build(deps): bump the minor-and-patch-action-updates group across 1 directory with 8 updates by dependabot[bot] · Pull Request #1278 · philips-software/amp-embedded-infra-lib

dependabot · 2026-07-22T01:39:17Z

Bumps the minor-and-patch-action-updates group with 8 updates in the / directory:

Package	From	To
carlosperate/arm-none-eabi-gcc-action	`1.12.3`	`1.13.0`
philips-software/antora-site-action	`1.4.0`	`1.4.1`
oxsecurity/megalinter/flavors/c_cpp	`9.5.0`	`9.6.0`
github/codeql-action/upload-sarif	`4.36.2`	`4.37.0`
sonarsource/sonarqube-scan-action	`8.2.0`	`8.2.1`
github/codeql-action/init	`4.36.2`	`4.37.0`
github/codeql-action/analyze	`4.36.2`	`4.37.0`
marocchino/sticky-pull-request-comment	`3.0.4`	`3.0.5`

Updates carlosperate/arm-none-eabi-gcc-action from 1.12.3 to 1.13.0

Release notes

Sourced from carlosperate/arm-none-eabi-gcc-action's releases.

v1.13.0

Added

New 15.3.Rel1 arm-none-eabi-gcc release. From this version Arm hosts the toolchain on Arm GitLab (the developer.arm.com downloads page is deprecated).

Added SHA256 verification for toolchain downloads (#100)

Changed

Toolchain downloads have been moved to GitLab, which uses ephemeral AWS URLS, so action has been updated to correctly process them.

Toolchain downloads page has been moved, so CI scripts have been updated.

Security

Security update for third party dependencies (#96, #97, #98, #99)

Full Changelog: carlosperate/arm-none-eabi-gcc-action@v1...v1.13.0

Changelog

Sourced from carlosperate/arm-none-eabi-gcc-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

v1.13.1 - Unreleased

Changed

Add optional backup download URLs for GCC the releases.

Removed URL redirection detection during action runtime, as it's unnecessary, moved to CI checks only.

v1.13.0 - (2026-07-06)

Added

New 15.3.Rel1 arm-none-eabi-gcc release. From this version Arm hosts the toolchain on Arm GitLab (the developer.arm.com downloads page is deprecated).

Added SHA256 verification for toolchain downloads (#100)

Changed

Toolchain downloads have been moved to GitLab, which uses ephemeral AWS URLS, so action has been updated to correctly process them.

Toolchain downloads page has been moved, so CI scripts have been updated.

Security

Security update for third party dependencies (#96, #97, #98, #99)

v1.12.3 - (2026-04-09)

Fixed

Fix cache path validation error on Windows by providing require polyfill in ESM actions/toolkit#2085#95).

Changed

As there can be OS specific issues when building the action, test-build job now runs on all supported OSes.

v1.12.2 - 2026-04-08

Changed

Replace ncc with rollup, for compat with ESM-only dependencies.

Updated most of the direct dependencies to their latest version.

Security

Security update for third party dependencies (#90, #91, #92, #93)

v1.12.1 - 2026-03-19

Changed

Upgraded the running node version from v20 to v24 (#88 thanks @ETSells!)

Minor refactor to switch @actions/http-client with fetch (441583d)

Security

Security update for third party dependencies (#85)

v1.12.0 - 2025-12-21

Added

Add 15.2.Rel1 Arm GNU Toolchain release (#83)

Changed

... (truncated)

Commits

98c40e5 project: Uprev to v1.13.0 & update changelog.
5e695a8 ci: Downloads page has moved, so check for new releases needs update.
cec2670 action: Add 15.2.Rel1 arm-none-eabi-gcc release.
0eac92e action: Add resolvedUrl/ephemeralUrl handling in preparation for 15.3.1.
a39ec26 Merge pull request #100 from carlosperate/sha256
06462e0 ci: Fix check for new releases to only run on pushes that modify the workflow...
23096de action: Add SHA256 download verification.
df257b0 Add sha256 values
02db244 deps: Bump undici from 6.24.1 to 6.27.0 (#99)
5954942 deps: Bump fast-xml-builder from 1.1.5 to 1.2.0 (#97)
Additional commits viewable in compare view

Updates philips-software/antora-site-action from 1.4.0 to 1.4.1

Release notes

Sourced from philips-software/antora-site-action's releases.

v1.4.1

1.4.1 (2026-07-15)

Bug Fixes

Pin asciidoctor-kroki to the latest compatible version (6b7b6da)

Changelog

Sourced from philips-software/antora-site-action's changelog.

Changelog

1.4.1 (2026-07-15)

Bug Fixes

Pin asciidoctor-kroki to the latest compatible version (6b7b6da)

Pin asciidoctor-kroki to the latest compatible version (792ba8f)

1.4.0 (2026-05-29)

Features

deps: Bump antora/antora from 3.1.14 to 3.1.15 (#50) (5b21d4e)

1.3.0 (2025-11-07)

Features

Builtin plantuml & kroki server for rendering diagrams (#29) (e32b558)

1.2.0 (2025-10-15)

Features

deps: Bump antora/antora from 3.1.10 to 3.1.12 (#23) (55b9c95)

deps: Bump antora/antora from 3.1.12 to 3.1.14 (#27) (bb25d32)

deps: Bump antora/antora from 3.1.9 to 3.1.10 (#7) (2b8a5c1)

1.1.0 (2024-10-24)

Features

Initial implementation of antora site action (#1) (510e59f)

Commits

422b8cb chore(main): release 1.4.1 (#59)
6b7b6da Merge pull request #58 from philips-software/fix/pin-asciidoctor-kroki-to-lat...
792ba8f fix: pin asciidoctor-kroki to the latest compatible version
23d7266 Merge pull request #56 from philips-software/dependabot/github_actions/minor-...
a34032e Merge pull request #54 from philips-software/dependabot/github_actions/action...
cdad00a build(deps): bump the minor-and-patch-action-updates group across 1 directory...
6acda27 build(deps): bump actions/checkout from 6.0.2 to 7.0.0
See full diff in compare view

Updates oxsecurity/megalinter/flavors/c_cpp from 9.5.0 to 9.6.0

Release notes

Sourced from oxsecurity/megalinter/flavors/c_cpp's releases.

v9.6.0

What's Changed

Breaking changes

Linters can no longer be run via a sibling Docker image at runtime. The cli_docker_image, cli_docker_image_version and cli_docker_args descriptor properties (and the matching <LINTER>_DOCKER_IMAGE_VERSION variable) have been removed, and MegaLinter no longer mounts /var/run/docker.sock (in mega-linter-runner, the GitHub Action action.yml files, and the Docker daemon previously bundled in flavor images). This closes the host-privilege escalation surface that the mounted Docker socket exposed. The only linter that used this mechanism was SWIFT_SWIFTLINT, now installed natively (see below). (#8216)

SWIFT_SWIFTLINT is now installed from the static swiftlint-static binary instead of running the ghcr.io/realm/swiftlint container. It runs natively on the Alpine image with no Docker socket required. SourceKit-dependent rules are disabled in this build and reported to the console when encountered; pure-syntax style rules are unaffected. (#8216)

@eslint/eslintrc shim removed from JavaScript/TypeScript/JSX/TSX Docker images (was only needed for legacy FlatCompat); MegaLinter's bundled test fixtures use native flat config. (#7869)

ESLint linters now force migration off .eslintrc.*: JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT activate when they find any eslint.config.* or any deprecated .eslintrc.* / package.json#eslintConfig. In the legacy case the linter does not call ESLint at all — it emits a single hard failure with a migration message so the build stays red until the config is migrated to flat config. See the ESLint flat-config migration guide. To opt out, set DISABLE_LINTERS or DISABLE to exclude the affected linter/descriptor. (#7869)

JSON_ESLINT_PLUGIN_JSONC removed: upstream bug ota-meshi/eslint-plugin-jsonc#328 blocks ESLint v10 compatibility and will not be fixed. Use JSON_JSONLINT, JSON_PRETTIER, or JSON_V8R for JSON validation instead. (#7869)

Core

New linter descriptor property common_linter_errors: declare known non-lint failure patterns (config issue, remote service down, missing credentials…) and the guidance message shown to users, directly in YAML — no custom Python class needed. (#7907)

Skipped-linters summary now explains why a linter was skipped by an activation rule, including the variable to set to activate it (e.g. MARKDOWN_RUMDL: MARKDOWN_DEFAULT_STYLE=markdownlint (set MARKDOWN_DEFAULT_STYLE=rumdl to activate)), fixing #8017.

New linters

Add betterleaks linter for repository secrets scanning — successor to gitleaks with higher recall (98.6% vs 70.4%), lower false-positive rates, and 4–5× faster scanning via BPE-based detection and CEL filter expressions (#8186)

Disabled linters

SALESFORCE_SFDX_SCANNER_APEX, SALESFORCE_SFDX_SCANNER_AURA and SALESFORCE_SFDX_SCANNER_LWC — disabled because sfdx-scanner 4.12.0 crashes on Node.js 22+ (TypeError: Cannot read properties of undefined (reading 'prototype'), caused by the removal of SlowBuffer.prototype), which is shipped with Alpine 3.24. These linters were already deprecated; use the SALESFORCE_CODE_ANALYZER_APEX / SALESFORCE_CODE_ANALYZER_AURA / SALESFORCE_CODE_ANALYZER_LWC variants instead (#8080).

Deprecated linters

REPOSITORY_GITLEAKS — deprecated in favour of REPOSITORY_BETTERLEAKS (same author, fully compatible config, significantly better detection). Will be removed in the next major release. Disable it by adding REPOSITORY_GITLEAKS to DISABLE_LINTERS in your .mega-linter.yml. (#8186)

Removed linters

JSON_ESLINT_PLUGIN_JSONC — permanently broken by upstream bug (see Breaking changes) (#7869)

Linters enhancements

REPOSITORY_CHECKOV: in pull-request mode, scan only the files modified in the PR instead of the whole repository (#7119)

Fixes

REPOSITORY_BETTERLEAKS: default scan now runs in filesystem (dir) mode instead of auto-switching to git-history (git) mode when a git repository is detected. betterleaks does not read the global git safe.directory config, so git mode failed with fatal: detected dubious ownership in repository in CI environments (e.g. GitHub Actions /github/workspace). Git-history mode is still used for the opt-in REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN feature. (#8186)

REPOSITORY_BETTERLEAKS: added --verbose so detected findings (file, line and rule) are reported instead of only the leaks found: N summary, matching gitleaks behavior. Secret values stay redacted via --redact. (#8186)

REPOSITORY_OSV_SCANNER: exit code 128 ("No package sources found") is now treated as a clean pass instead of a failure — osv-scanner returns this code when the repo contains no lockfiles/manifests/SBOMs, which is not a vulnerability finding (#7917).

Fix intermittent ansible-lint load-failure[not-found] error on github_conf/branch_protection_rules.json caused by a race condition with checkov running in parallel. Checkov's transient GitHub-conf directory is now written to a hidden path (.megalinter_github_conf) that project-mode linters skip, eliminating the conflict (#8092).

Complete the Alpine 3.24 upgrade across the whole image and fix how alpine version is detected. Docker images now build on the python:3.14-alpine3.24 base image (#8080).

Avoid DeprecationWarning / future breakage on Python 3.14 by no longer passing count and flags as positional arguments to re.sub (#8211).

Exclude REPORT_OUTPUT_FOLDER from linting when configured as an absolute path inside the workspace (e.g. /tmp/lint/megalinter-reports), fixing #7845.

Fix command injection in Roslynator linter (DOTNET_ROSLYNATOR) where a crafted .csproj filename could break out of dotnet restore arguments and execute arbitrary shell commands. The command is now invoked via argv list instead of a shell string. Reported by Francesco Sabiu. (#7857)

Fix IndexError when building the single-linter Docker image for a linter whose activation depends on a file (e.g. SPELL_VALE requires .vale.ini): python -m megalinter.run --linterversion now bypasses activation filtering since the per-linter image is built for that linter unconditionally.

Fix make bootstrap appearing to hang because exported Make color variables re-evaluated tput during recursive make invocations. (#8090)

Allow MegaLinter containers to run in an opt-in non-root mode matching the host UID:GID on POSIX systems, avoiding root-owned generated files on the host (#1975).

Restore missing examples in the Dart descriptor that were dropped from the generated documentation (#7913).

Reporters

Update Bitbucket pipeline generator template to trigger builds on pull requests from any branch, by @yermulnik in oxsecurity/megalinter#7421

Doc

Add pnpm installation and usage documentation for JavaScript and TypeScript linters (#8177)

Update Docker pull counters in README badges and flavors-stats.json with latest ghcr.io stats

Bump peter-evans/create-pull-request to v8 in the documented workflow examples (#8089)

... (truncated)

Changelog

Sourced from oxsecurity/megalinter/flavors/c_cpp's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased] (beta, main branch content)

Note: Can be used with oxsecurity/megalinter@beta in your GitHub Action mega-linter.yml file, or with oxsecurity/megalinter:beta docker image

Breaking changes

Core

Allow FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDE (global, per-descriptor and per-linter) to be defined as a list of regexes combined with a logical OR, so filter regexes can be appended across EXTENDS configs via CONFIG_PROPERTIES_TO_APPEND; single-string values remain fully supported, fixes #8361

Add ENABLE_DISABLE_LINTERS_PRIORITY variable to let DISABLE_LINTERS override ENABLE_LINTERS when a linter is in both lists (e.g. to trim an inherited ENABLE_LINTERS list via EXTENDS), fixes #8296

Add supported_cli_lint_modes descriptor property to declare which CLI lint modes (file, list_of_files, project) each linter supports, generate success/failure tests for every supported mode, and reject a <LINTER>_CLI_LINT_MODE override targeting an unsupported mode with an explicit error, fixes #7120

New linters

Add SALESFORCE_CODE_ANALYZER_FLOW, the Salesforce Code Analyzer v5 Flow Scanner engine that audits Salesforce Flows for security issues

Disabled linters

Re-enabled linters

Deprecated linters

Removed linters

Media

Linters enhancements

Fixes

Treat zero matching SARIF findings as a valid result without logging the entire report, fixes #8295

Remove invalid SARIF fixes with empty artifactChanges arrays before report aggregation, fixes #8474

Write REPOSITORY_CHECKOV's transient GitHub-config scan directory (branch_protection_rules.json and similar) to a hidden .checkov-github-conf subfolder of the MegaLinter report folder instead of the repository root, so the artifact stays out of the linted tree (gitignored, excluded from file discovery, and skipped by project-mode linters), extending the earlier ansible-lint race-condition fix (#8092)

Make remote configuration loading resilient to transient network failures by adding a request timeout and bounded retries with backoff when fetching MEGALINTER_CONFIG and EXTENDS files over HTTP (fixes intermittent config_test failures caused by raw.githubusercontent.com CDN cache lag)

Disable TERRAFORM_TERRASCAN (upstream repo archived by Tenable, unmaintained) and SQL_TSQLLINT (no upstream release since 2024-09), as both ship unpatched CVEs with no prospect of a fixed release

Fix SARIF_TO_HUMAN producing empty linter logs when the bundled sarif-fmt binary crashes by building it from source on Alpine and falling back to raw SARIF on conversion failure (#8294)

Keep the Docker Pulls badge in docs/index.md in sync by having docker_stats.py also update the hardcoded badge total in .automation/build.py

Fix outdated links in docs/descriptors/repository_kingfisher.md

Fix LINTER_RULES_PATH not being used to resolve config files for linters using active_only_if_file_found (e.g. REPOSITORY_LS_LINT, SPELL_PROSELINT, SPELL_VALE), fixes #8416

Honor EXCLUDED_DIRECTORIES and ADDITIONAL_EXCLUDED_DIRECTORIES in changed-files mode (VALIDATE_ALL_CODEBASE: false), so files inside excluded directories are pruned from the git diff file list the same way they are during full-codebase validation (#8360)

Reporters

Flavors

... (truncated)

Commits

ef3e84b Release MegaLinter v9.6.0
8b9259b Skill prepare-release (#8245)
5810155 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 in /.config/python/...
aca415c chore(deps): update dependency semver to v7.8.5 (#8198)
2d8b274 Remove max-parallel for linters
e9ab3e9 chore(ci): manual run of deploy linters beta job (#8242)
a8a6368 Changelog (#8241)
7f363c6 [automation] Auto-update linters version, help and documentation (#8215)
bce5232 chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.25 (#8232)
9d98266 chore(deps): update dependency realm/swiftlint to v0.65.0 (#8240)
Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.36.2 to 4.37.0

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

... (truncated)

Commits

99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
31c2707 Add changenote for #3973
72df218 Update changelog for v4.37.0
c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
3f34ff0 Add changelog note
43bec09 Update default bundle to codeql-bundle-v2.26.0
f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
8e22350 Thread ActionState to initConfig
69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
Additional commits viewable in compare view

Updates sonarsource/sonarqube-scan-action from 8.2.0 to 8.2.1

Release notes

Sourced from sonarsource/sonarqube-scan-action's releases.

v8.2.1

What's Changed

Bug fix

SQSCANGHA-156 GPG signature verification fails when temporary directory path is too long

Full Changelog: SonarSource/sonarqube-scan-action@v8.2.0...v8.2.1

Commits

2291811 SQSCANGHA-156 GPG signature verification fails when temporary directory path ...
7cdc154 SQSCANGHA-153 NO-JIRA Bump actions/checkout from 6.0.2 to 7.0.0 (#255)
45f2736 SQSCANGHA-151 Change Code Owners (#254)
See full diff in compare view

Updates github/codeql-action/init from 4.36.2 to 4.37.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

... (truncated)

Commits

99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
31c2707 Add changenote for #3973
72df218 Update changelog for v4.37.0
c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
3f34ff0 Add changelog note
43bec09 Update default bundle to codeql-bundle-v2.26.0
f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
8e22350 Thread ActionState to initConfig
69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.2 to 4.37.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

... (truncated)

Commits

99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
31c2707 Add changenote for #3973
72df218 Update changelog for v4.37.0
c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
3f34ff0 Add changelog note
43bec09 Update default bundle to codeql-bundle-v2.26.0
f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...

…irectory with 8 updates Bumps the minor-and-patch-action-updates group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [carlosperate/arm-none-eabi-gcc-action](https://github.com/carlosperate/arm-none-eabi-gcc-action) | `1.12.3` | `1.13.0` | | [philips-software/antora-site-action](https://github.com/philips-software/antora-site-action) | `1.4.0` | `1.4.1` | | [oxsecurity/megalinter/flavors/c_cpp](https://github.com/oxsecurity/megalinter) | `9.5.0` | `9.6.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` | | [sonarsource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `8.2.0` | `8.2.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` | | [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) | `3.0.4` | `3.0.5` | Updates `carlosperate/arm-none-eabi-gcc-action` from 1.12.3 to 1.13.0 - [Release notes](https://github.com/carlosperate/arm-none-eabi-gcc-action/releases) - [Changelog](https://github.com/carlosperate/arm-none-eabi-gcc-action/blob/main/CHANGELOG.md) - [Commits](carlosperate/arm-none-eabi-gcc-action@0725d97...98c40e5) Updates `philips-software/antora-site-action` from 1.4.0 to 1.4.1 - [Release notes](https://github.com/philips-software/antora-site-action/releases) - [Changelog](https://github.com/philips-software/antora-site-action/blob/main/CHANGELOG.md) - [Commits](philips-software/antora-site-action@f8cbb3f...422b8cb) Updates `oxsecurity/megalinter/flavors/c_cpp` from 9.5.0 to 9.6.0 - [Release notes](https://github.com/oxsecurity/megalinter/releases) - [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md) - [Commits](oxsecurity/megalinter@0e3ce9b...ef3e84b) Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...99df26d) Updates `sonarsource/sonarqube-scan-action` from 8.2.0 to 8.2.1 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](SonarSource/sonarqube-scan-action@7138816...2291811) Updates `github/codeql-action/init` from 4.36.2 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...99df26d) Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...99df26d) Updates `marocchino/sticky-pull-request-comment` from 3.0.4 to 3.0.5 - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](marocchino/sticky-pull-request-comment@0ea0beb...5770ad5) --- updated-dependencies: - dependency-name: carlosperate/arm-none-eabi-gcc-action dependency-version: 1.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch-action-updates - dependency-name: philips-software/antora-site-action dependency-version: 1.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch-action-updates - dependency-name: oxsecurity/megalinter/flavors/c_cpp dependency-version: 9.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch-action-updates - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch-action-updates - dependency-name: sonarsource/sonarqube-scan-action dependency-version: 8.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch-action-updates - dependency-name: github/codeql-action/init dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch-action-updates - dependency-name: github/codeql-action/analyze dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch-action-updates - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch-action-updates ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-22T01:39:45Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 45 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match. You may see unexpected additions in the diff.

Consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/static-analysis.yml

Package	Version	License	Issue Type
sonarsource/sonarqube-scan-action	22918119ff8e1ca75a623e15c8296b6ea4fbe28f	Null	Unknown License

external/crypto/tiny-aes128/CMakeLists.txt

Package	Version	License	Issue Type
kokke/tiny-aes-c	7e42e693288bdf22d8e677da94248115168211b9	Null	Unknown License
kokke/tiny-aes-c	7e42e693288bdf22d8e677da94248115168211b9	Null	Unknown License
kokke/tiny-aes-c	7e42e693288bdf22d8e677da94248115168211b9	Null	Unknown License
kokke/tiny-aes-c	7e42e693288bdf22d8e677da94248115168211b9	Null	Unknown License

osal/threadx/CMakeLists.txt

Package	Version	License	Issue Type
eclipse-threadx/threadx	06dabb0ad0403f59889ce85eeb3d48dbd9d3759b	Null	Unknown License
eclipse-threadx/threadx	06dabb0ad0403f59889ce85eeb3d48dbd9d3759b	Null	Unknown License
eclipse-threadx/threadx	06dabb0ad0403f59889ce85eeb3d48dbd9d3759b	Null	Unknown License
eclipse-threadx/threadx	06dabb0ad0403f59889ce85eeb3d48dbd9d3759b	Null	Unknown License

external/crypto/micro-ecc/CMakeLists.txt

Package	Version	License	Issue Type
kmackay/micro-ecc	24c60e243580c7868f4334a1ba3123481fe1aa48	Null	Unknown License
kmackay/micro-ecc	24c60e243580c7868f4334a1ba3123481fe1aa48	Null	Unknown License
kmackay/micro-ecc	24c60e243580c7868f4334a1ba3123481fe1aa48	Null	Unknown License
kmackay/micro-ecc	24c60e243580c7868f4334a1ba3123481fe1aa48	Null	Unknown License

cmake/emil_test_helpers.cmake

Package	Version	License	Issue Type
google/googletest	v1.14.0	Null	Unknown License
google/googletest	v1.14.0	Null	Unknown License
google/googletest	v1.14.0	Null	Unknown License
google/googletest	v1.14.0	Null	Unknown License

lwip/lwip/CMakeLists.txt

Package	Version	License	Issue Type
lwip-tcpip/lwip	77dcd25a72509eb83f72b033d219b1d40cd8eb95	Null	Unknown License
lwip-tcpip/lwip	77dcd25a72509eb83f72b033d219b1d40cd8eb95	Null	Unknown License
lwip-tcpip/lwip	77dcd25a72509eb83f72b033d219b1d40cd8eb95	Null	Unknown License
lwip-tcpip/lwip	77dcd25a72509eb83f72b033d219b1d40cd8eb95	Null	Unknown License

external/args/CMakeLists.txt

Package	Version	License	Issue Type
taywee/args	114200a9ad5fe06c8dea76e15d92325695cf3e34	Null	Unknown License
taywee/args	114200a9ad5fe06c8dea76e15d92325695cf3e34	Null	Unknown License
taywee/args	114200a9ad5fe06c8dea76e15d92325695cf3e34	Null	Unknown License
taywee/args	114200a9ad5fe06c8dea76e15d92325695cf3e34	Null	Unknown License

external/crypto/mbedtls/CMakeLists.txt

Package	Version	License	Issue Type
mbed-tls/mbedtls	107ea89daaefb9867ea9121002fbbdf926780e98	Null	Unknown License
mbed-tls/mbedtls	107ea89daaefb9867ea9121002fbbdf926780e98	Null	Unknown License
mbed-tls/mbedtls	107ea89daaefb9867ea9121002fbbdf926780e98	Null	Unknown License
mbed-tls/mbedtls	107ea89daaefb9867ea9121002fbbdf926780e98	Null	Unknown License

external/protobuf/CMakeLists.txt

Package	Version	License	Issue Type
protocolbuffers/protobuf	edaa823d8b36a8656d7b2b9241b7d0bfe50af878	Null	Unknown License
protocolbuffers/protobuf	edaa823d8b36a8656d7b2b9241b7d0bfe50af878	Null	Unknown License
protocolbuffers/protobuf	edaa823d8b36a8656d7b2b9241b7d0bfe50af878	Null	Unknown License
protocolbuffers/protobuf	edaa823d8b36a8656d7b2b9241b7d0bfe50af878	Null	Unknown License

infra/syntax/CMakeLists.txt

Package	Version	License	Issue Type
zeux/pugixml	ef856bf975f4b1909af1b40ed3d7e28af9263d95	Null	Unknown License
zeux/pugixml	ef856bf975f4b1909af1b40ed3d7e28af9263d95	Null	Unknown License
zeux/pugixml	ef856bf975f4b1909af1b40ed3d7e28af9263d95	Null	Unknown License
zeux/pugixml	ef856bf975f4b1909af1b40ed3d7e28af9263d95	Null	Unknown License

external/segger_rtt/CMakeLists.txt

Package	Version	License	Issue Type
seggermicro/rtt	ff57c3d516ea59b0a2d4d5cafb33a48572b09c0b	Null	Unknown License
seggermicro/rtt	ff57c3d516ea59b0a2d4d5cafb33a48572b09c0b	Null	Unknown License
seggermicro/rtt	ff57c3d516ea59b0a2d4d5cafb33a48572b09c0b	Null	Unknown License
seggermicro/rtt	ff57c3d516ea59b0a2d4d5cafb33a48572b09c0b	Null	Unknown License

osal/freertos/CMakeLists.txt

Package	Version	License	Issue Type
freertos/freertos-kernel	def7d2df2b0506d3d249334974f51e427c17a41c	Null	Unknown License
freertos/freertos-kernel	def7d2df2b0506d3d249334974f51e427c17a41c	Null	Unknown License
freertos/freertos-kernel	def7d2df2b0506d3d249334974f51e427c17a41c	Null	Unknown License
freertos/freertos-kernel	def7d2df2b0506d3d249334974f51e427c17a41c	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

actions/github/codeql-action/analyze

99df26d4f13ea111d4ec1a7dddef6063f76b97e9

Unknown

actions/github/codeql-action/init

99df26d4f13ea111d4ec1a7dddef6063f76b97e9

Unknown

actions/sonarsource/sonarqube-scan-action

22918119ff8e1ca75a623e15c8296b6ea4fbe28f

Unknown

unknown/kokke/tiny-aes-c

7e42e693288bdf22d8e677da94248115168211b9

Unknown

unknown/eclipse-threadx/threadx

06dabb0ad0403f59889ce85eeb3d48dbd9d3759b

Unknown

unknown/kmackay/micro-ecc

24c60e243580c7868f4334a1ba3123481fe1aa48

Unknown

unknown/google/googletest

v1.14.0

Unknown

unknown/lwip-tcpip/lwip

77dcd25a72509eb83f72b033d219b1d40cd8eb95

Unknown

unknown/taywee/args

114200a9ad5fe06c8dea76e15d92325695cf3e34

Unknown

unknown/mbed-tls/mbedtls

107ea89daaefb9867ea9121002fbbdf926780e98

Unknown

unknown/protocolbuffers/protobuf

edaa823d8b36a8656d7b2b9241b7d0bfe50af878

Unknown

unknown/zeux/pugixml

ef856bf975f4b1909af1b40ed3d7e28af9263d95

Unknown

unknown/seggermicro/rtt

ff57c3d516ea59b0a2d4d5cafb33a48572b09c0b

Unknown

unknown/freertos/freertos-kernel

def7d2df2b0506d3d249334974f51e427c17a41c

Unknown

actions/marocchino/sticky-pull-request-comment

5770ad5eb8f42dd2c4f34da00c94c5381e49af88

🟢 5.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Code-Review	⚠️ 0	Found 0/2 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

unknown/kokke/tiny-aes-c

7e42e693288bdf22d8e677da94248115168211b9

Unknown

unknown/protocolbuffers/protobuf

edaa823d8b36a8656d7b2b9241b7d0bfe50af878

Unknown

unknown/freertos/freertos-kernel

def7d2df2b0506d3d249334974f51e427c17a41c

Unknown

unknown/lwip-tcpip/lwip

77dcd25a72509eb83f72b033d219b1d40cd8eb95

Unknown

unknown/mbed-tls/mbedtls

107ea89daaefb9867ea9121002fbbdf926780e98

Unknown

unknown/seggermicro/rtt

ff57c3d516ea59b0a2d4d5cafb33a48572b09c0b

Unknown

unknown/google/googletest

v1.14.0

Unknown

unknown/zeux/pugixml

ef856bf975f4b1909af1b40ed3d7e28af9263d95

Unknown

unknown/eclipse-threadx/threadx

06dabb0ad0403f59889ce85eeb3d48dbd9d3759b

Unknown

unknown/kmackay/micro-ecc

24c60e243580c7868f4334a1ba3123481fe1aa48

Unknown

unknown/taywee/args

114200a9ad5fe06c8dea76e15d92325695cf3e34

Unknown

unknown/lwip-tcpip/lwip

77dcd25a72509eb83f72b033d219b1d40cd8eb95

Unknown

unknown/freertos/freertos-kernel

def7d2df2b0506d3d249334974f51e427c17a41c

Unknown

unknown/kmackay/micro-ecc

24c60e243580c7868f4334a1ba3123481fe1aa48

Unknown

unknown/kokke/tiny-aes-c

7e42e693288bdf22d8e677da94248115168211b9

Unknown

unknown/mbed-tls/mbedtls

107ea89daaefb9867ea9121002fbbdf926780e98

Unknown

unknown/zeux/pugixml

ef856bf975f4b1909af1b40ed3d7e28af9263d95

Unknown

unknown/eclipse-threadx/threadx

06dabb0ad0403f59889ce85eeb3d48dbd9d3759b

Unknown

unknown/taywee/args

114200a9ad5fe06c8dea76e15d92325695cf3e34

Unknown

unknown/google/googletest

v1.14.0

Unknown

unknown/seggermicro/rtt

ff57c3d516ea59b0a2d4d5cafb33a48572b09c0b

Unknown

unknown/protocolbuffers/protobuf

edaa823d8b36a8656d7b2b9241b7d0bfe50af878

Unknown

unknown/kokke/tiny-aes-c

7e42e693288bdf22d8e677da94248115168211b9

Unknown

unknown/zeux/pugixml

ef856bf975f4b1909af1b40ed3d7e28af9263d95

Unknown

unknown/protocolbuffers/protobuf

edaa823d8b36a8656d7b2b9241b7d0bfe50af878

Unknown

unknown/freertos/freertos-kernel

def7d2df2b0506d3d249334974f51e427c17a41c

Unknown

unknown/kmackay/micro-ecc

24c60e243580c7868f4334a1ba3123481fe1aa48

Unknown

unknown/lwip-tcpip/lwip

77dcd25a72509eb83f72b033d219b1d40cd8eb95

Unknown

unknown/eclipse-threadx/threadx

06dabb0ad0403f59889ce85eeb3d48dbd9d3759b

Unknown

unknown/seggermicro/rtt

ff57c3d516ea59b0a2d4d5cafb33a48572b09c0b

Unknown

unknown/mbed-tls/mbedtls

107ea89daaefb9867ea9121002fbbdf926780e98

Unknown

unknown/google/googletest

v1.14.0

Unknown

unknown/taywee/args

114200a9ad5fe06c8dea76e15d92325695cf3e34

Unknown

Scanned Files

.github/workflows/static-analysis.yml
.github/workflows/validate-pr.yml
cmake/emil_test_helpers.cmake
external/args/CMakeLists.txt
external/crypto/mbedtls/CMakeLists.txt
external/crypto/micro-ecc/CMakeLists.txt
external/crypto/tiny-aes128/CMakeLists.txt
external/protobuf/CMakeLists.txt
external/segger_rtt/CMakeLists.txt
infra/syntax/CMakeLists.txt
lwip/lwip/CMakeLists.txt
osal/freertos/CMakeLists.txt
osal/threadx/CMakeLists.txt

github-actions · 2026-07-22T01:43:31Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	11		0	0	0.31s
✅ ACTION	zizmor	11	0	0	0	5.58s
✅ CPP	clang-format	1098	8	0	0	9.6s
✅ DOCKERFILE	hadolint	2		0	0	0.04s
✅ JSON	jsonlint	7		0	0	0.36s
✅ JSON	prettier	7	0	0	0	0.59s
⚠️ MARKDOWN	markdownlint	8	0	5	0	1.28s
✅ MARKDOWN	markdown-table-formatter	8	0	0	0	0.23s
❌ REPOSITORY	betterleaks	yes		1	5	1.6s
✅ REPOSITORY	checkov	yes		no	no	36.24s
✅ REPOSITORY	git_diff	yes		no	no	0.1s
✅ REPOSITORY	grype	yes		no	no	71.18s
❌ REPOSITORY	ls-lint	yes		1	no	0.02s
✅ REPOSITORY	osv-scanner	yes		no	no	0.69s
✅ REPOSITORY	secretlint	yes		no	no	15.82s
✅ REPOSITORY	syft	yes		no	no	2.13s
✅ REPOSITORY	trivy	yes		no	no	21.81s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.3s
✅ REPOSITORY	trufflehog	yes		no	no	4.44s
⚠️ SPELL	lychee	140		1	0	121.17s
⚠️ YAML	prettier	21	1	1	0	0.7s
✅ YAML	v8r	21		0	0	10.74s
✅ YAML	yamllint	21		0	0	0.91s

Detailed Issues

❌ REPOSITORY / betterleaks - 1 error

warning: private-key has detected secret for file services/network/CertificatesMbedTls.cpp.
    ┌─ services/network/CertificatesMbedTls.cpp:125:21
    │  
125 │           stream << "HIDDEN_BY_MEGALINTER\r\n";
    │ ╰────────────────────────────────────────────────^

warning: generic-api-key has detected secret for file external/crypto/tiny-aes128/TinyAes.c.
   ┌─ external/crypto/tiny-aes128/TinyAes.c:17:4
   │  
17 │     key:
   │ ╭────^
18 │ │     2b7e151628aed2a6abf7158809cf4f3c
   │ ╰────────────────────────────────────^

warning: generic-api-key has detected secret for file services/network/WebSocket.cpp.
   ┌─ services/network/WebSocket.cpp:81:50
   │
81 │         headers.push_back(services::HttpHeader("Sec-Websocket-Key", "AQIDBAUGBbgJCgsMDQ4PEC=="));
   │                                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

warning: private-key has detected secret for file services/network/test_doubles/Certificates.cpp.
   ┌─ services/network/test_doubles/Certificates.cpp:56:15
   │  
56 │               "HIDDEN_BY_MEGALINTER\r\n";
   │ ╰──────────────────────────────────────────^

warning: private-key has detected secret for file services/network/test_doubles/Certificates.cpp.
    ┌─ services/network/test_doubles/Certificates.cpp:108:15
    │  
108 │               "HIDDEN_BY_MEGALINTER\r\n";
    │ ╰──────────────────────────────────────────^

warning: 5 warnings emitted

❌ REPOSITORY / ls-lint - 1 error

.megalinter_github_conf failed for `.dir` rules: snakecase

⚠️ SPELL / lychee - 1 error

📝 Summary
---------------------
🔍 Total..........697
🔗 Unique.........661
✅ Successful.....691
⏳ Timeouts.........0
🔀 Redirected.....310
👻 Excluded.........5
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1

Errors in external/protoc/CMakeLists.txt
[404] https://github.com/protocolbuffers/protobuf/releases/download/v$%7Bprotobuf_tag%7D/protoc-$%7Bprotobuf_version%7D-$%7Bos_postfix%7D.zip (at 18:13) | Rejected status code: 404 Not Found

Hint: Followed 310 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

⚠️ MARKDOWN / markdownlint - 5 errors

.github/instructions/microtest.instructions.md:7 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "## Google Test Suite Coding Ru..."]
external/crypto/tiny-aes128/README.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "### Tiny AES128 in C"]
external/crypto/tiny-aes128/README.md:29 error MD046/code-block-style Code block style [Expected: fenced; Actual: indented]
external/crypto/tiny-aes128/README.md:39 error MD046/code-block-style Code block style [Expected: fenced; Actual: indented]
external/crypto/tiny-aes128/README.md:49 error MD046/code-block-style Code block style [Expected: fenced; Actual: indented]

⚠️ YAML / prettier - 1 error

[error] Explicitly specified pattern "documents/modules/ROOT/examples/clangformat.yaml" is a symbolic link.
.clusterfuzzlite/project.yaml 55ms (unchanged)
.github/dependabot.yml 15ms (unchanged)
.github/workflows/ci.yml 75ms (unchanged)
.github/workflows/dependency-scanner.yml 10ms (unchanged)
.github/workflows/documentation.yml 11ms (unchanged)
.github/workflows/fuzzing-batch.yml 5ms (unchanged)
.github/workflows/fuzzing-cron.yml 7ms (unchanged)
.github/workflows/fuzzing-pr.yml 5ms (unchanged)
.github/workflows/linting-formatting.yml 17ms (unchanged)
.github/workflows/release-please.yml 14ms (unchanged)
.github/workflows/security.yml 4ms (unchanged)
.github/workflows/static-analysis.yml 10ms (unchanged)
.github/workflows/validate-pr.yml 21ms (unchanged)
.ls-lint.yml 3ms
.mega-linter.yml 2ms (unchanged)
antora-playbook-branch.yml 3ms (unchanged)
antora-playbook-site.yml 3ms (unchanged)
documents/antora.yml 2ms (unchanged)
documents/supplemental-ui/ui.yml 1ms (unchanged)
mull.yml 1ms (unchanged)

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,CPP_CLANG_FORMAT,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_LS_LINT,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

sonarqubecloud · 2026-07-22T01:46:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot · 2026-07-24T01:41:08Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 22, 2026

dependabot Bot requested a review from a team as a code owner July 22, 2026 01:39

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 22, 2026

dependabot Bot closed this Jul 24, 2026

dependabot Bot deleted the dependabot/github_actions/minor-and-patch-action-updates-06e569ce4b branch July 24, 2026 01:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the minor-and-patch-action-updates group across 1 directory with 8 updates#1278

build(deps): bump the minor-and-patch-action-updates group across 1 directory with 8 updates#1278
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/minor-and-patch-action-updates-06e569ce4b

dependabot Bot commented on behalf of github Jul 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

sonarqubecloud Bot commented Jul 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.13.0

Added

Changed

Security

Changelog

v1.13.1 - Unreleased

Changed

v1.13.0 - (2026-07-06)

Added

Changed

Security

v1.12.3 - (2026-04-09)

Fixed

Changed

v1.12.2 - 2026-04-08

Changed

Security

v1.12.1 - 2026-03-19

Changed

Security

v1.12.0 - 2025-12-21

Added

Changed

v1.4.1

1.4.1 (2026-07-15)

Bug Fixes

Changelog

1.4.1 (2026-07-15)

Bug Fixes

1.4.0 (2026-05-29)

Features

1.3.0 (2025-11-07)

Features

1.2.0 (2025-10-15)

Features

1.1.0 (2024-10-24)

Features

v9.6.0

What's Changed

Changelog

[Unreleased] (beta, main branch content)

v4.37.0

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

v8.2.1

What's Changed

Bug fix

v4.37.0

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

v4.37.0

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

dependabot Bot commented on behalf of github Jul 22, 2026 •

edited

Loading