From d91779079988f4db59a45de91d83ef2fd230c559 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:09:55 +0000 Subject: [PATCH] deps(actions): bump the actions group with 3 updates Bumps the actions group with 3 updates: [taiki-e/install-action](https://github.com/taiki-e/install-action), [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `taiki-e/install-action` from 2.86.5 to 2.87.0 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/ba47c86ac325773530516bb756137ac718732518...37f7c5781271959fb65b6b35224e28652ff2b63d) Updates `github/codeql-action/init` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.87.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 6 +++--- .github/workflows/codeql.yml | 4 ++-- .github/workflows/fuzz.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b19a5d2a..bf46844f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,7 +34,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@1.95.0 # Prebuilt cargo-deny — do not cargo install. Pin Action commit (CodeQL). - - uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5 + - uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0 with: # 0.18.x cannot parse rustsec CVSS 4.0 advisories (2026). tool: cargo-deny@0.20.2 @@ -58,7 +58,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Not in taiki-e TOOLS.md; install-action falls back to cargo-binstall # (GitHub Release prebuilt). Do not cargo install. - - uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5 + - uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0 with: tool: ast-grep@0.45.1 - name: ast-grep fixture self-test @@ -207,7 +207,7 @@ jobs: workspaces: ". -> target/cov" # Prebuilt binary — do not `cargo install` (compiles llvm-cov from crates.io). # Pin commit (CodeQL: unpinned 3rd-party Action tags are not immutable). - - uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5 + - uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0 with: tool: cargo-llvm-cov@0.6.14,cargo-crap@0.4.3 - name: coverage (line gate) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 61e4af79..e3b62199 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -63,7 +63,7 @@ jobs: uses: dtolnay/rust-toolchain@1.95.0 # nixpkgs/crane rustc pin — not Dependabot - name: Initialize CodeQL - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -72,6 +72,6 @@ jobs: queries: security-extended - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 4eeeb2e5..2d48f829 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -39,7 +39,7 @@ jobs: # Prebuilt cargo-fuzz — do not cargo install (compiles from crates.io # inside the 20-min job timeout). Pin Action commit (CodeQL). - - uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5 + - uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0 with: tool: cargo-fuzz@0.13.2