Repository navigation
chore(deps): bump workflow actions together (autobuild 6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1,install-action 8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29->a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30,init 6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1,analyze 6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1) - #177
Merged
Merged
Conversation
…e351a197ba0b00d91d03cd2aee # v4.39.0->9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1,install-action 8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29->a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30,init 6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1,analyze 6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1) All workflow refs for each action move in one commit so CodeQL and other multi-step workflows run against a single version. Supersedes the currently open Dependabot PRs for these bumps, which fail in isolation because they leave the steps of the same workflow on different versions. I also grouped github-actions updates in .github/dependabot.yml so future action bumps arrive as one PR per week instead of one PR per step.
tokio 1.53.x before 1.53.3 has AsyncFd constructors that violate I/O safety (RUSTSEC-2026-0386); the lockfile now tracks 1.54.1. cargo-deny treats the unsound advisory as an error, so every fresh CI run fails without this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the currently open Dependabot workflow bumps into one branch so every reference of each multi-step action moves together and CI can pass:
github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29->taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0->github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1I also added a
groups.actionsblock for the github-actions ecosystem in.github/dependabot.yml, so future action bumps land as a single weekly PR instead of one PR per workflow step (same pattern the npm, go-modules and gradle ecosystems already use here).Supersedes:
Each superseded PR applies only one step of a shared workflow, which trips the CodeQL version-mismatch check (
All steps in a workflow that use github/codeql-action must use the same version), so they cannot go green individually.