Skip to content

chore(deps): bump the github-actions-dependencies group across 1 directory with 9 updates#1428

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-dependencies-a2331e154e
Closed

chore(deps): bump the github-actions-dependencies group across 1 directory with 9 updates#1428
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-dependencies-a2331e154e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions-dependencies group with 9 updates in the / directory:

Package From To
hoverkraft-tech/ci-github-common/.github/workflows/linter.yml 0.37.1 0.37.2
actions/checkout 6.0.3 7.0.0
hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request 0.37.1 0.37.2
hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml 0.37.1 0.37.2
hoverkraft-tech/ci-dokumentor 0.3.1 0.4.0
hoverkraft-tech/ci-github-publish/actions/deploy/github-pages 0.26.3 0.26.4
hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml 0.37.1 0.37.2
hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml 0.37.1 0.37.2
hoverkraft-tech/ci-github-common/.github/workflows/stale.yml 0.37.1 0.37.2

Updates hoverkraft-tech/ci-github-common/.github/workflows/linter.yml from 0.37.1 to 0.37.2

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/linter.yml's releases.

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates actions/checkout from 6.0.3 to 7.0.0

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request from 0.37.1 to 0.37.2

Release notes

Sourced from hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request's releases.

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml from 0.37.1 to 0.37.2

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml's releases.

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates hoverkraft-tech/ci-dokumentor from 0.3.1 to 0.4.0

Release notes

Sourced from hoverkraft-tech/ci-dokumentor's releases.

0.4.0

Release Summary

No new runtime features or bug fixes are included; the public update refreshes the action documentation.

Internal maintenance updates production, development, documentation, and GitHub Actions dependencies, including webpack-dev-server, ws, commander, and grouped npm/GitHub Actions upgrades.

Breaking changes

No Breaking changes.

What's Changed

Full Changelog: hoverkraft-tech/ci-dokumentor@0.3.1...0.4.0

Commits
  • 301ef70 build(deps-dev): Bump the npm-development-dependencies group across 1 directo...
  • 4a56281 build(deps): Bump the github-actions-dependencies group across 1 directory wi...
  • b7a6c68 build(deps): Bump commander in the npm-production-dependencies group
  • ae3a11d build(deps): Bump the npm-docs-dependencies group with 2 updates
  • c54bf05 build(deps): Bump ws from 8.18.3 to 8.20.1
  • 1ef67e8 docs: update action documentation
  • f448253 build(deps): Bump webpack-dev-server from 5.2.2 to 5.2.4
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-publish/actions/deploy/github-pages from 0.26.3 to 0.26.4

Release notes

Sourced from hoverkraft-tech/ci-github-publish/actions/deploy/github-pages's releases.

0.26.4

Release Summary

Documentation now clarifies the token permissions required and updates the available actions and workflows documentation.

actions/argocd/get-manifest-files now correctly handles value assignment without mutating a constant unexpectedly.

Breaking changes

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-publish@0.26.3...0.26.4

Commits
  • 5ecd2fc docs: update actions and workflows documentation
  • 06ca00d build(deps): Bump the github-actions-dependencies group across 8 directories ...
  • 83646fa docs: update actions and workflows documentation
  • 63184f4 fix(actions/argocd/get-manifest-files): unexpected value assignment on const
  • 5bd10dc docs: update actions and workflows documentation
  • c751cb6 docs: tell required permissions for token
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml from 0.37.1 to 0.37.2

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml's releases.

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml from 0.37.1 to 0.37.2

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml's releases.

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-common/.github/workflows/stale.yml from 0.37.1 to 0.37.2

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/stale.yml's releases.

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ctory with 9 updates

Bumps the github-actions-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hoverkraft-tech/ci-github-common/.github/workflows/linter.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.2` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.0` |
| [hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.2` |
| [hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.2` |
| [hoverkraft-tech/ci-dokumentor](https://github.com/hoverkraft-tech/ci-dokumentor) | `0.3.1` | `0.4.0` |
| [hoverkraft-tech/ci-github-publish/actions/deploy/github-pages](https://github.com/hoverkraft-tech/ci-github-publish) | `0.26.3` | `0.26.4` |
| [hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.2` |
| [hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.2` |
| [hoverkraft-tech/ci-github-common/.github/workflows/stale.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.2` |



Updates `hoverkraft-tech/ci-github-common/.github/workflows/linter.yml` from 0.37.1 to 0.37.2
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...7034f6a)

Updates `actions/checkout` from 6.0.3 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

Updates `hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request` from 0.37.1 to 0.37.2
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...7034f6a)

Updates `hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml` from 0.37.1 to 0.37.2
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...7034f6a)

Updates `hoverkraft-tech/ci-dokumentor` from 0.3.1 to 0.4.0
- [Release notes](https://github.com/hoverkraft-tech/ci-dokumentor/releases)
- [Commits](hoverkraft-tech/ci-dokumentor@3258ef0...301ef70)

Updates `hoverkraft-tech/ci-github-publish/actions/deploy/github-pages` from 0.26.3 to 0.26.4
- [Release notes](https://github.com/hoverkraft-tech/ci-github-publish/releases)
- [Commits](hoverkraft-tech/ci-github-publish@b2562b4...5ecd2fc)

Updates `hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml` from 0.37.1 to 0.37.2
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...7034f6a)

Updates `hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml` from 0.37.1 to 0.37.2
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...7034f6a)

Updates `hoverkraft-tech/ci-github-common/.github/workflows/stale.yml` from 0.37.1 to 0.37.2
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...7034f6a)

---
updated-dependencies:
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-dokumentor
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-publish/actions/deploy/github-pages
  dependency-version: 0.26.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Jun 26, 2026
@github-actions

Copy link
Copy Markdown

Hi, thank you for creating your PR, we will check it out very soon

@github-actions

Copy link
Copy Markdown

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
GITHUB_ACTIONS Pass ✅
GITHUB_ACTIONS_ZIZMOR Pass ✅
GITLEAKS Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Pass ✅
YAML_PRETTIER Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

TRIVY

Report Summary

┌──────────────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│                        Target                        │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ .github/actions/generate-blog-post/package-lock.json │    npm     │        0        │         -         │    -    │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ .github/actions/share-blog-post/package-lock.json    │    npm     │        2        │         -         │    -    │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ .github/actions/validate-manifest/package-lock.json  │    npm     │        0        │         -         │    -    │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ application/package-lock.json                        │    npm     │       11        │         -         │    -    │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                                           │ dockerfile │        -        │         0         │    -    │
└──────────────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


.github/actions/share-blog-post/package-lock.json (npm)
=======================================================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ js-yaml │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0         │ js-yaml is a JavaScript YAML parser and dumper. Prior to │
│         │                │          │        │                   │               │ 4.2.0, a...                                              │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550               │
│         │                │          │        ├───────────────────┤               │                                                          │
│         │                │          │        │ 4.1.1             │               │                                                          │
│         │                │          │        │                   │               │                                                          │
│         │                │          │        │                   │               │                                                          │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

application/package-lock.json (npm)
===================================
Total: 11 (UNKNOWN: 0, LOW: 3, MEDIUM: 4, HIGH: 4, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version         │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ @babel/core │ CVE-2026-49356 │ LOW      │ fixed  │ 7.29.0            │ 8.0.0-rc.6, 7.29.6           │ Babel is a compiler for writing next generation JavaScript. │
│             │                │          │        │                   │                              │ Prior to 8...                                               │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-49356                  │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │        │ 4.1.1             │ 4.2.0                        │ js-yaml is a JavaScript YAML parser and dumper. Prior to    │
│             │                │          │        │                   │                              │ 4.2.0, a...                                                 │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
├─────────────┼────────────────┤          │        ├───────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ tar         │ CVE-2026-53655 │          │        │ 7.5.14            │ 7.5.16                       │ node-tar is a full-featured Tar for Node.js. Prior to       │
│             │                │          │        │                   │                              │ 7.5.16, tar (nod...                                         │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-53655                  │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ undici      │ CVE-2026-12151 │ HIGH     │        │ 7.25.0            │ 6.27.0, 7.28.0, 8.5.0        │ undici: undici: Denial of Service due to unbounded memory   │
│             │                │          │        │                   │                              │ growth via WebSocket...                                     │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-12151                  │
│             ├────────────────┤          │        │                   ├──────────────────────────────┼─────────────────────────────────────────────────────────────┤
│             │ CVE-2026-6734  │          │        │                   │ 7.28.0, 8.2.0                │ undici: undici: Information disclosure and data integrity   │
│             │                │          │        │                   │                              │ issues due to incorrect Socks5ProxyAgent...                 │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-6734                   │
│             ├────────────────┤          │        │                   ├──────────────────────────────┼─────────────────────────────────────────────────────────────┤
│             │ CVE-2026-9697  │          │        │                   │ 7.28.0, 8.5.0                │ undici: undici: Man-in-the-Middle attack via ignored TLS    │
│             │                │          │        │                   │                              │ options with SOCKS5 proxy                                   │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9697                   │
│             ├────────────────┼──────────┤        │                   │                              ├─────────────────────────────────────────────────────────────┤
│             │ CVE-2026-9678  │ MEDIUM   │        │                   │                              │ undici: Undici: Information disclosure due to improper      │
│             │                │          │        │                   │                              │ cache-control header parsing                                │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9678                   │
│             ├────────────────┤          │        │                   ├──────────────────────────────┼─────────────────────────────────────────────────────────────┤
│             │ CVE-2026-9679  │          │        │                   │ 6.27.0, 7.28.0, 8.5.0        │ undici: undici vulnerable to HTTP header injection via      │
│             │                │          │        │                   │                              │ Set-Cookie percent-decoding                                 │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9679                   │
│             ├────────────────┼──────────┤        │                   │                              ├─────────────────────────────────────────────────────────────┤
│             │ CVE-2026-11525 │ LOW      │        │                   │                              │ undici: undici: Weakening of cookie SameSite policy due to  │
│             │                │          │        │                   │                              │ incorrect parsing of...                                     │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-11525                  │
│             ├────────────────┤          │        │                   │                              ├─────────────────────────────────────────────────────────────┤
│             │ CVE-2026-6733  │          │        │                   │                              │ undici: Undici: Response queue poisoning on reused          │
│             │                │          │        │                   │                              │ keep-alive sockets can lead to...                           │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-6733                   │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ ws          │ CVE-2026-48779 │ HIGH     │        │ 8.20.1            │ 5.2.5, 6.2.4, 7.5.11, 8.21.0 │ ws: ws: Denial of Service via memory exhaustion from small  │
│             │                │          │        │                   │                              │ WebSocket fragments...                                      │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-48779                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴─────────────────────────────────────────────────────────────┘

@github-actions

Copy link
Copy Markdown

Code Coverage Report

Coverage Results

Test Results

Status Count
✅ Passed 27
❌ Failed 0
⏭️ Skipped 0
Total 27

Pass Rate: 100.0%

Coverage

Metric Covered Total Percentage
Lines 100 108 92.59%
Branches 95 105 90.48%
Functions 22 23 95.65%

Overall: 92.59% 🟢
🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩⬜

@dependabot @github

dependabot Bot commented on behalf of github Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1432.

@dependabot dependabot Bot closed this Jul 3, 2026
@dependabot dependabot Bot deleted the dependabot/github_actions/github-actions-dependencies-a2331e154e branch July 3, 2026 15:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants