Skip to content

build(deps): bump actions/cache from 5 to 6#903

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/cache-6
Open

build(deps): bump actions/cache from 5 to 6#903
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/cache-6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 24, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/cache from 5 to 6.

Release notes

Sourced from actions/cache's releases.

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5...v6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 24, 2026
@dependabot dependabot Bot requested review from AtomicFS and MDr164 as code owners June 24, 2026 00:09
@AtomicFS AtomicFS enabled auto-merge June 24, 2026 00:09
@github-actions

Copy link
Copy Markdown

MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 15 0 0 0.48s
⚠️ ACTION zizmor 15 339 0 34.7s
✅ BASH bash-exec 10 0 0 0.05s
✅ BASH shellcheck 9 0 0 0.14s
✅ BASH shfmt 9 0 0 0.01s
✅ DOCKERFILE hadolint 5 0 0 0.2s
✅ EDITORCONFIG editorconfig-checker 227 0 0 0.13s
✅ GO revive 31 0 0 36.56s
✅ JSON jsonlint 14 0 0 0.47s
✅ JSON prettier 14 0 0 4.09s
✅ JSON v8r 14 0 0 6.04s
✅ MARKDOWN markdownlint 32 0 0 5.74s
✅ PYTHON black 20 0 0 2.23s
✅ PYTHON flake8 20 0 0 1.57s
✅ PYTHON isort 20 0 0 0.35s
✅ PYTHON mypy 20 0 0 11.54s
✅ PYTHON pylint 20 0 0 9.26s
✅ PYTHON pyright 20 0 0 0.97s
✅ PYTHON ruff 20 0 0 0.03s
✅ REPOSITORY checkov yes no no 29.87s
✅ REPOSITORY gitleaks yes no no 4.8s
✅ REPOSITORY git_diff yes no no 0.02s
❌ REPOSITORY grype yes 6 no 98.1s
❌ REPOSITORY osv-scanner yes 6 no 21.93s
✅ REPOSITORY secretlint yes no no 1.42s
✅ REPOSITORY syft yes no no 5.45s
❌ REPOSITORY trivy yes 1 no 19.53s
✅ REPOSITORY trivy-sbom yes no no 3.12s
✅ REPOSITORY trufflehog yes no no 6.38s
✅ SPELL cspell 227 0 0 5.33s
✅ YAML prettier 35 0 0 2.99s
✅ YAML v8r 35 0 0 15.04s
✅ YAML yamllint 35 0 0 1.61s

Detailed Issues

❌ REPOSITORY / grype - 6 errors
[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME              INSTALLED  FIXED IN  TYPE       VULNERABILITY  SEVERITY  EPSS         RISK  
golang.org/x/net  v0.54.0    0.55.0    go-module  GO-2026-5026   Critical  0.4% (27th)  0.3   
golang.org/x/net  v0.54.0    0.55.0    go-module  GO-2026-5028   Medium    0.3% (25th)  0.2   
golang.org/x/net  v0.54.0    0.55.0    go-module  GO-2026-5025   Medium    0.2% (15th)  0.1   
golang.org/x/net  v0.54.0    0.55.0    go-module  GO-2026-5027   Medium    0.2% (14th)  0.1   
golang.org/x/net  v0.54.0    0.55.0    go-module  GO-2026-5029   Medium    0.2% (14th)  0.1   
golang.org/x/net  v0.54.0    0.55.0    go-module  GO-2026-5030   Medium    0.2% (14th)  0.1
[0098] ERROR discovered vulnerabilities at or above the severity threshold
❌ REPOSITORY / osv-scanner - 6 errors
Scanning dir .
Starting filesystem walk for root: /
Scanned .dagger-ci/daggerci/requirements.txt file and found 9 packages
Scanned cmd/firmware-action/go.mod file and found 59 packages
End status: 79 dirs visited, 339 inodes visited, 2 Extract calls, 9.009612ms elapsed, 9.009813ms wall time

Total 3 packages affected by 17 known vulnerabilities (0 Critical, 1 High, 5 Medium, 0 Low, 11 Unknown) from 2 ecosystems.
17 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+----------+---------+---------------+--------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE  | VERSION | FIXED VERSION | SOURCE                               |
+-------------------------------------+------+-----------+----------+---------+---------------+--------------------------------------+
| https://osv.dev/GO-2026-4866        |      | Go        | stdlib   | 1.26.1  | 1.26.2        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-4869        |      | Go        | stdlib   | 1.26.1  | 1.26.2        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-4870        |      | Go        | stdlib   | 1.26.1  | 1.26.2        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-4918        |      | Go        | stdlib   | 1.26.1  | 1.26.3        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-4946        |      | Go        | stdlib   | 1.26.1  | 1.26.2        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-4947        |      | Go        | stdlib   | 1.26.1  | 1.26.2        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-4971        |      | Go        | stdlib   | 1.26.1  | 1.26.3        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-4977        |      | Go        | stdlib   | 1.26.1  | 1.26.3        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-4986        |      | Go        | stdlib   | 1.26.1  | 1.26.3        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-5037        |      | Go        | stdlib   | 1.26.1  | 1.26.4        | cmd/firmware-action/go.mod           |
| https://osv.dev/GO-2026-5039        |      | Go        | stdlib   | 1.26.1  | 1.26.4        | cmd/firmware-action/go.mod           |
| https://osv.dev/PYSEC-2026-215      | 6.9  | PyPI      | idna     | 3.9.0   | 3.15          | .dagger-ci/daggerci/requirements.txt |
| https://osv.dev/GHSA-65pc-fj4g-8rjx |      |           |          |         |               |                                      |
| https://osv.dev/PYSEC-2018-28       | 7.5  | PyPI      | requests | 2.9.2   | 2.20.0        | .dagger-ci/daggerci/requirements.txt |
| https://osv.dev/GHSA-x84v-xcm2-53pg |      |           |          |         |               |                                      |
| https://osv.dev/PYSEC-2023-74       | 6.1  | PyPI      | requests | 2.9.2   | 2.31.0        | .dagger-ci/daggerci/requirements.txt |
| https://osv.dev/GHSA-j8r2-6x86-q33q |      |           |          |         |               |                                      |
| https://osv.dev/GHSA-9hjg-9r4m-mvj7 | 5.3  | PyPI      | requests | 2.9.2   | 2.32.4        | .dagger-ci/daggerci/requirements.txt |
| https://osv.dev/GHSA-9wx4-h78v-vm56 | 5.6  | PyPI      | requests | 2.9.2   | 2.32.0        | .dagger-ci/daggerci/requirements.txt |
| https://osv.dev/GHSA-gc5v-m9x4-r6x2 | 4.4  | PyPI      | requests | 2.9.2   | 2.33.0        | .dagger-ci/daggerci/requirements.txt |
+-------------------------------------+------+-----------+----------+---------+---------------+--------------------------------------+
❌ REPOSITORY / trivy - 1 error
-------------------->] 100.00% 104.57 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 97.83 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 97.83 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 97.83 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 91.52 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 91.52 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 91.52 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 85.61 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 85.61 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 85.61 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 80.09 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 80.09 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 80.09 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 74.92 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 74.92 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 74.92 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 70.09 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 70.09 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 70.09 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 65.57 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 65.57 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 65.57 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 61.34 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 61.34 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [---------------------------------------------->] 100.00% 61.34 MiB p/s ETA 0s97.07 MiB / 97.07 MiB [-------------------------------------------------] 100.00% 11.76 MiB p/s 8.5s2026-06-24T00:11:54Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-06-24T00:11:54Z	INFO	[vuln] Vulnerability scanning is enabled
2026-06-24T00:11:54Z	INFO	[misconfig] Misconfiguration scanning is enabled
2026-06-24T00:11:54Z	INFO	[checks-client] Need to update the checks bundle
2026-06-24T00:11:54Z	INFO	[checks-client] Downloading the checks bundle...
234.65 KiB / 234.65 KiB [--------------------------------------------------------->] 100.00% ? p/s ?234.65 KiB / 234.65 KiB [----------------------------------------------] 100.00% 19.59 MiB p/s 200ms2026-06-24T00:12:03Z	INFO	Number of language-specific files	num=1
2026-06-24T00:12:03Z	INFO	[gomod] Detecting vulnerabilities...
2026-06-24T00:12:03Z	INFO	Detected config files	num=5
2026-06-24T00:12:03Z	WARN	Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.70/guide/scanner/vulnerability#severity-selection for details.

Report Summary

┌────────────────────────────┬────────────┬─────────────────┬───────────────────┐
│           Target           │    Type    │ Vulnerabilities │ Misconfigurations │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ cmd/firmware-action/go.mod │   gomod    │        6        │         -         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/coreboot/Dockerfile │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/edk2/Dockerfile     │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/linux/Dockerfile    │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/uboot/Dockerfile    │ dockerfile │        -        │         0         │
├────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docker/uroot/Dockerfile    │ dockerfile │        -        │         0         │
└────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


cmd/firmware-action/go.mod (gomod)
==================================
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 6, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2026-25680 │ HIGH     │ fixed  │ v0.54.0           │ 0.55.0        │ Parsing arbitrary HTML can consume excessive CPU time,       │
│                  │                │          │        │                   │               │ possibly leadin ...                                          │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-25680                   │
│                  ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-25681 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                  │                │          │        │                   │               │ can result ...                                               │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-25681                   │
│                  ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-27136 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                  │                │          │        │                   │               │ can result ...                                               │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-27136                   │
│                  ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-39821 │          │        │                   │               │ golang.org/x/net/idna: golang: golang.org/x/net/idna:        │
│                  │                │          │        │                   │               │ Privilege escalation via incorrect Punycode label processing │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                  ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-42502 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                  │                │          │        │                   │               │ can result ...                                               │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42502                   │
│                  ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-42506 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                  │                │          │        │                   │               │ can result ...                                               │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42506                   │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.71.2 of Trivy is now available, current version is 0.70.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 10000 characters out of 12024)
⚠️ ACTION / zizmor - 339 errors
- name: Checkout
   |  _________^
66 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:27:15
   |
27 |         uses: re-actors/alls-green@release/v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:42:15
   |
42 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:45:15
   |
45 |       - uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:60:15
   |
60 |         uses: arduino/setup-task@v2
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:62:15
   |
62 |         uses: actions/setup-python@v6
   |               ^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:66:15
   |
66 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release-prepare.yml:19:9
   |
19 |         - name: Checkout
   |  _________^
20 | |         uses: actions/checkout@v7
21 | |         with:
22 | |           fetch-depth: 0
...  |
25 | |       # Automatically determinate the next release version from Conventional Commits since the latest tag
   | |_________________________________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release-prepare.yml:37:59
   |
36 |         run: |
   |         --- this run block
37 |           sed -i -E "s/default: 'v[0-9\.]+'/default: '${{ steps.semver.outputs.next }}'/g" action.yml
   |                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:20:15
   |
20 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:28:15
   |
28 |         uses: ietf-tools/semver-action@v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:50:15
   |
50 |         uses: peter-evans/create-pull-request@v8
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:28:9
   |
28 |         - name: Checkout code
   |  _________^
29 | |         uses: actions/checkout@v7
30 | |         with:
31 | |           fetch-depth: 0
32 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:87:9
   |
87 |         - name: Checkout code
   |  _________^
88 | |         uses: actions/checkout@v7
89 | |         with:
90 | |           fetch-depth: 0
91 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release.yml:52:28
   |
51 |         run: |
   |         --- this run block
52 |           NEXT_VERSION=${{ steps.get_version.outputs.version }}
   |                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

info[template-injection]: code injection via template expansion
   --> .github/workflows/release.yml:108:27
    |
 99 |         uses: actions/github-script@v9
    |         ------------------------------ action accepts arbitrary code
...
102 |           script: |
    |           ------ via this input
...
108 |                 ref: "${{ steps.get_version.outputs.version }}",
    |                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:29:15
   |
29 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:34:15
   |
34 |         uses: actions/setup-go@v6
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:60:15
   |
60 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:88:15
   |
88 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:99:15
   |
99 |         uses: actions/github-script@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/release.yml:34:9
   |
34 |         uses: actions/setup-go@v6
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
...
60 |         uses: goreleaser/goreleaser-action@v7
   |         ------------------------------------- runtime artifacts usually published here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

339 findings (121 suppressed, 1 safe fixes, 156 unsafe fixes): 62 informational, 36 low, 4 medium, 116 high

(Truncated to last 10000 characters out of 106949)

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,EDITORCONFIG_EDITORCONFIG_CHECKER,GO_REVIVE,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

@codecov

codecov Bot commented Jun 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.22%. Comparing base (7ffdfec) to head (c35a864).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #903   +/-   ##
=======================================
  Coverage   53.22%   53.22%           
=======================================
  Files          17       17           
  Lines        1997     1997           
=======================================
  Hits         1063     1063           
  Misses        841      841           
  Partials       93       93           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant