You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Verdict: No high-confidence vulnerabilities found.
This PR only bumps actions/checkout from @v6 to @v7 across seven workflow files. No application code, secrets handling, or workflow trigger/permission model changes are introduced.
Scope reviewed
Area
Result
Injection (command, path, template)
No new vectors — diff is version-string replacements only
Authn/authz bypass
No changes to permissions:, triggers, or token usage
Secrets / logging
Unchanged (secrets.GITHUB_TOKEN usage identical)
SSRF / deserialization / XSS
Not applicable to this diff
Supply chain
Major-version bump to official actions/checkout; v7 includes dependency security fixes and fork-PR checkout hardening
Trigger compatibility (v7 behavior)
actions/checkout@v7 blocks checkout of fork PR code on pull_request_target and workflow_run unless allow-unsafe-pr-checkout: true is set. None of the affected workflows use those triggers — they use standard pull_request, push, schedule, and workflow_dispatch. The bump is neutral-to-positive for this repo's CI posture.
check-workspace-parity.yml checks out a peer repo via a hardcoded case on GITHUB_REPOSITORY (not user-controlled input); that logic is unchanged.
Low-priority hygiene (not vulnerabilities)
Workflows continue to pin actions/checkout to the floating @v7 tag rather than an immutable commit SHA. This is pre-existing practice (was @v6) and is common for official GitHub actions, but SHA pinning would further reduce tag-retag supply-chain risk if you want to harden later.
Recommendation: Safe to merge from a security perspective.
Verdict: No high-confidence vulnerabilities found.
This PR only bumps actions/checkout from @v6 to @v7 across seven workflow files. No application code, secrets handling, or workflow trigger/permission model changes are introduced.
Scope reviewed
Area
Result
Injection (command, path, template)
No new vectors — diff is version-string replacements only
Authn/authz bypass
No changes to permissions:, triggers, or token usage
Secrets / logging
Unchanged (secrets.GITHUB_TOKEN usage identical)
SSRF / deserialization / XSS
Not applicable to this diff
Supply chain
Major-version bump to official actions/checkout; v7 includes dependency security fixes and fork-PR checkout hardening
Trigger compatibility (v7 behavior)
actions/checkout@v7 blocks checkout of fork PR code on pull_request_target and workflow_run unless allow-unsafe-pr-checkout: true is set. None of the affected workflows use those triggers — they use standard pull_request, push, schedule, and workflow_dispatch. The bump is neutral-to-positive for this repo's CI posture.
check-workspace-parity.yml checks out a peer repo via a hardcoded case on GITHUB_REPOSITORY (not user-controlled input); that logic is unchanged.
Low-priority hygiene (not vulnerabilities)
Workflows continue to pin actions/checkout to the floating @v7 tag rather than an immutable commit SHA. This is pre-existing practice (was @v6) and is common for official GitHub actions, but SHA pinning would further reduce tag-retag supply-chain risk if you want to harden later.
Recommendation: Safe to merge from a security perspective.
Sent by Cursor Automation: Find vulnerabilities
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps the weekly-dependency-refresh group with 1 update: actions/checkout.
Updates
actions/checkoutfrom 6 to 7Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions