build(deps): bump the github-actions group with 2 updates by dependabot[bot] · Pull Request #89 · thedavidweng/sdf-flash-gui

dependabot · 2026-10-23T19:57:10Z

Bumps the github-actions group with 2 updates: taiki-e/install-action and jdx/jactionlint.

Updates taiki-e/install-action from 2.87.27 to 2.87.29

Release notes

Sourced from taiki-e/install-action's releases.

2.87.29

Update zizmor@latest to 1.31.0.

Update wasmtime@latest to 49.0.3.

Update wasm-tools@latest to 1.262.0.

Update uv@latest to 0.13.1.

Update trivy@latest to 0.76.0.

Update tombi@latest to 1.8.4.

Update release-plz@latest to 0.3.172.

Update osv-scanner@latest to 2.7.0.

Update mise@latest to 2026.10.11.

Update mdbook-d2@latest to 0.3.9.

Update kingfisher@latest to 2.13.0.

Update kache@latest to 1.2.1.

Update just@latest to 1.59.0.

Update dprint@latest to 0.63.0.

Update cargo-crap@latest to 0.8.0.

Update bpf-linker@latest to 0.12.0.

2.87.28

Update dprint@latest to 0.62.0.

Update vacuum@latest to 0.33.0.

Update uv@latest to 0.13.0.

Update tombi@latest to 1.8.1.

Update release-plz@latest to 0.3.171.

Update rclone@latest to 1.75.2.

Update mise@latest to 2026.10.7.

Update cargo-binstall@latest to 1.25.3.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

Update vacuum@latest to 0.35.0.

Update xh@latest to 0.26.3.

Update uv@latest to 0.13.5.

Update ubi@latest to 0.13.0.

Update trivy@latest to 0.76.1.

Update tombi@latest to 1.9.0.

Update release-plz@latest to 0.3.174.

Update prek@latest to 0.5.7.

Update mise@latest to 2026.10.17.

Update jaq@latest to 3.1.2.

Update espup@latest to 0.17.1.

Update cargo-zigbuild@latest to 0.24.0.

Update cargo-nextest@latest to 0.9.149.

Update biome@latest to 2.6.2.

[2.87.30] - 2026-10-21

Update zizmor@latest to 1.31.1.

Update wasmtime@latest to 50.0.0.

Update vacuum@latest to 0.33.2.

Update uv@latest to 0.13.4.

... (truncated)

Commits

8cca091 Release 2.87.29
fc26824 Update wasmtime manifest
5018b2e Update zizmor@latest to 1.31.0
d0e5204 Update wasmtime@latest to 49.0.3
517774f Update wasm-tools@latest to 1.262.0
4bc69b1 Update vacuum manifest
0470a3f Update uv@latest to 0.13.1
7a2b747 Update trivy@latest to 0.76.0
7efb533 Update tombi@latest to 1.8.4
e5d37d6 Update release-plz@latest to 0.3.172
Additional commits viewable in compare view

Updates jdx/jactionlint from 2.1.0 to 2.2.0

Release notes

Sourced from jdx/jactionlint's releases.

v2.2.0: New rules, repository-aware CLI modes, and a PyPI package

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (--changed-since), rule discovery (--list-rules, --explain, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the default or correctness profile, so a run that was clean on 2.1.0 can show new findings. See Changed before you upgrade.

Highlights

More checks before a run fails: shell syntax errors without shellcheck, JavaScript syntax errors in actions/github-script, job permissions too narrow for the actions in the job, gh without a token, ubuntu-slim limits, github.event property typos, and validation of GitHub's Actions lock file.

Deeper security analysis: untrusted-checkout, cache-poisoning, template-injection and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.

Better for CI and tooling: report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with pip/uvx.

Added

New rules in the default and correctness profiles

shell-syntax (default, error): reports syntax errors in bash/sh run: scripts, such as an unclosed quote or a missing fi/done, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @jdx)

insufficient-permissions (default, error): reports a job whose explicit permissions: miss a scope that one of its actions needs (upload-sarif, deploy-pages, OIDC logins, gh release create, git push and others, about 26 entries). missing-permissions --fix now uses the same table to write job-level permissions when the needs are exact. (#192, @jdx)

ubuntu-slim-limits (default, error): reports container:, services: and Docker container actions in jobs that run only on ubuntu-slim. With pedantic, it also reports timeout-minutes above 15. missing-timeout --fix limits its value to 15 for these jobs. (#190, @jdx)

actions-lock (default, error) and actions-lock-drift (online): check .github/workflows/actions.lock against the workflows. They report missing, stale and malformed entries. With --online, they also report replaced repositories, moved tags and commits that are on no branch or tag. Repositories without a lock file are not affected. unpinned-uses accepts a ref that the lock file pins to a commit. (#237, #228, @jdx)

hardcoded-registry-credentials (default, error): reports plain-text passwords, tokens and keys in registries of dependabot.yml, including passwords embedded in a registry URL. (#265, @jdx)

gh-without-token (correctness): reports a gh command that needs a token in a step where no GH_TOKEN/GITHUB_TOKEN is set. (#177, @jdx)

environment-file-redirect (correctness): reports writes to GITHUB_OUTPUT (and similar files) without the $, and a > that overwrites data the same script already wrote. It has a fix: safe for the missing $, unsafe for >. (#184, @jdx)

github-script-syntax (correctness): checks the script input of actions/github-script with node --check. It knows the argument names of each action version, so it catches errors like const glob = require(...). It needs Node.js 20 or later on PATH; without it, the rule is skipped and a note says so. (#242, @jdx)

malformed-expression-delimiters (correctness): reports ${ github.ref }, $ {{ x }} and {{ github.sha }}. (#180, @jdx)

multiline-plain-run (correctness): reports a multi-line run: that YAML folds into a single line. (#205, #256, @jdx)

concurrency-deadlock (correctness): reports a concurrency group that a workflow shares with a local reusable workflow it calls. GitHub cancels such runs as a deadlock. (#210, @jdx)

conflicting-action-inputs (correctness), plus new missing-action-input cases: report input combinations of well-known actions that cannot work, for example download-artifact name with artifact-ids, or nick-fields/retry without exactly one timeout input. (#207, @jdx)

undefined-property now checks github.event.* property names against the webhook payloads, down to three levels. By default, it reports only names that no event has. The strict-event-payloads option, on in the pedantic profile, also reports properties that the workflow's own triggers don't have. (#249, @jdx)

New pedantic rules

deprecated-runner-label: warns about runner labels with an announced retirement date (macos-14, ubuntu-22.04), with replacement labels. (#182)

deprecated-node-runtime: reports runs.using: node20/16/12 in action metadata, popular actions at majors that declare node20, and environment variables that select the Node.js runtime. (#225, #230, #234)

command-injection: reports untrusted input that was moved to env: but then runs as code (eval, bash -c, python -c, execSync in github-script, and similar). (#202)

argument-injection: reports free text in the program of sed/awk, in find -exec, or as a leading word of tar, curl, git clone and others. (#221)

output-clobbering: reports input that can contain line breaks written to GITHUB_OUTPUT as a single record. (#212)

comment-trigger-authorization: reports comment-triggered jobs that don't check who commented. (#217)

event-name-never-received: reports github.event_name compared with an event the workflow never receives. (#214)

fail-fast-action-inputs: reports actions configured to pass when they produced nothing. (#196)

macos-gnu-flags: reports GNU-only options in run scripts of macOS jobs. (#241)

unmatched-paths-filter: reports paths filters that match no file in the repository. (#238)

missing-version-comment: reports a commit-SHA pin without a version comment. --online --fix adds the comment. (#232)

unused-workflow-secret: reports on.workflow_call.secrets that nothing reads. (#223)

All by @jdx.

New online rules
repojacking: reports an action or reusable workflow whose owner name anyone could register. It runs on github.com only. (#248, @jdx)

unpinnable-action: reports an action pinned by hash whose own dependencies are not pinned. (#240, @jdx)
action-release-cooldown (opt-in): reports an action at a version released less than N days ago. It is off until the config has an entry for it:

... (truncated)

Changelog

Sourced from jdx/jactionlint's changelog.

Changelog

2.3.0 (2026-10-21)

Features

config: add allow-unused to durable ignores (#297) (69311d3)

upstream: catch workflow analyzer gaps earlier (#288) (439e97d)

Bug Fixes

build with Go 1.27.3 to reject compromised eMudhra certificates (#301) (cca9bb8)

workflow-call-permissions: grant id-token to a silent caller under the permissive default (#299) (493a916)

2.2.0 (2026-10-14)

Features

action-input-dependencies: report inputs of well-known actions that need each other (#207) (ef17270)

action-release-cooldown: report an action at a version younger than N days (online, opt-in) (#235) (7dbd838)

action: check the inputs of any remote action against its action.yml with --online (#231) (ac30cbe)

actions-lock: lint GitHub's Actions lock file against the workflows (#237) (c9d8944)

argument-injection: report free text in the program or the options of sed, awk, find and tar (#221) (ecf46dc)

aube: understand aube in the rules that know npm, pnpm, yarn and bun (#254) (f6d9319)

cache-poisoning: add pnpm/setup, graalvm and composer, and report caches of credential files (#216) (e3c29f0)

cache-poisoning: report more zizmor findings and add a pedantic tier (#160) (c725459)

cli: add --ruff, --show-doc-urls, --finding-context, platform forgejo and jujutsu roots (#215) (8e31c5c)

cli: add shell completions and --explain RULE (#204) (b3b09d3)

cli: add the options select, no-ignores and list-rules (#200) (dca5092)

cli: show only the findings on what changed since a revision (--changed-since) (#274) (ea0ac90)

command-injection: report input that a script runs as code after it moved to env (#202) (ebeeb6f)

comment-trigger-authorization: report comment-triggered jobs that do not check who commented (pedantic) (#217) (60fa75e)

concurrency-deadlock: report a group that a workflow shares with the workflow it calls (#210) (c41e2ad)

concurrency-limits: report schedule-only and manual-only workflows (pedantic) (#266) (c1ec820)

config: JSON Schemas for the config file and for --format json (#195) (5f83de6)

dangerous-triggers: say what the token and the secrets can do, and make a workflow without privileges pedantic (#189) (97e79e7)

deprecated-node-runtime: report a Node.js runtime that GitHub removed in the metadata of an action (pedantic) (#225) (84dd922)

deprecated-node-runtime: report popular actions at majors that declare node20 (pedantic) (#230) (8a9fc95)

deprecated-node-runtime: report the environment variables that chose the Node.js runtime (pedantic) (#234) (6531d87)

environment-file-redirect: report writes to GITHUB_OUTPUT that lose the data (#184) (79cc5ef)

event-name-never-received: report github.event_name compared with an event the workflow never receives (#214) (b3bfcc4)

external-tools: say when shellcheck or pyflakes did not run (#188) (f7280e5)

facts: export the events, permissions, concurrency and calls of a repository as versioned JSON (--export-facts) (#272) (881dde9)

fail-fast-action-inputs: report actions that pass when nothing was produced (#196) (f856144)

fix: say why more findings have no fix, add --show-fix-status and the fix prerequisites to --explain (#269) (7aa3187)

gh-without-token: report the gh command without GH_TOKEN or GITHUB_TOKEN (#177) (1d997da)

github-app: check two more token actions and cover local composite actions in dependabot-missing-actions-update (#229) (e5b620e)

... (truncated)

Commits

1027f0a chore(main): release 2.2.0 (#162)
1de90e2 fix(action-release-cooldown): use the clock of the linter so the docs check d...
a6c8dd3 fix(cli): align user-facing messages with the documented behavior (#287)
a058e9c test(check-checks): generate the outputs of the checks page that were written...
e2d3304 fix(api): accept nil LinterOptions, print the rule ID in Error and PrettyPrin...
1a848ff fix(config): a missing file in "extends" of a discovered config file is an er...
3f9e648 fix(ignore): read own-line ignore directives from real YAML comments only (#284)
3165939 fix(download-script): report a missing release, accept amd64, fix the help te...
ae1664f docs: rewrite the documentation and split the usage guide (#281)
31ee66e feat(shell-syntax): report syntax errors in run scripts without shellcheck (#...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 2 updates: [taiki-e/install-action](https://github.com/taiki-e/install-action) and [jdx/jactionlint](https://github.com/jdx/jactionlint). Updates `taiki-e/install-action` from 2.87.27 to 2.87.29 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@ab68953...8cca091) Updates `jdx/jactionlint` from 2.1.0 to 2.2.0 - [Release notes](https://github.com/jdx/jactionlint/releases) - [Changelog](https://github.com/jdx/jactionlint/blob/main/CHANGELOG.md) - [Commits](jdx/jactionlint@a0bb9f0...1027f0a) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.87.29 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: jdx/jactionlint dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-23T19:57:15Z

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

coderabbitai · 2026-10-23T19:57:21Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: a0f3eff5-2944-4cfc-808e-6948bb11922d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026

github-actions Bot enabled auto-merge (squash) October 23, 2026 19:57

github-actions Bot merged commit e224ea7 into main Oct 23, 2026
15 checks passed

dependabot Bot deleted the dependabot/github_actions/github-actions-995400b406 branch October 23, 2026 19:58

Navigation Menu

Repository navigation

build(deps): bump the github-actions group with 2 updates - #89

build(deps): bump the github-actions group with 2 updates#89
github-actions[bot] merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-995400b406

dependabot Bot commented on behalf of github Oct 23, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 23, 2026

Uh oh!

coderabbitai Bot commented Oct 23, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026

2.87.29

2.87.28

Changelog

[Unreleased]

[2.87.30] - 2026-10-21

v2.2.0: New rules, repository-aware CLI modes, and a PyPI package

Highlights

Added

New rules in the default and correctness profiles

New pedantic rules

New online rules

Changelog

2.3.0 (2026-10-21)

Features

Bug Fixes

2.2.0 (2026-10-14)

Features

Uh oh!

dependabot Bot commented on behalf of github Oct 23, 2026

Labels

Uh oh!

coderabbitai Bot commented Oct 23, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

New rules in the `default` and `correctness` profiles