From c327f1b80f047e3fe149bf4e8fbeafc03a332a8b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 09:28:45 +0000 Subject: [PATCH 1/2] Bump the actions group with 3 updates Bumps the actions group with 3 updates: [actions/setup-java](https://github.com/actions/setup-java), [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `actions/setup-java` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad) Updates `github/codeql-action/init` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/build.yaml | 2 +- .github/workflows/codeql.yaml | 6 +++--- .github/workflows/consumer-compatibility.yaml | 10 +++++----- .github/workflows/dependency-submission.yaml | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 059cb3c..b7f0f9b 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -36,7 +36,7 @@ jobs: - name: Check JSP and Jakarta source parity run: python3 scripts/check-taglib-parity.py - name: Set up JDK 17 - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: java-version: '17' distribution: 'temurin' diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 4c8929b..fd57322 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -42,18 +42,18 @@ jobs: python3 scripts/check-ci-version.py --ref "$GITHUB_REF" echo "MAVEN_OPTS=-Dmaven.repo.local=$RUNNER_TEMP/m2" >> "$GITHUB_ENV" - if: matrix.language == 'java-kotlin' - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: '17' - - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Compile all libraries and the optional Jakarta application if: matrix.language == 'java-kotlin' run: ./mvnw -B -ntp clean package -PtestJakarta -DskipTests - - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: category: /language:${{ matrix.language }} output: target/codeql-results diff --git a/.github/workflows/consumer-compatibility.yaml b/.github/workflows/consumer-compatibility.yaml index 020e608..e4beb17 100644 --- a/.github/workflows/consumer-compatibility.yaml +++ b/.github/workflows/consumer-compatibility.yaml @@ -32,7 +32,7 @@ jobs: run: | python3 scripts/check-ci-version.py --ref "$GITHUB_REF" echo "MAVEN_OPTS=-Dmaven.repo.local=$RUNNER_TEMP/m2" >> "$GITHUB_ENV" - - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: '17' @@ -77,7 +77,7 @@ jobs: run: | python3 scripts/check-ci-version.py --ref "$GITHUB_REF" echo "MAVEN_OPTS=-Dmaven.repo.local=$RUNNER_TEMP/m2" >> "$GITHUB_ENV" - - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: ${{ matrix.java }} @@ -110,7 +110,7 @@ jobs: run: | python3 scripts/check-ci-version.py --ref "$GITHUB_REF" echo "MAVEN_OPTS=-Dmaven.repo.local=$RUNNER_TEMP/m2" >> "$GITHUB_ENV" - - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: | @@ -164,7 +164,7 @@ jobs: run: | python3 scripts/check-ci-version.py --ref "$GITHUB_REF" echo "MAVEN_OPTS=-Dmaven.repo.local=$RUNNER_TEMP/m2" >> "$GITHUB_ENV" - - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: ${{ matrix.java }} @@ -194,7 +194,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: '17' diff --git a/.github/workflows/dependency-submission.yaml b/.github/workflows/dependency-submission.yaml index f8ebd16..b574ce5 100644 --- a/.github/workflows/dependency-submission.yaml +++ b/.github/workflows/dependency-submission.yaml @@ -42,7 +42,7 @@ jobs: run: | python3 scripts/check-ci-version.py --ref "$GITHUB_REF" echo "MAVEN_OPTS=-Dmaven.repo.local=$RUNNER_TEMP/m2" >> "$GITHUB_ENV" - - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: '17' From 57ddbeb1d254a31b8e402703b8b1a42b003512bc Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Tue, 20 Oct 2026 09:29:10 +0200 Subject: [PATCH 2/2] Refresh reviewed action pins and compatibility notes --- .github/ACTION_PINS.md | 21 ++++++++++++++++----- .github/CI_SECURITY.md | 2 +- 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/.github/ACTION_PINS.md b/.github/ACTION_PINS.md index 291479d..a090532 100644 --- a/.github/ACTION_PINS.md +++ b/.github/ACTION_PINS.md @@ -1,24 +1,25 @@ # Reviewed action pins Resolved release tags through each authoritative repository Git ref (including -annotated-tag dereferencing) on 2026-10-18 UTC, matching the current workflows. +annotated-tag dereferencing) on 2026-10-18 UTC; Setup Java and CodeQL were +updated and rechecked on 2026-10-20 UTC, matching the current workflows. These are source pins, not claims that runtime tool downloads are made immutable by pinning an action. | Repository/action | Release | Commit | | --- | --- | --- | | `actions/checkout` | [v7.0.1](https://github.com/actions/checkout/releases/tag/v7.0.1) | `3d3c42e5aac5ba805825da76410c181273ba90b1` | -| `actions/setup-java` | [v6.0.1](https://github.com/actions/setup-java/releases/tag/v6.0.1) | `de7274f081f381c8f8158605e0321c36c376e2e6` | +| `actions/setup-java` | [v6.1.0](https://github.com/actions/setup-java/releases/tag/v6.1.0) | `b843ebf9b913146b38da2eaa7aeddf76074ae1ad` | | `actions/upload-artifact` | [v7.0.2](https://github.com/actions/upload-artifact/releases/tag/v7.0.2) | `cf430e030ddbb5b0abf93d22962f4752f3646cd9` | | `actions/download-artifact` | [v8.0.2](https://github.com/actions/download-artifact/releases/tag/v8.0.2) | `9000827ccba6bdab643e8b6fd33ac0654aef8333` | -| `github/codeql-action` | [v4.38.3](https://github.com/github/codeql-action/releases/tag/v4.38.3) | `24c54180a607b1449ed407dd24f251e4e9147c8d` | +| `github/codeql-action` | [v4.39.0](https://github.com/github/codeql-action/releases/tag/v4.39.0) | `6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee` | | `advanced-security/maven-dependency-submission-action` | [v6.0.1](https://github.com/advanced-security/maven-dependency-submission-action/releases/tag/v6.0.1) | `a64327a7329c9939cf675e458452febe1894a70c` | CodeQL uses the `init` and `analyze` subactions at the same commit. No other external actions or reusable workflows are referenced. Upload/download were originally reviewed together for PR #175 and advanced with CodeQL in [PR #240](https://github.com/OWASP/owasp-java-encoder/pull/240). The current -release-to-commit mappings were rechecked on 2026-10-18; this inventory refresh +release-to-commit mappings were rechecked on the dates above; this inventory refresh does not claim a new full source audit. The two artifact-action release tags resolve directly to the commits above. All actions are JavaScript actions, not composite actions with hidden @@ -26,7 +27,7 @@ actions with hidden paths were reviewed, along with the release changes. CodeQL's release tag is annotated: the Git ref points to tag object -`cee97f86b972a3ded3c58d04148362b193ddc518`, which must be dereferenced to the +`48870fdd6b42ee6474ec4207209ff87609271a5e`, which must be dereferenced to the commit in the table. Do not copy an annotated tag object's SHA into a commit pin. Verify the object's type and follow tag targets until it is a commit (equivalently, inspect the peeled `refs/tags/^{}` Git ref). @@ -36,6 +37,11 @@ pin. Verify the object's type and follow tag targets until it is a commit service when absent from the hosted toolcache and verifies the distribution. Dependency caching is disabled. JDK version lines are intentionally updated within their supported major versions; a commit pin does not pin the JDK bytes. + The v6.1.0 source review covered Temurin version parsing, download verification, + GPG-agent cleanup, Maven settings generation and dependency updates. Its new + credential-origin and plugin-repository inputs are unused here. The changed + Central exclusion behavior requires repository inputs that these workflows + do not set. - Artifact actions use bundled clients and GitHub's artifact service. Both run on Node.js 24 and require a runner supporting that runtime (2.327.1+); this project uses current GitHub-hosted runners, including in Java 8 jobs. The action runtime @@ -52,6 +58,11 @@ pin. Verify the object's type and follow tag targets until it is a commit - CodeQL runs bundled JavaScript and obtains its corresponding CodeQL tools/query bundle. No repository token with content-write permission or custom scanner secret is available to the analysis jobs. + The v4.39.0 source review covered tool retrieval, checkout validation, caching + and status reporting. Its minimum CodeQL bundle is 2.20.7; these workflows use + the action's newer default bundle. Init and analyze both use the workspace-root + checkout, satisfying the new checkout-path validation. Default Setup's proxy + changes do not enable Default Setup or a private registry in this repository. - Maven submission v6.0.1 runs the checkout's Maven command with the pinned `com.github.ferstl:depgraph-maven-plugin:4.0.3`, then submits with GitHub's bundled dependency toolkit. It has no composite action references. Its source logs diff --git a/.github/CI_SECURITY.md b/.github/CI_SECURITY.md index 1995063..72bb716 100644 --- a/.github/CI_SECURITY.md +++ b/.github/CI_SECURITY.md @@ -27,7 +27,7 @@ original packaged bytes. No privileged job restores PR artifacts or caches. All Maven invocations use a fresh runner-temporary repository. Shared Maven caching is deliberately disabled, including Java 8's necessary `install`, all -scanner builds, and intentional release commits. Setup Java's pinned v6.0.1 +scanner builds, and intentional release commits. Setup Java's pinned v6.1.0 does expose cache controls, but this configuration does not rely on any of them. See [local quarantine guidance](../RELEASING.md#maven-storage-and-repository-controls).