Bump github/codeql-action from 2.13.4 to 3.25.13#9
Bump github/codeql-action from 2.13.4 to 3.25.13#9dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
dependabot
bot
added
dependencies
muir
force-pushed
the
dependabot/github_actions/github/codeql-action-3.25.13
branch
from
14dc6d8 to
aaab07c
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #9 +/- ##
=======================================
Coverage 82.80% 82.80%
=======================================
Files 5 5
Lines 250 250
=======================================
Hits 207 207
Misses 30 30
Partials 13 13 ☔ View full report in Codecov by Sentry. |
|
A newer version of github/codeql-action exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
|
@dependabot recreate |
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.13.4 to 3.25.13. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdcdbb5...2d79040) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/github_actions/github/codeql-action-3.25.13
branch
from
aaab07c to
5c4758c
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb | ||
| uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc |
There was a problem hiding this comment.
Pinned commit hash doesn't match stated version v3.25.13
Medium Severity
The commit hash 38697555549f1db7851b81482ff19f1fa5c4fedc pinned in the workflow does not correspond to github/codeql-action v3.25.13 as stated in the PR title. The correct hash for v3.25.13 is 2d790406f505036ef40ecba973cc774a50395aac, verified across multiple other repositories' dependabot PRs. This hash likely corresponds to a much newer version (possibly v4.x) due to @dependabot recreate resolving the latest version while keeping the stale PR title. This is a major version mismatch that could introduce unexpected breaking changes.
Additional Locations (2)
|
Superseded by #58. |
dependabot
bot
deleted the
dependabot/github_actions/github/codeql-action-3.25.13
branch
2 participants
Bumps github/codeql-action from 2.13.4 to 3.25.13.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
2d79040Merge pull request #2379 from github/update-v3.25.13-270a29d1c232a8bcUpdate changelog for v3.25.13270a29dMerge pull request #2375 from github/update-supported-enterprise-server-versions58f46daAdd changelog notef216681Announce deprecation of CodeQL v2.13.4 and earlier8e14792Merge pull request #2374 from github/aeisenberg/eslinte6663d9Update supported GitHub Enterprise Server versions455bd98Update checked-in dependencies778c2bcFix eslint configuration3cf7236Migrate toeslint.config.mjsYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Low risk: this only updates the pinned
github/codeql-actionversion used in CI scanning, with no product/runtime code changes. Main risk is potential CodeQL workflow behavior differences or analysis failures due to the major action upgrade (v2 -> v3).Overview
Updates the
CodeQLGitHub Actions workflow to use a newer pinned commit ofgithub/codeql-actionfor theinit,autobuild, andanalyzesteps (v2.13.4 -> v3.25.13).Written by Cursor Bugbot for commit 5c4758c. This will update automatically on new commits. Configure here.