build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 in the github group by dependabot[bot] · Pull Request #939 · 9elements/firmware-action

dependabot · 2026-08-31T00:13:24Z

Bumps the github group with 1 update: github/codeql-action.

Updates github/codeql-action from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action's releases.

v4.37.9

Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action's changelog.

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

Commits

cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
7243f38 Update changelog for v4.37.9
920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
ecfa6e1 Add changelog note
adcdf4a Update default bundle to codeql-bundle-v2.26.4
486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
4605e03 Rebuild
099c869 Update changelog and version after v4.37.8
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github group with 1 update: [github/codeql-action](https://github.com/github/codeql-action). Updates `github/codeql-action` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.8...v4.37.9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-31T00:16:55Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	15	0	0	0.2s
⚠️ ACTION	zizmor	15	341	0	15.05s
✅ BASH	bash-exec	9	0	0	0.02s
✅ BASH	shellcheck	8	0	0	0.05s
✅ BASH	shfmt	8	0	0	0.0s
✅ DOCKERFILE	hadolint	5	0	0	0.11s
✅ EDITORCONFIG	editorconfig-checker	230	0	0	0.06s
✅ GO	revive	31	0	0	24.82s
✅ JSON	jsonlint	14	0	0	1.16s
✅ JSON	prettier	14	0	0	2.22s
✅ JSON	v8r	14	0	0	3.78s
✅ MARKDOWN	markdownlint	32	0	0	2.1s
✅ PYTHON	black	21	0	0	3.23s
✅ PYTHON	flake8	21	0	0	2.45s
✅ PYTHON	isort	21	0	0	0.67s
✅ PYTHON	mypy	21	0	0	6.76s
✅ PYTHON	pylint	21	0	0	6.74s
✅ PYTHON	pyright	21	0	0	1.33s
✅ PYTHON	ruff	21	0	0	0.06s
✅ REPOSITORY	betterleaks	yes	no	no	1.61s
✅ REPOSITORY	checkov	yes	no	no	24.3s
✅ REPOSITORY	git_diff	yes	no	no	0.17s
❌ REPOSITORY	grype	yes	1	no	73.37s
✅ REPOSITORY	osv-scanner	yes	no	no	20.41s
✅ REPOSITORY	secretlint	yes	no	no	1.71s
✅ REPOSITORY	syft	yes	no	no	14.4s
❌ REPOSITORY	trivy	yes	1	no	17.77s
✅ REPOSITORY	trivy-sbom	yes	no	no	1.27s
✅ REPOSITORY	trufflehog	yes	no	no	6.17s
✅ SPELL	cspell	230	0	0	3.32s
✅ YAML	prettier	36	0	0	5.65s
✅ YAML	v8r	36	0	0	9.71s
✅ YAML	yamllint	36	0	0	3.87s

Detailed Issues

❌ REPOSITORY / grype - 1 error

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME                 INSTALLED  FIXED IN  TYPE       VULNERABILITY  SEVERITY  EPSS         RISK  
golang.org/x/crypto  v0.54.0    0.55.0    go-module  GO-2026-6303   High      0.3% (24th)  0.2   
golang.org/x/crypto  v0.54.0              go-module  GO-2026-5932   Unknown   N/A          N/A
[0073] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / trivy - 1 error

2026-08-31T00:15:43Z	INFO	Loaded	file_path=".trivy.yaml"
2026-08-31T00:15:43Z	INFO	[vulndb] Need to update DB
2026-08-31T00:15:43Z	INFO	[vulndb] Downloading vulnerability DB...
2026-08-31T00:15:43Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
0 B / 109.86 MiB [___________________________________________________________________] 0.00% ? p/s ?36.31 MiB / 109.86 MiB [------------------->________________________________________] 33.05% ? p/s ?66.49 MiB / 109.86 MiB [------------------------------------>_______________________] 60.52% ? p/s ?94.09 MiB / 109.86 MiB [--------------------------------------->______] 85.65% 156.55 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 156.55 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 156.55 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 148.15 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 148.15 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 148.15 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 138.59 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 138.59 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 138.59 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 129.65 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 129.65 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 129.65 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 121.28 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 121.28 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 121.28 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 113.46 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 113.46 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 113.46 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 106.14 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 106.14 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [------------------------------------------->] 100.00% 106.14 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 99.29 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 99.29 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 99.29 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 92.89 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 92.89 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 92.89 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 86.89 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 86.89 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 86.89 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 81.29 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 81.29 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 81.29 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 76.04 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 76.04 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 76.04 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 71.14 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 71.14 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 71.14 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 66.55 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 66.55 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 66.55 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 62.25 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 62.25 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 62.25 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-------------------------------------------->] 100.00% 58.24 MiB p/s ETA 0s109.86 MiB / 109.86 MiB [-----------------------------------------------] 100.00% 11.38 MiB p/s 9.9s2026-08-31T00:15:54Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-08-31T00:15:54Z	INFO	[vuln] Vulnerability scanning is enabled
2026-08-31T00:15:54Z	INFO	[misconfig] Misconfiguration scanning is enabled
2026-08-31T00:15:54Z	INFO	[checks-client] Need to update the checks bundle
2026-08-31T00:15:54Z	INFO	[checks-client] Downloading the checks bundle...
234.65 KiB / 234.65 KiB [--------------------------------------------------------->] 100.00% ? p/s ?234.65 KiB / 234.65 KiB [--------------------------------------------------------->] 100.00% ? p/s ?234.65 KiB / 234.65 KiB [---------------------------------------------] 100.00% 680.59 KiB p/s 500ms2026-08-31T00:16:00Z	INFO	Number of language-specific files	num=1
2026-08-31T00:16:00Z	INFO	[gomod] Detecting vulnerabilities...
2026-08-31T00:16:00Z	INFO	Detected config files	num=5
2026-08-31T00:16:00Z	WARN	Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.73/guide/scanner/vulnerability#severity-selection for details.
2026-08-31T00:16:00Z	INFO	Some vulnerabilities have been ignored/suppressed. Use the "--show-suppressed" flag to display them.

Report Summary

┌────────────────────────────┬────────────┬─────────────────┬───────────────────┐
│           Target           │    Type    │ Vulnerabilities │ Misconfigurations │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ cmd/firmware-action/go.mod │   gomod    │        1        │         -         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/coreboot/Dockerfile │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/edk2/Dockerfile     │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/linux/Dockerfile    │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/uboot/Dockerfile    │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/uroot/Dockerfile    │ dockerfile │        -        │         0         │
└────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.73/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


cmd/firmware-action/go.mod (gomod)
==================================
Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                         Title                         │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2026-56854 │ UNKNOWN  │ fixed  │ v0.54.0           │ 0.55.0        │ The source-address critical option in the Permissions │
│                     │                │          │        │                   │               │ returned by an a ......                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56854            │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.74.0 of Trivy is now available, current version is 0.73.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

⚠️ ACTION / zizmor - 341 errors

it documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:70:15
   |
70 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:72:15
   |
72 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:77:15
   |
77 |         uses: golangci/golangci-lint-action@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:86:15
   |
86 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:88:15
   |
88 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/lint.yml:54:9
   |
 5 | / on:
 6 | |   pull_request: {}
 7 | |   pull_request_review:
 8 | |     types: ['submitted']
...  |
11 | |     branches: ['main']
12 | |     tags: ['v*']
   | |________________- generally used when publishing artifacts generated at runtime
...
54 |         - uses: actions/setup-go@v7
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/pytest.yml:41:9
   |
41 |         - name: Checkout
   |  _________^
42 | |         uses: actions/checkout@v7
43 | |         with:
44 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/pytest.yml:65:9
   |
65 |         - name: Checkout
   |  _________^
66 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:27:15
   |
27 |         uses: re-actors/alls-green@release/v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:42:15
   |
42 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:45:15
   |
45 |       - uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:60:15
   |
60 |         uses: arduino/setup-task@v3
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:62:15
   |
62 |         uses: actions/setup-python@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:66:15
   |
66 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release-prepare.yml:19:9
   |
19 |         - name: Checkout
   |  _________^
20 | |         uses: actions/checkout@v7
21 | |         with:
22 | |           fetch-depth: 0
...  |
25 | |       # Automatically determinate the next release version from Conventional Commits since the latest tag
   | |_________________________________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release-prepare.yml:37:59
   |
36 |         run: |
   |         --- this run block
37 |           sed -i -E "s/default: 'v[0-9\.]+'/default: '${{ steps.semver.outputs.next }}'/g" action.yml
   |                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:20:15
   |
20 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:28:15
   |
28 |         uses: ietf-tools/semver-action@v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:50:15
   |
50 |         uses: peter-evans/create-pull-request@v8
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:28:9
   |
28 |         - name: Checkout code
   |  _________^
29 | |         uses: actions/checkout@v7
30 | |         with:
31 | |           fetch-depth: 0
32 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:87:9
   |
87 |         - name: Checkout code
   |  _________^
88 | |         uses: actions/checkout@v7
89 | |         with:
90 | |           fetch-depth: 0
91 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release.yml:52:28
   |
51 |         run: |
   |         --- this run block
52 |           NEXT_VERSION=${{ steps.get_version.outputs.version }}
   |                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

info[template-injection]: code injection via template expansion
   --> .github/workflows/release.yml:108:27
    |
 99 |         uses: actions/github-script@v9
    |         ------------------------------ action accepts arbitrary code
...
102 |           script: |
    |           ------ via this input
...
108 |                 ref: "${{ steps.get_version.outputs.version }}",
    |                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:29:15
   |
29 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:34:15
   |
34 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:60:15
   |
60 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:88:15
   |
88 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:99:15
   |
99 |         uses: actions/github-script@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/release.yml:34:9
   |
34 |         uses: actions/setup-go@v7
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
...
60 |         uses: goreleaser/goreleaser-action@v7
   |         ------------------------------------- runtime artifacts usually published here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

341 findings (121 suppressed, 1 safe fixes, 158 unsafe fixes): 62 informational, 36 low, 4 medium, 118 high

(Truncated to last 13333 characters out of 108025)

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: MARKDOWN_MARKDOWN_LINK_CHECK, REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,EDITORCONFIG_EDITORCONFIG_CHECKER,GO_REVIVE,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 31, 2026

dependabot Bot requested review from AtomicFS and MDr164 as code owners August 31, 2026 00:13

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 31, 2026

AtomicFS enabled auto-merge August 31, 2026 00:13

AtomicFS approved these changes Aug 31, 2026

View reviewed changes

AtomicFS disabled auto-merge August 31, 2026 08:43

AtomicFS merged commit ac4165c into main Aug 31, 2026
56 of 57 checks passed

AtomicFS deleted the dependabot/github_actions/github-39eae9928b branch August 31, 2026 08:44

Navigation Menu

build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 in the github group - #939

build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 in the github group#939
AtomicFS merged 1 commit into
mainfrom
dependabot/github_actions/github-39eae9928b

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

v4.37.9

4.37.9 - 26 Aug 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant