Skip to content

chore(deps): bump the github-actions group with 3 updates - #48

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-54b0e3b03d
Closed

chore(deps): bump the github-actions group with 3 updates#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-54b0e3b03d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 3 updates: actions/setup-python, zizmorcore/zizmor-action and trufflesecurity/trufflehog.

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits
  • 6d4fd22 Cache upgrade to 6.3.0 (#1370)
  • ec52d0a Bump @鈥媡ypescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
  • ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
  • 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
  • 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
  • 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
  • e1be392 Bump @鈥媡ypes/semver from 7.7.1 to 7.8.0 (#1359)
  • 06da627 Bump @鈥媣ercel/ncc from 0.44.0 to 0.45.0 (#1357)
  • af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
  • 7aeabeb Bump @鈥媡ypescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
  • Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 馃悰馃敆

  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 馃尡馃敆

  • The typosquat-uses audit now supports pre-commit config inputs (#2437)

  • The self-hosted-runner audit is now significantly more precise (#2350)

    Many thanks to @鈥媢biratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

  • zizmor is now aware of the image_version workflow trigger (#2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

    Many thanks to @鈥媢biratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 馃悰馃敆

... (truncated)

Commits

Updates trufflesecurity/trufflehog from 3.99.2 to 3.99.3

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.3

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.2...v3.99.3

Commits
  • e63326d github: name the missing permission when a comment listing is refused (#5438)
  • 048de9f Update module google.golang.org/grpc to v1.83.2 [SECURITY] (#5431)
  • 31d7303 Add per-logger debug level override for source logging (#5432)
  • feea7f9 Add SonarQube Server token detector (#5419)
  • 27d8ea2 fix(github): use a single "app client registry" to make sure we reuse client ...
  • b40e7fe [INT-1051] Fix GitHub comment scans stopping early on large repositories (#5405)
  • 9e93a20 Update module google.golang.org/grpc to v1.83.1 [SECURITY] (#5426)
  • 4b56723 Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [S...
  • 37a6f6e Replace deprecated google.CredentialsFromJSON with CredentialsFromJSONWithTyp...
  • 6404b63 Update module filippo.io/edwards25519 to v1.1.1 [SECURITY] (#5421)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the github-actions group with 3 updates
3971cb3 
Bumps the github-actions group with 3 updates: [actions/setup-python](https://github.com/actions/setup-python), [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog).


Updates `actions/setup-python` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@5fda3b9...6d4fd22)

Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@cc914d7...85b2b9f)

Updates `trufflesecurity/trufflehog` from 3.99.2 to 3.99.3
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@e76dff8...e63326d)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.99.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 24, 2026
@lissy93 lissy93 closed this Oct 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lissy93