Repository navigation
chore(deps): bump the dependencies group across 1 directory with 3 updates - #650
Merged
SoulPancake merged 2 commits intoJul 31, 2026
Merged
Conversation
…dates Bumps the dependencies group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@0f481fc...03ad4de) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
github_actions
📄 Knowledge reviewDosu skipped reviewing this PR because your organization has used its
|
SoulPancake
approved these changes
Jul 31, 2026
SoulPancake
deleted the
dependabot/github_actions/dependencies-de3d43df49
branch
July 31, 2026 06:18
SoulPancake
added a commit
that referenced
this pull request
Sep 22, 2026
* chore(deps): bump the dependencies group across 1 directory with 3 updates (#650) Bumps the dependencies group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@0f481fc...03ad4de) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Anurag Bandyopadhyay <angbpy@gmail.com> * chore(deps): bump the dependencies group with 3 updates (#658) Bumps the dependencies group with 3 updates: [actions/setup-java](https://github.com/actions/setup-java), [gradle/actions/wrapper-validation](https://github.com/gradle/actions) and [gradle/actions/setup-gradle](https://github.com/gradle/actions). Updates `actions/setup-java` from 5.6.0 to 5.7.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@03ad4de...b6effb0) Updates `gradle/actions/wrapper-validation` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@3f131e8...9c97196) Updates `gradle/actions/setup-gradle` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@3f131e8...9c97196) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: gradle/actions/wrapper-validation dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: gradle/actions/setup-gradle dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /pkg/js (#655) * chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /pkg/js Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * fix(deps): resolve JavaScript audit vulnerabilities (#659) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Siddhant Khare <siddhant.khare@okta.com> * feat: support $expression reserved condition name on type restrictions (#664) * feat: support reserved condition name on type restrictions * fix build failure * chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the dependencies group (#666) chore(deps): bump docker/setup-buildx-action in the dependencies group Bumps the dependencies group with 1 update: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action). Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@bb05f3f...37fe631) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(graph): prevent nil-pointer panic and corruption in parseThis (#661) * fix(graph): prevent nil-pointer panic and corruption in parseThis Fix production panic when parseThis encounters degenerate RelationReference with oneof set but empty (relation:"" or wildcard:nil). Such references survive proto validation but fell through all branch conditions, leaving curNode nil. Boxed into graph.Node interface, typed-nil defeated guards and panicked on promoted ID() call. Changes: - Replace non-exclusive ifs with exhaustive switch in parseThis - Move curNode inside loop to prevent stale value leakage across iterations - Add isNilNode() helper to detect typed-nil *AuthorizationModelNode - Check type assertions in upsertEdge/hasEdge (were discarding ok value) - Validate GetType() for special chars that break node label format - Align weighted_graph_builder.go parseThis with same switch structure Tests added covering panic scenarios, stale curNode corruption, and typed-nil guards. Default case degrades empty relation to concrete type, matching transformer/jsontodsl.go parseTypeRestriction behavior. Fixes panic reported in production (trace: graph_builder.go:261 -> <autogenerated>:1). Also prevents silent graph corruption where degenerate entry in non-first position inherits previous iteration's node, merging conditions onto wrong edge. * test(graph): fix expectPanic flags and address review feedback Critical fix: Changed expectPanic from true to false in first two test cases. The flag being true meant graph topology assertions were never running - tests would pass even with completely wrong graphs. Now properly validates nodes, edges, and conditions. Additional improvements: - findEdge: Filter by edgeType and tuplesetRelation for multigraph correctness - DRY: Extract classifyRelationReference() helper to eliminate duplication across graph_builder.go and weighted_graph_builder.go parseThis - Comment brevity: Shorten 15-line comment to 3 lines - Test coverage: Add cases for special chars and nil wildcard All tests pass (14 new malformed-relation tests + 302 existing tests). * chore(ci): pin the Go version used by the lint job (#669) * ci: pin the Go version used by the lint job The lint job asked for >=1.25.0 with check-latest, so it moved to Go 1.27 as soon as that showed up in the manifest. golangci-lint v1.64.8 cannot read Go 1.27 export data and reports every antlr symbol in pkg/go/gen as undefined. The build matrix pins 1.25 and 1.26, which is why only lint went red. golangci-lint v2 does not help yet either, it fails parsing 1.27's own stdlib. So pin the toolchain to 1.26 and pin the linter version next to it so the two are raised together. * ci: keep check-latest on the pinned lint toolchain Bounded to 1.26 it cannot pull in 1.27, and it picks up patch releases instead of whatever the runner image happens to have cached. * chore(deps): bump the dependencies group in /pkg/go with 2 updates (#665) Bumps the dependencies group in /pkg/go with 2 updates: [github.com/stretchr/testify](https://github.com/stretchr/testify) and google.golang.org/protobuf. Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.0) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12 --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Siddhant Khare <siddhant.khare@okta.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 in /pkg/go in the dependencies group (#670) chore(deps): bump github.com/stretchr/testify Bumps the dependencies group in /pkg/go with 1 update: [github.com/stretchr/testify](https://github.com/stretchr/testify). Updates `github.com/stretchr/testify` from 1.12.0 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.12.0...v1.12.1) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-java from 5.7.0 to 6.0.0 in the dependencies group (#671) chore(deps): bump actions/setup-java in the dependencies group Bumps the dependencies group with 1 update: [actions/setup-java](https://github.com/actions/setup-java). Updates `actions/setup-java` from 5.7.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b6effb0...dd06d9c) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(pkg/go): exempt $expression from the undefined-condition check $expression is a reserved inline-expression condition name introduced in #664. It never appears in the model's conditions block so the semantic validation added in #616 would incorrectly report it as undefined. Skip the check when the condition name equals $expression, mirroring the exemption already present in the Java validator (ModelValidator.java). * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /pkg/go (#675) chore(deps): bump google.golang.org/grpc in /pkg/go Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump browserslist from 4.28.4 to 4.28.8 in /pkg/js (#676) Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.4 to 4.28.8. - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.8) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /pkg/js (#677) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 in /pkg/js (#678) Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8. - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) --- updated-dependencies: - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /pkg/go (#680) chore(deps): bump google.golang.org/grpc in /pkg/go Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.83.1...v1.83.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /pkg/js (#681) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Siddhant Khare <siddhant.khare@okta.com> Co-authored-by: yissellokta <146273812+yissellokta@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the dependencies group with 3 updates in the / directory: actions/checkout, actions/setup-java and ossf/scorecard-action.
Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-javafrom 5.5.0 to 5.6.0Release notes
Sourced from actions/setup-java's releases.
Commits
03ad4deBackport #1097/#1098: cache Maven and Gradle wrapper distributions separately...d229d2eBackport #1111: Preserve Maven toolchains across repeated setup-java runs (#1...bbf0f69dist: Cover Tencent Kona JDK 25 (#1110)513edc4feat: expose cache-primary-key output (#597) [v5 backport] (#1089)62df799Add Maven compiler problem matcher for javac diagnostics (#1087)176156achore: bump version to 5.6.0 for v5 release linebf7b8debuild: rebuild dist for backported changes (#1079, #1083, #1084)0173e6dInfer distribution from asdf .tool-versions vendor prefix (#1084)f45cd82Rename jdkFile input to jdk-file with deprecated alias (#1083)e2863adMap Zulu x86 architecture to i686 for Azul Metadata API (#1079)Updates
ossf/scorecard-actionfrom 2.4.3 to 2.4.4Release notes
Sourced from ossf/scorecard-action's releases.
Commits
2d11466Bump action tag for v2.4.4 release (#1688)1bd3285🌱 Bump the docker-images group across 1 directory with 2 updates (#1...913edce🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#1671)0957b8f🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (#1680)f0061eb🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#1687)20ee732🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#1685)9f295ef🌱 Bump the github-actions group with 6 updates (#1686)69bf556🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (#1681)94e8b96🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#1673)c7a1b37🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#1675)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions