Skip to content

build(deps): update anyio requirement from ~=4.14 to ~=4.15 in /.dagger-ci/daggerci - #940

Merged
AtomicFS merged 1 commit into
mainfrom
dependabot/pip/dot-dagger-ci/daggerci/anyio-approx-eq-4.15
Sep 7, 2026
Merged

AtomicFS merged 1 commit into
mainfrom
dependabot/pip/dot-dagger-ci/daggerci/anyio-approx-eq-4.15

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on anyio to permit the latest version.

Release notes

Sourced from anyio's releases.

4.15.0

  • Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

    • follow_symlinks on exists() (Python 3.12+)
    • follow_symlinks on is_dir() (Python 3.13+)
    • follow_symlinks on is_file() (Python 3.13+)
    • follow_symlinks on owner() (Python 3.13+)
    • follow_symlinks on group() (Python 3.13+)
    • newline on read_text() (Python 3.13+)

    (#1286, #1293; PR by @​jaideeppyne)

  • Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

  • Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

  • Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

  • Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

  • Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

  • Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

  • Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

  • Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

  • Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

  • Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

  • Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

  • Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

  • Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

  • Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

  • Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

  • Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

  • Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

  • Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

  • Fixed asyncio task groups leaking unawaited coroutines when a custom task constructor fails; default task creation is unaffected (#1274; PR by @​dsfaccini)

... (truncated)

Commits
  • 9283662 Bumped up the version
  • d137692 Improved the instructions for AI agents
  • 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
  • 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
  • b825c3b Fixed pyproject.toml changes not triggering the test suite
  • 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
  • b05fe6d Fixed wrong type in move_on_after (#1297)
  • 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
  • ae25044 [pre-commit.ci] pre-commit autoupdate (#1290)
  • 6d3a30d Add follow_symlinks argument to anyio.Path.owner() and group() (#1293)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [anyio](https://github.com/agronholm/anyio) to permit the latest version.
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.0...4.15.0)

---
updated-dependencies:
- dependency-name: anyio
  dependency-version: 4.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 7, 2026
@dependabot
dependabot Bot requested review from AtomicFS and MDr164 as code owners September 7, 2026 00:08
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 7, 2026
@AtomicFS
AtomicFS enabled auto-merge September 7, 2026 00:08
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
✅ ACTION actionlint 15 0 0 0.51s
⚠️ ACTION zizmor 15 341 0 15.21s
✅ BASH bash-exec 9 0 0 0.03s
✅ BASH shellcheck 8 0 0 0.09s
✅ BASH shfmt 8 0 0 0.01s
✅ DOCKERFILE hadolint 5 0 0 0.23s
✅ EDITORCONFIG editorconfig-checker 230 0 0 0.12s
✅ GO revive 31 0 0 38.28s
✅ JSON jsonlint 14 0 0 1.67s
✅ JSON prettier 14 0 0 2.46s
✅ JSON v8r 14 0 0 6.23s
✅ MARKDOWN markdownlint 32 0 0 3.28s
✅ PYTHON black 21 0 0 2.33s
✅ PYTHON flake8 21 0 0 1.58s
✅ PYTHON isort 21 0 0 1.34s
✅ PYTHON mypy 21 0 0 11.92s
✅ PYTHON pylint 21 0 0 10.05s
✅ PYTHON pyright 21 0 0 3.01s
✅ PYTHON ruff 21 0 0 0.06s
✅ REPOSITORY betterleaks yes no no 2.77s
✅ REPOSITORY checkov yes no no 29.01s
✅ REPOSITORY git_diff yes no no 0.03s
❌ REPOSITORY grype yes 3 no 114.49s
✅ REPOSITORY osv-scanner yes no no 27.01s
✅ REPOSITORY secretlint yes no no 1.38s
✅ REPOSITORY syft yes no no 22.72s
❌ REPOSITORY trivy yes 1 no 18.84s
✅ REPOSITORY trivy-sbom yes no no 3.59s
✅ REPOSITORY trufflehog yes no no 8.08s
✅ SPELL cspell 230 0 0 6.03s
✅ YAML prettier 36 0 0 10.91s
⚠️ YAML v8r 36 1 0 18.92s
✅ YAML yamllint 36 0 0 10.88s

Detailed Issues

❌ REPOSITORY / grype - 3 errors
[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME                 INSTALLED  FIXED IN  TYPE       VULNERABILITY  SEVERITY  EPSS         RISK  
golang.org/x/crypto  v0.54.0    0.56.0    go-module  GO-2026-6355   High      0.4% (30th)  0.3   
golang.org/x/crypto  v0.54.0    0.55.0    go-module  GO-2026-6303   High      0.3% (25th)  0.2   
golang.org/x/crypto  v0.54.0    0.56.0    go-module  GO-2026-6354   High      0.3% (23rd)  0.2   
golang.org/x/crypto  v0.54.0              go-module  GO-2026-5932   Unknown   N/A          N/A
[0114] ERROR discovered vulnerabilities at or above the severity threshold
❌ REPOSITORY / trivy - 1 error
1 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [------------------------------------------->] 100.00% 117.61 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [------------------------------------------->] 100.00% 110.02 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [------------------------------------------->] 100.00% 110.02 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [------------------------------------------->] 100.00% 110.02 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [------------------------------------------->] 100.00% 102.92 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [------------------------------------------->] 100.00% 102.92 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [------------------------------------------->] 100.00% 102.92 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 96.28 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 96.28 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 96.28 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 90.07 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 90.07 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 90.07 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 84.26 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 84.26 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 84.26 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 78.83 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 78.83 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 78.83 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 73.74 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 73.74 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 73.74 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 68.98 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 68.98 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 68.98 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 64.53 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 64.53 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 64.53 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 60.37 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 60.37 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 60.37 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 56.47 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 56.47 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 56.47 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 52.83 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 52.83 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 52.83 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 49.42 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 49.42 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 49.42 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 46.23 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------->] 100.00% 46.23 MiB p/s ETA 0s111.09 MiB / 111.09 MiB [-------------------------------------------------] 100.00% 9.44 MiB p/s 12s2026-09-07T00:10:54Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-09-07T00:10:54Z	INFO	[vuln] Vulnerability scanning is enabled
2026-09-07T00:10:54Z	INFO	[misconfig] Misconfiguration scanning is enabled
2026-09-07T00:10:54Z	INFO	[checks-client] Need to update the checks bundle
2026-09-07T00:10:54Z	INFO	[checks-client] Downloading the checks bundle...
234.65 KiB / 234.65 KiB [--------------------------------------------------------->] 100.00% ? p/s ?234.65 KiB / 234.65 KiB [-----------------------------------------------] 100.00% 8.81 MiB p/s 200ms2026-09-07T00:10:59Z	INFO	Number of language-specific files	num=1
2026-09-07T00:10:59Z	INFO	[gomod] Detecting vulnerabilities...
2026-09-07T00:10:59Z	INFO	Detected config files	num=5
2026-09-07T00:10:59Z	WARN	Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.74/guide/scanner/vulnerability#severity-selection for details.
2026-09-07T00:10:59Z	INFO	Some vulnerabilities have been ignored/suppressed. Use the "--show-suppressed" flag to display them.

Report Summary

┌────────────────────────────┬────────────┬─────────────────┬───────────────────┐
│           Target           │    Type    │ Vulnerabilities │ Misconfigurations │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ cmd/firmware-action/go.mod │   gomod    │        3        │         -         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/coreboot/Dockerfile │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/edk2/Dockerfile     │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/linux/Dockerfile    │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/uboot/Dockerfile    │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/uroot/Dockerfile    │ dockerfile │        -        │         0         │
└────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.74/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


cmd/firmware-action/go.mod (gomod)
==================================
Total: 3 (UNKNOWN: 2, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2026-56854 │ CRITICAL │ fixed  │ v0.54.0           │ 0.55.0        │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:         │
│                     │                │          │        │                   │               │ Authentication bypass due to unenforced source-address    │
│                     │                │          │        │                   │               │ restrictions                                              │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56854                │
│                     ├────────────────┼──────────┤        │                   ├───────────────┼───────────────────────────────────────────────────────────┤
│                     │ CVE-2026-56855 │ UNKNOWN  │        │                   │ 0.56.0        │ Previously, after a channel has been established, a       │
│                     │                │          │        │                   │               │ malicious peer cou ......                                 │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56855                │
│                     ├────────────────┤          │        │                   │               ├───────────────────────────────────────────────────────────┤
│                     │ CVE-2026-78662 │          │        │                   │               │ Previously, a channel registered in the mux's chanList is │
│                     │                │          │        │                   │               │ not usable u...                                           │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-78662                │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

(Truncated to last 10000 characters out of 11960)
⚠️ YAML / v8r - 1 error
✖ .github/workflows/docker-build-and-test-rerun.yml is invalid

✖ Maximum call stack size exceeded
⚠️ ACTION / zizmor - 341 errors
- name: Checkout
   |  _________^
66 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:27:15
   |
27 |         uses: re-actors/alls-green@release/v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:42:15
   |
42 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:45:15
   |
45 |       - uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:60:15
   |
60 |         uses: arduino/setup-task@v3
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:62:15
   |
62 |         uses: actions/setup-python@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:66:15
   |
66 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release-prepare.yml:19:9
   |
19 |         - name: Checkout
   |  _________^
20 | |         uses: actions/checkout@v7
21 | |         with:
22 | |           fetch-depth: 0
...  |
25 | |       # Automatically determinate the next release version from Conventional Commits since the latest tag
   | |_________________________________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release-prepare.yml:37:59
   |
36 |         run: |
   |         --- this run block
37 |           sed -i -E "s/default: 'v[0-9\.]+'/default: '${{ steps.semver.outputs.next }}'/g" action.yml
   |                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:20:15
   |
20 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:28:15
   |
28 |         uses: ietf-tools/semver-action@v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:50:15
   |
50 |         uses: peter-evans/create-pull-request@v8
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:28:9
   |
28 |         - name: Checkout code
   |  _________^
29 | |         uses: actions/checkout@v7
30 | |         with:
31 | |           fetch-depth: 0
32 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:87:9
   |
87 |         - name: Checkout code
   |  _________^
88 | |         uses: actions/checkout@v7
89 | |         with:
90 | |           fetch-depth: 0
91 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release.yml:52:28
   |
51 |         run: |
   |         --- this run block
52 |           NEXT_VERSION=${{ steps.get_version.outputs.version }}
   |                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

info[template-injection]: code injection via template expansion
   --> .github/workflows/release.yml:108:27
    |
 99 |         uses: actions/github-script@v9
    |         ------------------------------ action accepts arbitrary code
...
102 |           script: |
    |           ------ via this input
...
108 |                 ref: "${{ steps.get_version.outputs.version }}",
    |                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:29:15
   |
29 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:34:15
   |
34 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:60:15
   |
60 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:88:15
   |
88 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:99:15
   |
99 |         uses: actions/github-script@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/release.yml:34:9
   |
34 |         uses: actions/setup-go@v7
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
...
60 |         uses: goreleaser/goreleaser-action@v7
   |         ------------------------------------- runtime artifacts usually published here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

341 findings (121 suppressed, 1 safe fixes, 158 unsafe fixes): 62 informational, 36 low, 4 medium, 118 high

(Truncated to last 10000 characters out of 108025)

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: MARKDOWN_MARKDOWN_LINK_CHECK, REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,EDITORCONFIG_EDITORCONFIG_CHECKER,GO_REVIVE,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@AtomicFS
AtomicFS disabled auto-merge September 7, 2026 09:04
@AtomicFS
AtomicFS merged commit dc664c9 into main Sep 7, 2026
56 of 57 checks passed
@AtomicFS
AtomicFS deleted the dependabot/pip/dot-dagger-ci/daggerci/anyio-approx-eq-4.15 branch September 7, 2026 09:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant