[dependabot]

Bumps https://github.com/jdx/jactionlint from v2.2.0 to 2.3.0. This release includes the previously tagged commit.

Release notes

Sourced from https://github.com/jdx/jactionlint's releases.

v2.3.0: allow-unused for config ignores, and a Go toolchain fix for online checks

jactionlint 2.3.0 adds an allow-unused option to ignores entries in the config file and fixes a workflow-call-permissions false positive for OIDC. It is also built with Go 1.27.3, so online checks reject certificates from the compromised eMudhra CA.

Added

• allow-unused for durable ignores. An ignores entry with allow-unused: true is not reported as unused-ignore when it suppresses nothing. Use it for findings that come and go, such as one caused by a moving tag. expired-ignore still reports the entry when it expires. The default is false, and any value other than true or false is a config error. The option is also in the config JSON Schema. (#297, @​jdx)

  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true

Fixed

• workflow-call-permissions no longer reports a missing id-token: write when the caller sets no permissions: and assume-default-permissions is permissive or not set. In that case, GitHub gives the called job an OIDC token. With assume-default-permissions: restricted, jactionlint still reports it. (#299, @​jdx)
• Online checks reject forged certificates from the compromised eMudhra CA. Release binaries are now built with Go 1.27.3, which rejects these certificate chains. Older binaries do not have this fix, so replace them with this release if you use --online. (#301, @​jdalton)

New Contributors

• @​jdalton made their first contribution in #292

Full Changelog: jdx/jactionlint@v2.2.0...v2.3.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.

Changelog

Sourced from https://github.com/jdx/jactionlint's changelog.

Changelog

2.4.0 (2026-10-28)

Features

• invisible-characters: report Private Use Area characters (#311) (b4a8d08)

Bug Fixes

• artipacked: skip actions/checkout v6 and later (#308) (7a5eb59)
• dependabot-syntax: don't report a multi-ecosystem group update as a duplicate (#314) (1950126)
• sarif: stop writing primaryLocationLineHash (#307) (beecbca)

2.3.0 (2026-10-21)

Features

• config: add allow-unused to durable ignores (#297) (69311d3)
• upstream: catch workflow analyzer gaps earlier (#288) (439e97d)

Bug Fixes

• build with Go 1.27.3 to reject compromised eMudhra certificates (#301) (cca9bb8)
• workflow-call-permissions: grant id-token to a silent caller under the permissive default (#299) (493a916)

2.2.0 (2026-10-14)

Features

• action-input-dependencies: report inputs of well-known actions that need each other (#207) (ef17270)
• action-release-cooldown: report an action at a version younger than N days (online, opt-in) (#235) (7dbd838)
• action: check the inputs of any remote action against its action.yml with --online (#231) (ac30cbe)
• actions-lock: lint GitHub's Actions lock file against the workflows (#237) (c9d8944)
• argument-injection: report free text in the program or the options of sed, awk, find and tar (#221) (ecf46dc)
• aube: understand aube in the rules that know npm, pnpm, yarn and bun (#254) (f6d9319)
• cache-poisoning: add pnpm/setup, graalvm and composer, and report caches of credential files (#216) (e3c29f0)
• cache-poisoning: report more zizmor findings and add a pedantic tier (#160) (c725459)
• cli: add --ruff, --show-doc-urls, --finding-context, platform forgejo and jujutsu roots (#215) (8e31c5c)
• cli: add shell completions and --explain RULE (#204) (b3b09d3)
• cli: add the options select, no-ignores and list-rules (#200) (dca5092)
• cli: show only the findings on what changed since a revision (--changed-since) (#274) (ea0ac90)
• command-injection: report input that a script runs as code after it moved to env (#202) (ebeeb6f)
• comment-trigger-authorization: report comment-triggered jobs that do not check who commented (pedantic) (#217) (60fa75e)
• concurrency-deadlock: report a group that a workflow shares with the workflow it calls (#210) (c41e2ad)

... (truncated)

Commits

• a65ab04 chore(main): release 2.3.0 (#295)
• cca9bb8 fix: build with Go 1.27.3 to reject compromised eMudhra certificates (#301)
• 4aa701f test(schema): pin the latest actions/runner schemas (#300)
• 493a916 fix(workflow-call-permissions): grant id-token to a silent caller under the p...
• 69311d3 feat(config): add allow-unused to durable ignores (#297)
• 439e97d feat(upstream): catch workflow analyzer gaps earlier (#288)
• 1bcb264 docs: rewrite the README and redesign the home page (#293)
• 8f0ce5d ci: parallelize unit tests and builds (#292)
• e278392 docs: generate the social image in the docs build (#291)
• dfd49ed docs: refresh the social image for 2.2 (#290)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)