chore(ci): bump github/codeql-action/analyze from 4.37.7 to 4.37.8 - #69
chore(ci): bump github/codeql-action/analyze from 4.37.7 to 4.37.8#69dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.7 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff2f1c6...db488dd) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
dependencies
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
…ps (#76) Three open Dependabot PRs could never go green, for two distinct reasons. Microsoft.OpenApi (#75): Microsoft.AspNetCore.OpenApi 10.x constrains it to >=2.7.5 <3.0.0, so the proposed 3.10.2 resolves outside the constraint and raises NU1608 — an error here, not a warning, because Directory.Build.props sets TreatWarningsAsErrors. No 3.x can merge until ASP.NET Core moves first. Ignore major updates for that package only; 2.x patches still flow, which is what the explicit pin exists for (GHSA-v5pm-xwqc-g5wc). codeql-action (#72, #69): init and analyze are pinned to a single SHA, and Dependabot raised one PR per sub-action. Either alone lands a mismatch that fails at run time with "Loaded a configuration file for version X, but running version Y". The same hazard sits in #70/#68 — test-suite.yml uploads and downloads artifacts, so the two actions must share a major. Group both families ahead of the actions-all catch-all so co-versioned actions always travel in one PR. Groups match in definition order. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
Closing — same root cause as #72, from the other side.
#76 groups |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps github/codeql-action/analyze from 4.37.7 to 4.37.8.
Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
db488ddMerge pull request #4102 from github/update-v4.37.8-9ee088e131845f5bUpdate changelog for v4.37.89ee088eMerge pull request #4080 from github/henrymercer/studious-giggle1aef003Address review feedback on overlay disk flags508b83bMerge main into overlay minimum disk feature branchd97b342Merge pull request #4098 from github/mbg/permission-error-as-configuration-error47fa622MakeEACCESaConfigurationError45693ccRefactorENOSPCcheck intoisDiskConfigurationErrorfunctionc2fd8f5Merge pull request #4081 from github/mario-campos/version-cache-to-diskc56f48eLog unexpected conditions during caching CLI outputDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)