Skip to content

chore(deps): bump the actions group across 1 directory with 3 updates - #135

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-bbc57f1620
Closed

chore(deps): bump the actions group across 1 directory with 3 updates#135
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-bbc57f1620

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 3 updates in the / directory: github/codeql-action, hyperpolymath/smtp-notify-action and trufflesecurity/trufflehog.

Updates github/codeql-action from 4.39.1 to 4.39.3

Release notes

Sourced from github/codeql-action's releases.

v4.39.3

  • Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

  • Update default CodeQL bundle version to 2.27.4. #4284
  • Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
  • Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243
Changelog

Sourced from github/codeql-action's changelog.

4.39.3 - 04 Nov 2026

  • Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

  • Update default CodeQL bundle version to 2.27.4. #4284
  • Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
  • Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243
Commits
  • 33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
  • 24393f8 Update changelog for v4.39.3
  • 064910b Merge pull request #4297 from github/mbg/update-glob
  • f532ac5 Update glob to 14.0.3
  • 8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
  • cea289b Return different exit code when a language is not recognised
  • 7287bb3 Remove exclude entry that's no longer needed
  • 8eb7cdf Use normal .editorconfig pattern
  • 160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
  • 913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
  • Additional commits viewable in compare view

Updates hyperpolymath/smtp-notify-action from 0.5.0 to 0.5.1

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.5.1

Protocol-neutral server_address metadata

server_address is the host input for both SMTP and NNTP, and remained the only input in action.yml still described as SMTP-only ('SMTP server host name'). It now reads:

description: 'Server host name (SMTP or NNTP, per protocol: `protocol`)'

The secure and diagnose folded scalar descriptions were also rewrapped to line width (Reports → reports after the colon in diagnose), and the download URL in action.yml now points to v0.5.1.

Because workflow editors, consumers, and GitHub Marketplace read action.yml from the release tag — and tags are immutable here — this ships as v0.5.1 rather than moving v0.5.0. v0.5.0 remains supported in SECURITY.md since the binary and input surface are unchanged.

For the full NNTP posting (protocol: nntp, newsgroups) and Marketplace readiness notes introduced in the 0.5 series, see v0.5.0 and CHANGELOG.adoc.

Provenance

Zero Zig or Idris2 source files changed between v0.5.0 and v0.5.1. CI rebuilt both static musl binaries from this tag and verified they hash byte-identically to the unchanged SHA-256 pins inside action.yml before publishing. SHA256SUMS is attached:

2683da8f619dd5f310c9f6884da39e825c807c2c86a6319c19aba39b27f9c5c9  smtp-notify-x86_64-linux-musl
a58138308fb9832e1ceb551a12f1b04e591dc38ba5fd336c9acfb3f263161f29  smtp-notify-aarch64-linux-musl
Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

== v0.5.1 — 2026-10-24

A metadata correction, and the release to publish the Marketplace listing from. The binary is byte-identical to v0.5.0's — the two SHA-256 pins are unchanged and re-verified by the release workflow — so v0.5.0 remains supported and correct for anyone already pinned to it. A new tag rather than an edit of the existing one because a tag is immutable here: consumers pin SHAs, and GitHub reads action.yml from the tag, which is the same property that made v0.5.0 necessary in the first place.

NOTE: The v0.5.0 heading below carries a note that the tag had to be pushed immediately after its merge. That was done, and the release published the same day; the note is left in place because it describes a property of the release process, not a pending task.

=== Fixed

  • server_address is no longer described as SMTP-only. The field is the host for both protocols, and the description said 'SMTP server host name' — the last input description that still read as if the news transport did not exist. It now reads 'Server host name (SMTP or NNTP, per protocol: protocol)'. Cosmetic, but workflow editors and consumers read action.yml from the release ref, which is why it ships as a new tag rather than a main-only edit.

=== Changed

  • The asset URL names v0.5.1. The pins do not move: the binary did not change.
  • The secure and diagnose input descriptions were rewrapped to the file's line width (and Reports lowercased after the colon in diagnose).
  • README.adoc's three pinned examples and .github/SECURITY.md's supported-versions table follow the current release.
Commits
  • e384daf fix(action): protocol-neutral server_address wording (needs tag v0.5.1) (#28)
  • See full diff in compare view

Updates trufflesecurity/trufflehog from 3.99.3 to 3.99.8

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.8

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.99.7...v3.99.8

v3.99.7

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.99.6...v3.99.7

v3.99.6

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

... (truncated)

Commits
  • ea68ca0 Verify BoxOauth credentials only when Box issues a token for a subject (#5498)
  • 7238e0e Clean up GitLab source logging for per-source debug (#5485)
  • 5a3176f Update module github.com/mattn/go-isatty to v0.0.24 (#5366)
  • a74daf6 Update module github.com/jlaffaye/ftp to v0.2.4 (#5365)
  • 1641840 Update module github.com/go-git/go-git/v5 to v5.19.3 (#5480)
  • ee5d0d2 Cap 7z LZMA and LZMA2 dictionary sizes and keep scanning past refused entries...
  • 421026a Recover from detector panics in the verification overlap worker (#5495)
  • 6973459 Close Couchbase clusters after verification and honor the context (#5489)
  • 87adc84 Add source fields to Init logs in single-source CLI commands (#5466)
  • 020634e Clean up Docker source logging for per-source debug (#5494)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the actions group across 1 directory with 3 updates
c8ab48b 
Bumps the actions group with 3 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action), [hyperpolymath/smtp-notify-action](https://github.com/hyperpolymath/smtp-notify-action) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog).


Updates `github/codeql-action` from 4.39.1 to 4.39.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v4.39.1...v4.39.3)

Updates `hyperpolymath/smtp-notify-action` from 0.5.0 to 0.5.1
- [Release notes](https://github.com/hyperpolymath/smtp-notify-action/releases)
- [Changelog](https://github.com/hyperpolymath/smtp-notify-action/blob/main/CHANGELOG.adoc)
- [Commits](hyperpolymath/smtp-notify-action@v0.5.0...v0.5.1)

Updates `trufflesecurity/trufflehog` from 3.99.3 to 3.99.8
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@v3.99.3...v3.99.8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.39.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: hyperpolymath/smtp-notify-action
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.99.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 7, 2026
@coderabbitai

coderabbitai Bot commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 61e3b9f2-c5e6-42f2-9f62-76109befa973

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@sonarqubecloud

sonarqubecloud Bot commented Nov 7, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@dependabot @github

dependabot Bot commented on behalf of github Nov 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 14, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-bbc57f1620 branch November 14, 2026 22:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants