ci(deps): bump the actions group with 4 updates by dependabot[bot] · Pull Request #207 · SimplyLiz/CodeMCP

dependabot · 2026-04-14T08:57:10Z

Bumps the actions group with 4 updates: actions/upload-artifact, actions/cache, marocchino/sticky-pull-request-comment and actions/github-script.

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
See full diff in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
See full diff in compare view

Updates marocchino/sticky-pull-request-comment from 3.0.3 to 3.0.4

Release notes

Sourced from marocchino/sticky-pull-request-comment's releases.

v3.0.4

What's Changed

build(deps-dev): Bump vite from 8.0.3 to 8.0.5 by @dependabot[bot] in marocchino/sticky-pull-request-comment#1679

build(deps-dev): Bump vitest from 4.1.2 to 4.1.3 by @dependabot[bot] in marocchino/sticky-pull-request-comment#1680

build(deps-dev): Bump @types/node from 25.5.2 to 25.6.0 by @dependabot[bot] in marocchino/sticky-pull-request-comment#1684

build(deps): Bump @actions/github from 9.0.0 to 9.1.0 by @dependabot[bot] in marocchino/sticky-pull-request-comment#1683

build(deps-dev): Bump vitest from 4.1.3 to 4.1.4 by @dependabot[bot] in marocchino/sticky-pull-request-comment#1682

build(deps-dev): Bump @biomejs/biome from 2.4.10 to 2.4.11 by @dependabot[bot] in marocchino/sticky-pull-request-comment#1681

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.3...v3.0.4

Commits

0ea0beb 📦️ Build
df6c1bd build(deps-dev): Bump @biomejs/biome from 2.4.10 to 2.4.11 (#1681)
3ad213f build(deps-dev): Bump vitest from 4.1.3 to 4.1.4 (#1682)
58072e5 build(deps): Bump @actions/github from 9.0.0 to 9.1.0 (#1683)
313a938 build(deps-dev): Bump @types/node from 25.5.2 to 25.6.0 (#1684)
159c677 build(deps-dev): Bump vitest from 4.1.2 to 4.1.3 (#1680)
b37c1a1 build(deps-dev): Bump vite from 8.0.3 to 8.0.5 (#1679)
See full diff in compare view

Updates actions/github-script from 8.0.0 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.

Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.

getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.

If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in actions/github-script#695

ci: use deployment: false for integration test environments by @salmanmkc in actions/github-script#712

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in actions/github-script#700

New Contributors

@Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits

3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
ca10bbd fix: use @octokit/core/types import for v7 compatibility
86e48e2 merge: incorporate main branch changes
c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
ff8117e ci: fix user-agent test to handle orchestration ID
81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
3953caf docs: update README examples from @v8 to @v9, add getOctokit docs and v9 brea...
c17d55b ci: add getOctokit integration test job
a047196 test: add getOctokit integration tests via callAsyncFunction
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 4 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/cache](https://github.com/actions/cache), [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) and [actions/github-script](https://github.com/actions/github-script). Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) Updates `actions/cache` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@6682284...27d5ce7) Updates `marocchino/sticky-pull-request-comment` from 3.0.3 to 3.0.4 - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](marocchino/sticky-pull-request-comment@d4d6b09...0ea0beb) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@ed59741...3a2844b) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-04-14T08:58:37Z

🟢 Change Impact Analysis

Metric	Value
Risk Level	LOW 🟢
Files Changed	11
Symbols Changed	11
Directly Affected	0
Transitively Affected	0

Blast Radius: 0 modules, 0 files, 0 unique callers

📝 Changed Symbols (11)

Symbol	File	Type	Confidence
`.github/workflows/build-matrix.yml`	`.github/workflows/build-matrix.yml`	modified	30%
`.github/workflows/ci.yml`	`.github/workflows/ci.yml`	modified	30%
`.github/workflows/ckb.yml`	`.github/workflows/ckb.yml`	modified	30%
`.github/workflows/cov.yml`	`.github/workflows/cov.yml`	modified	30%
`.github/workflows/nfr.yml`	`.github/workflows/nfr.yml`	modified	30%
`.github/workflows/security-dependencies.yml`	`.github/workflows/security-dependencies.yml`	modified	30%
`.github/workflows/security-gate.yml`	`.github/workflows/security-gate.yml`	modified	30%
`.github/workflows/security-sast-common.yml`	`.github/workflows/security-sast-common.yml`	modified	30%
`.github/workflows/security-sast-go.yml`	`.github/workflows/security-sast-go.yml`	modified	30%
`.github/workflows/security-sast-python.yml`	`.github/workflows/security-sast-python.yml`	modified	30%
`.github/workflows/security-secrets.yml`	`.github/workflows/security-secrets.yml`	modified	30%

Recommendations

ℹ️ coverage: 11 symbols have low mapping confidence. Index may be stale.
- Action: Run 'ckb index' to refresh the SCIP index

_{Generated by CKB}

github-actions · 2026-04-14T08:59:28Z

CKB Analysis

🎯 11 changed → 0 affected · 🔥 9 hotspots · 📚 197 stale

Risk factors: Medium-sized PR with 11 files • Touches 9 hotspot(s)

👥 Suggested: @lisa.welsch1985@gmail.com (91%), @talantyyr@gmail.com (91%)

Metric	Value
Impact Analysis	11 symbols → 0 affected	🟢
Doc Coverage	6.598984771573605%	⚠️
Complexity	0 violations	✅
Coupling	0 gaps	✅
Blast Radius	0 modules, 0 files	✅
Index	indexed (0s)	🆕

🎯 Change Impact Analysis · 🟢 LOW · 11 changed → 0 affected

Metric	Value
Symbols Changed	11
Directly Affected	0
Transitively Affected	0
Modules in Blast Radius	0
Files in Blast Radius	0

Symbols changed in this PR:

.github/workflows/build-matrix.yml [modified] (30%) — .github/workflows/build-matrix.yml
.github/workflows/ci.yml [modified] (30%) — .github/workflows/ci.yml
.github/workflows/ckb.yml [modified] (30%) — .github/workflows/ckb.yml
.github/workflows/cov.yml [modified] (30%) — .github/workflows/cov.yml
.github/workflows/nfr.yml [modified] (30%) — .github/workflows/nfr.yml
.github/workflows/security-dependencies.yml [modified] (30%) — .github/workflows/security-dependencies.yml
.github/workflows/security-gate.yml [modified] (30%) — .github/workflows/security-gate.yml
.github/workflows/security-sast-common.yml [modified] (30%) — .github/workflows/security-sast-common.yml
.github/workflows/security-sast-go.yml [modified] (30%) — .github/workflows/security-sast-go.yml
.github/workflows/security-sast-python.yml [modified] (30%) — .github/workflows/security-sast-python.yml
… and 1 more

Recommendations:

ℹ️ 11 symbols have low mapping confidence. Index may be stale.
- Action: Run 'ckb index' to refresh the SCIP index

🔥 Hotspots · 9 volatile files

File	Churn Score
`.github/workflows/ci.yml`	20.49
`.github/workflows/ckb.yml`	12.20
`.github/workflows/nfr.yml`	9.91
`.github/workflows/security-dependencies.yml`	9.48
`.github/workflows/security-gate.yml`	10.37
`.github/workflows/security-sast-common.yml`	9.66
`.github/workflows/security-sast-go.yml`	8.22
`.github/workflows/security-sast-python.yml`	8.58

📦 Modules · 1 at risk

	Module	Files
🔴	`.github/workflows`	11

💡 Quick wins · 10 suggestions

🟡 Add tests → internal/audit/analyzer.go
🟡 Add tests → internal/query/engine_test.go
🟡 Add tests → internal/incremental/store_test.go
🟡 Add tests → internal/incremental/detector_test.go
🟡 Add tests → internal/identity/identity_test.go
🟢 Assign backup owner → internal/audit/analyzer.go
🟢 Assign backup owner → internal/query/engine_test.go
🟢 Assign backup owner → internal/incremental/store_test.go

📚 Stale docs · 197 broken references

docs/CONTRIBUTING.md:108 → errors.New
docs/CONTRIBUTING.md:108 → errors.SYMBOL_NOT_FOUND
docs/CONTRIBUTING.md:111 → errors.Wrap
docs/backlog/index-refresh-improvements.md:36 → watcher.Add
docs/backlog/index-refresh-improvements.md:36 → filepath.Join
docs/backlog/index-refresh-improvements.md:97 → time.Second
docs/featureplans/change-impact-analysis-checklist.md:208 → coverage.out
docs/featureplans/change-impact-analysis-checklist.md:214 → lcov.info
docs/featureplans/change-impact-analysis-checklist.md:309 → coverage.out
docs/featureplans/change-impact-analysis.md:448 → scip.SCIPIndex
docs/featureplans/change-impact-analysis.md:478 → context.Context
docs/featureplans/change-impact-analysis.md:669 → coverage.out
docs/features/a2a/overview.md:41 → index.initialized
docs/features/a2a/overview.md:42 → index.fresh
docs/features/a2a/overview.md:43 → index.commitsBehind

_{Generated by CKB · Run details}

github-actions · 2026-04-14T09:02:45Z

CKB review failed to generate output.

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(deps): bump the actions group with 4 updates#207

ci(deps): bump the actions group with 4 updates#207
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/github_actions/develop/actions-a2cfd80d71

dependabot bot commented on behalf of github Apr 14, 2026

Uh oh!

github-actions bot commented Apr 14, 2026

Uh oh!

github-actions bot commented Apr 14, 2026

Uh oh!

github-actions bot commented Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Apr 14, 2026

v7.0.1

What's Changed

v5.0.5

What's Changed

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

v3.0.4

What's Changed

v9.0.0

What's Changed

New Contributors

Uh oh!

github-actions bot commented Apr 14, 2026

🟢 Change Impact Analysis

Recommendations

Uh oh!

github-actions bot commented Apr 14, 2026

CKB Analysis

Uh oh!

github-actions bot commented Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants