[dependabot]

Bumps the github-actions group with 7 updates in the / directory:

Package	From	To
github/codeql-action/init	4.38.3	4.39.1
github/codeql-action/analyze	4.38.3	4.39.1
github/codeql-action/upload-sarif	4.38.3	4.39.1
cachix/install-nix-action	31.11.1	31.11.3
actions/setup-java	6.0.1	6.1.0
securego/gosec	2.29.0	2.30.0
zizmorcore/zizmor-action	0.6.4	0.8.0

Updates github/codeql-action/init from 4.38.3 to 4.39.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.4. #4284

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.38.3 to 4.39.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.4. #4284

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.38.3 to 4.39.1

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.4. #4284

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates cachix/install-nix-action from 31.11.1 to 31.11.3

Release notes

Sourced from cachix/install-nix-action's releases.

31.11.3

This tag was incorrectly named. Prefer v31.11.3.

What's Changed

• nix: 2.35.3 -> 2.35.4 by @​xokdvium in cachix/install-nix-action#283 Security: Updates the bundled certificates shipped with the installer to remove the compromised eMudhra certificates.

Full Changelog: cachix/install-nix-action@v31.11.2...31.11.3

v31.11.3

What's Changed

• nix: 2.35.3 -> 2.35.4 by @​xokdvium in cachix/install-nix-action#283 Security: Updates the bundled certificates shipped with the installer to remove the compromised eMudhra certificates.

Re-release of 31.11.3, which was tagged incorrectly.

Full Changelog: cachix/install-nix-action@v31.11.2...v31.11.3

v31.11.2

What's Changed

• nix: 2.35.2 -> 2.35.3 by @​github-actions[bot] in cachix/install-nix-action#282 Security: Fixes a number of vulnerabilities that could be combined to achieve root priviledge escalation. See https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

Full Changelog: cachix/install-nix-action@v31.11.1...v31.11.2

Commits

• 75c75c3 Merge pull request #283 from xokdvium/cacert-bump
• 3736037 nix: 2.35.3 -> 2.35.4
• 448cde7 Merge pull request #282 from cachix/create-pull-request/patch
• 280a411 nix: 2.35.2 -> 2.35.3
• See full diff in compare view

Updates actions/setup-java from 6.0.1 to 6.1.0

Release notes

Sourced from actions/setup-java's releases.

v6.1.0

What's Changed

• Preserve compound Liberica build versions from .sdkmanrc by @​brunoborges with @​Copilot in actions/setup-java#1268
• Support Temurin on Linux RISC-V by @​yawkat in actions/setup-java#1269
• Stop GPG agent before removing signature-verification home by @​brunoborges with @​Copilot in actions/setup-java#1273
• Prefer Zulu 4-segment hotfix builds when resolving version ranges by @​brunoborges in actions/setup-java#1278
• Support Temurin JEP 322 patch versions like 26.0.2.1+1 by @​brunoborges in actions/setup-java#1279
• chore(deps): bump undici from 6.28.0 to 6.29.0 by @​dependabot[bot] in actions/setup-java#1274
• chore(deps): bump the monthly-npm-updates group with 13 updates by @​dependabot[bot] in actions/setup-java#1276
• feat: support Maven server credential origins by @​YunaBraska in actions/setup-java#1282
• Support Maven plugin repositories in generated settings.xml by @​brunoborges in actions/setup-java#1286

New Contributors

• @​yawkat made their first contribution in actions/setup-java#1269
• @​YunaBraska made their first contribution in actions/setup-java#1282

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

Commits

• b843ebf Support Maven plugin repositories in generated settings.xml (#1286)
• 2a69be2 feat: support Maven server credential origins (#1282)
• d0e6e4d chore(deps): bump the monthly-npm-updates group with 13 updates (#1276)
• b24925b chore(deps): bump undici from 6.28.0 to 6.29.0 (#1274)
• 47b3648 Support Temurin JEP 322 patch versions like 26.0.2.1+1 (#1270) (#1279)
• 74920aa Prefer Zulu 4-segment hotfix builds when resolving version ranges (#1278)
• a78ec39 Stop GPG agent before removing signature-verification home (#1273)
• 97c5a5e Support Temurin on Linux RISC-V (#1269)
• 1aa87b6 Preserve compound Liberica build versions from .sdkmanrc (#1268)
• See full diff in compare view

Updates securego/gosec from 2.29.0 to 2.30.0

Release notes

Sourced from securego/gosec's releases.

v2.30.0

Changelog

• 5eb1d104ef85ff2c905c877eb600e8c1dee33a22 fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
• cc750ddcf0d2219e121034f86db3c6c2f3c76d50 fix(G112): honor read timeouts assigned through a struct field (#1798)
• 1cbfd7e6488c2464f18603623354de1be9565b39 fix(G112): report read timeouts explicitly set to zero (#1797)
• 05b9c4c0a7f49e421d7a459922a11bc0c0dd7197 feat(G706): extend log/slog method coverage (#1795)
• 17ad2dd7533fd4c773d916e2bc81446917d593b5 fix(autofix): read the first text block of a Claude response (#1794)
• b23171c64c662de0bc757c17feced6f4c10a877e fix(autofix): give every AI request its own timeout (#1793)
• 20b9e5b1bcc56518b240bf1afc333d6589163cae fix(resolve): treat constants from other packages as resolved (#1792)
• 86d3c26c060940ea7b6832c3b0d41e8ebf07a146 fix(autofix): return an error when a Gemini candidate has no content (#1791)
• 14ef84f6feccf40be7f5092fd2db119bf3f5f836 Update to go version 1.27.3 and 1.26.10 (#1790)
• 7cbd7a927365c48badf18bfb118e5503d606351f fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
• 1e26bcef55d71e330db7ca5e494be6165ffbc35f fix(G102): resolve concatenated and constant listen addresses (#1787)
• 836dbdb55d40238f021780afc91c237898db85e3 fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786)
• bbd69e23f657862f7e6d615dd8ba077663d593a3 fix(g602): track statically known lengths for append results in slice bounds check (#1773)
• 30e2d38421dc927e1f4f7148dcb822c1308cf4cc feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777)
• 57c45b800aa0cbd12994ea142537673fd15d54b8 fix: load absolute file paths so nested modules are analysed from the parent directory (#1779)
• 77fa84e3a47a5532d6893467f3df13d2af907541 fix(G118): treat a cancel sent on a channel as handed off (#1782)
• ca547ab2f2c6c7c378bbb91e76e5b97321b55934 fix(G112): honor read timeouts assigned after the http.Server literal (#1781)
• 024084bafcb4182ad1c0af86134aa71a819d6f52 fix(G303): resolve constant temp file paths (#1784)
• 782eeb188eebedaf2335f3adac7052d106670324 fix(deps): update all dependencies (#1783)
• 707f2271f66579a18e1da25794b1e8012247274b fix(G203): treat constant template arguments as safe (#1770)
• 8c5daa67d0e2bec9069da20146b0e928fb9fa53b fix(G402): check TLS settings assigned through a *tls.Config (#1769)
• 71577268350e1e0f2f1491de1ef53f1227b43c1f fix(deps): update all dependencies (#1775)
• 7b1b5cebe007d62fb58eacb90fc571112939ec30 Update to go version 1.27.2 and 1.26.9 (#1772)
• d2b649ec01825c20bd101ec584e559adb287e578 Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767)
• 1f52e64f6dfe434ae4261574baa9495c2532a6de fix(G602): track append() results for slice bounds checking (#1754)
• ea75d9ff49b6bbea15f0eb5e0483408a553019a6 fix(deps): update all dependencies (#1768)
• 65c2c082857febe898116edeb1fcddea0193634a fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752)
• 6ff893e9ef3f172b24f235acba2a31dab66fa379 fix(G407): treat an array IV/nonce as a zeroed buffer (#1763)
• aaca8946492fb2a6ff3598c185ff97776e12ea6f fix(fileperms): resolve constant file and directory permissions (#1766)
• 826f6f4fd18b7b0cf0a76b2df1994b3eb90da8f3 fix(G102): detect binding to the IPv6 unspecified address (#1760)
• 021cc2eae58ed8ea0160ca8beab93648daefc0e7 fix(G407): stop the nonce source walk on cycles (#1761)
• ccb369da13791bade6e735e70e833d0d095b7db0 fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762)
• 9b318063d35cfc5cdf2456de3b92830270e80326 fix(deps): update all dependencies (#1764)
• 8c77519419e934a3e158dbf1a3fbbc0871b8c691 fix(G602): validate inequality len guards (#1757)
• 027baa29ac97f58e9200d664d4ba63c9ea47a5ae fix(G121): track request captured by closures (#1759)
• 9ede89eea46b783aa0a1d28804b817c6d57ff36d fix(deps): update all dependencies (#1756)
• 29a042eca11db9ff0b3985146c5dd3ac46bbd24e fix: make nosec suppression independent of comment order (#1741)
• 681347199262bc33b9b5119ae2b448dec5718240 fix(G403): resolve constant RSA key sizes (#1751)
• 201d4136b42ab474d230d73ada12f7f98e57d8b0 fix(G602): validate subslice bounds under equality guards (#1749)
• accb42475d41cfbf54df86bdf7e3e97b9f9bfbe5 fix(G124): resolve negated constant cookie flags (#1748)
• 61fa1dafbaa3e41a5cb42a02eba204af91f60a41 fix(G602): report constant index equal to the length asserted by an equality guard (#1746)
• 78fbcc7b89a935cdf88bb6a4ecd2a73d1c2e26c5 Skip taint call graphs when no sinks match (#1745)
• 79b4fcd5e4aeed2f53ce93c499b63e4cb51e516e Fix brittle test for html writer (#1744)
• d70cac375c74052389aed6f2209fd2fd942dc6ab fix(G404): ignore non-cryptographic Shuffle calls (#1742)
• 9e8e5d91f2f39f90a574a18f55351b4a4832dacb fix(deps): update all dependencies (#1743)
• 8075fd2e520d33330afe168f26fc7a91f57f2cbc fix(taint): remove Result.Source field that is never populated (#1739)
• 58362d8a331e123b887741c27056f459c8b0660f Update all dependencies (#1737)
• d98945a5b2856e4586445089f564085c3b453e8f Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738)

... (truncated)

Commits

• 5eb1d10 fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
• cc750dd fix(G112): honor read timeouts assigned through a struct field (#1798)
• 1cbfd7e fix(G112): report read timeouts explicitly set to zero (#1797)
• 05b9c4c feat(G706): extend log/slog method coverage (#1795)
• 17ad2dd fix(autofix): read the first text block of a Claude response (#1794)
• b23171c fix(autofix): give every AI request its own timeout (#1793)
• 20b9e5b fix(resolve): treat constants from other packages as resolved (#1792)
• 86d3c26 fix(autofix): return an error when a Gemini candidate has no content (#1791)
• 14ef84f Update to go version 1.27.3 and 1.26.10 (#1790)
• 7cbd7a9 fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.8.0

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.8.0

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version of zizmor or version: prerelease to get whatever latest prerelease the action knows about.

What's Changed

• Support prereleases by @​woodruffw in zizmorcore/zizmor-action#182
• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#184

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

... (truncated)

Commits

• 53290ba Sync zizmor versions (#184)
• 76da2ee Support prereleases (#182)
• fb1d87b chore(deps): bump the github-actions group with 2 updates (#180)
• be36601 README: bump pins (#179)
• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Bumps seven GitHub Actions across the CI workflow files to their latest releases.

Notable changes

• CodeQL Action v4.39.0 raises the minimum CodeQL bundle version to 2.20.7.
• cachix/install-nix-action pulls in security fixes for Nix (2.35.3 → 2.35.4).
• gosec bumps to 2.30.0, which may let us drop the GOTOOLCHAIN workaround in security.yml.

^{Written for commit 6ab16a3. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/codeql.yml
• .github/workflows/release.yml
• .github/workflows/scorecard.yml
• .github/workflows/security.yml
• .github/workflows/test.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

🟡 Changes recommended

The gosec bump leaves the Makefile pin out of sync, causing CI and release lockstep checks to fail, while the action still uses a v2.29.0 scanner image without the intended v2.30.0 fixes.

2 open issues

• Update GOSEC_VERSION to match the v2.30.0 action · New
• Pin the action to the v2.30.0 scanner · New

What changed in this PR

Updates SHA-pinned GitHub Actions used by hey-cli’s testing, security scanning, and release workflows. No CLI or TUI application code changes.

Changes:

• Updates CodeQL initialization, analysis, and SARIF upload actions to v4.39.1.
• Bumps gosec to the v2.30.0 action revision and zizmor-action to v0.8.0.
• Updates Nix installation to v31.11.3 and Java setup to v6.1.0.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
.github/​workflows/​test.yml	Updates zizmor and Nix installation actions.
.github/​workflows/​security.yml	Updates gosec and security-result uploads.
.github/​workflows/​scorecard.yml	Updates Scorecard’s SARIF upload action.
.github/​workflows/​release.yml	Updates Nix installation and Java setup for signing.
.github/​workflows/​codeql.yml	Updates CodeQL initialization, analysis, and uploads.

_{Review effort: Balanced}