bumps github.com/automa-saga/automa from 0.11.0 to 0.11.1.

Release notes

Sourced from github.com/automa-saga/automa's releases.

v0.11.1

0.11.1 (2026-07-11)

Bug Fixes

• deps: upgrade Go to 1.26.5 to remediate SNYK-GOLANG-STDOS-17905377 (#108) (88afed7)

Commits

• 88afed7 fix(deps): upgrade Go to 1.26.5 to remediate SNYK-GOLANG-STDOS-17905377 (#108)
• f38858d build(deps): bump actions/setup-node from 6.2.0 to 6.4.0 (#102)
• dc5aa9c build(deps): bump actions/checkout from 6.0.2 to 7.0.0 (#103)
• ea45fed build(deps): bump actions/setup-go from 6.2.0 to 6.5.0 (#104)
• 22eb10f build(deps): bump arduino/setup-task from 2.0.0 to 3.0.0 (#105)
• 7c6e4bb chore(deps): upgrade Go to 1.26.5 to align with org standard (#107)
• 8d74568 build(deps): bump step-security/harden-runner from 2.14.1 to 2.19.4 (#100)
• bee2b08 build(deps): bump golang.org/x/sync from 0.19.0 to 0.22.0 (#106)
• 20288c2 docs: add specification docs (#97)
• See full diff in compare view

[swirlds-automation]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[alex-au]

@dependabot rebase

[alex-au]

🤖 Dependabot review — no concerns

Reviewed the diff for github.com/automa-saga/automa: 0.11.0 → 0.11.1 (Go non-vendored upgrade).

Purpose: Security bump — upgrades the module’s minimum Go toolchain from 1.25.0 to 1.26.5 to remediate SNYK-GOLANG-STDOS-17905377, plus bumps golang.org/x/sync from 0.19.0 to 0.22.0.

Upstream compare (v0.11.0...v0.11.1) — 10 files, 9 commits:

File	Verdict
go.mod / go.sum	Go 1.25.0→1.26.5, golang.org/x/sync 0.19.0→0.22.0 — expected
.github/workflows/*.yaml (4 files)	Upstream-only CI; Go version pin + SHA-pinned action bumps — all action refs remain commit-SHA pinned, no tag-only downgrades
docs/ (4 added files)	Documentation only — no runtime impact

Checks performed:

• ✅ Diff scoped to expected files (go.mod, go.sum only — no vendor/ changes, no application source)
• ✅ No Go source (.go) files changed in upstream module between v0.11.0 and v0.11.1
• ✅ No install/build hooks added or modified
• ✅ No new process spawning, network, or credential-access patterns
• ✅ No workflow / CI changes in our repo
• ✅ No obfuscated payloads (base64 blobs, bidi/zero-width chars)
• ✅ No unexpected file additions or deletions in our diff
• ✅ go.sum hash entries updated (2 old removed, 2 new added) — consistent with a single module version change
• ✅ Upstream commit authors are known maintainers (leninmehedy) and dependabot[bot]
• ✅ All upstream CI action refs remain commit-SHA pinned (no tag-only pins introduced)
• ✅ No bidi/zero-width obfuscation in diff

Automated review by Claude. Verify before merging — this is a second pair of eyes, not a replacement for human review.

[alex-au]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.