[dependabot]

Bumps the actions group with 6 updates:

Package	From	To
github/codeql-action	4.39.1	4.39.3
hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml	64ebfbed21942e7d2a68d46273e54cfc1a3a0580	8906f47f945d4675d7375eb78898ed0f1c48cc95
step-security/harden-runner	2.22.3	2.22.4
leanprover/lean-action	1.7.0	1.7.1
dawidd6/action-send-mail	23	24
softprops/action-gh-release	3.0.3	3.0.4

Updates github/codeql-action from 4.39.1 to 4.39.3

Release notes

Sourced from github/codeql-action's releases.

v4.39.3

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action's changelog.

4.39.3 - 04 Nov 2026

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Commits

• 33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
• 24393f8 Update changelog for v4.39.3
• 064910b Merge pull request #4297 from github/mbg/update-glob
• f532ac5 Update glob to 14.0.3
• 8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
• cea289b Return different exit code when a language is not recognised
• 7287bb3 Remove exclude entry that's no longer needed
• 8eb7cdf Use normal .editorconfig pattern
• 160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
• 913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
• Additional commits viewable in compare view

Updates hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml from 64ebfbed21942e7d2a68d46273e54cfc1a3a0580 to 8906f47f945d4675d7375eb78898ed0f1c48cc95

Changelog

Sourced from hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml's changelog.

Changelog

All notable changes to gitbot-fleet will be documented in this file.

This file is generated from conventional commits by the changelog-reusable.yml workflow (hyperpolymath/standards#206). Adopt the workflow in this repo's CI to keep this file in sync automatically — see templates/cliff.toml for the canonical config.

The format follows Keep a Changelog; this project aims to follow Semantic Versioning.

[Unreleased]

Added

• feat(sustainabot): migrate bot-integration from ReScript to AffineScr… (#199)
• feat(scripts): add fix-tracked-package-lock.sh for standards#67 enforcement (#170)
• feat(robot-repo-automaton): canonical RSR skeleton generator (rsr-template-repo#48) (#160)
• feat(rhodibot): add offline check CLI subcommand for CI gating (#150)
• feat(gsbot)!: faithful Rust/SPARK port — eliminate Python from the fleet (#145)

Fixed

• fix(examples): migrate SafeDOMExample.affine to current AffineScript grammar (closes #208) (#210)
• fix(sustainabot): parse-blocking OCaml-isms and HANDLE-keyword name (Refs #148) (#206)
• fix(licence): clear scaffold-placeholder leak (isolated; dirty repo) (#167)
• fix(ci): pin upload-artifact to valid SHA in fix-unpinned-actions.sh generator (Refs standards#48) (#163)
• fix(ci): bump a2ml/k9-validate-action pins to canonical (standards#85) (#162)
• fix(ci): sync hypatia-scan.yml to canonical (kill cd-scanner build drift) (#161)
• fix: resolve gitbot-fleet legacy hypatia findings at source; de-baseline (#152)
• fix(ci): adopt canonical hypatia-scan.yml (env.HOME/scanner-layout + Comment-step gate) (#151)
• fix(shared-context): clear pre-existing clippy -D warnings debt (item B) (#149)
• fix: stagger estate push to stop CI thundering-herd (#147)

Documentation

• docs(archive): session record for sustainabot #148 hand-port validation (#209)
• docs: promote stub .adoc to faithful AsciiDoc from canonical .md (Item 11 Group A) (#159)

CI

• ci: redistribute concurrency-cancel guard to read-only check workflows (#165)
• ci(hypatia-scan): restore hardened workflow (supersedes #129) (#142)

... (truncated)

Commits

• 8906f47 chore(deps): bump rustls from 0.23.45 to 0.23.46 in /bots/rhodibot (#635)
• 4c841b8 chore(deps): bump rustls from 0.23.45 to 0.23.46 in /bots/glambot (#636)
• b60f614 chore(deps): bump rustls from 0.23.45 to 0.23.46 in /bots/finishingbot (#637)
• 3611897 chore(deps): bump rustls from 0.23.45 to 0.23.46 in /bots/echidnabot in the c...
• f4e2b8d chore(deps): bump rustls from 0.23.45 to 0.23.46 in /bots/seambot (#633)
• 1c22722 chore(deps): bump hyperpolymath/smtp-notify-action from 0.5.0 to 0.5.1 in the...
• 5f3b4ba fix(hooks): fail closed on unavailable and invalid pre-push scans (#654)
• 46d26a4 Require HTTPS for upstream panic-rule table checks (#653)
• c1d8754 Preserve pinned source closure and resolve governance findings (#652)
• 8a4fedd Recognize Agda infrastructure and resolve local prose references (#651)
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.22.3 to 2.22.4

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.4

What's Changed

• Fixed a Linux agent memory leak that could cause runners to run out of memory during jobs with heavy process or network activity.
• The workaround for GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners now defaults to enabled when feature flags can’t be fetched.
• Improved HTTP/2 TLS interception on Linux (enterprise tier).
• Added retries for failed monitoring API requests, improving reliability of monitoring initialization and raw-event uploads.

Full Changelog: step-security/harden-runner@v2.22.3...v2.22.4

Commits

• 1d88384 Merge pull request #716 from step-security/rc-48
• 26249c0 Merge pull request #712 from Prateek-stepsecurity/pn/monitor-retry
• b5a70cf Treat 409 from /monitor as terminal and add retry tests
• 0a48cce Retry /monitor call up to 3 times on failure
• 967c33e Merge pull request #715 from step-security/rc-47
• 4fa77e8 Merge pull request #714 from h0x0er/jatin/agent-v1.9.6-v0.18.1
• dd2b975 bump agent versions
• See full diff in compare view

Updates leanprover/lean-action from 1.7.0 to 1.7.1

Release notes

Sourced from leanprover/lean-action's releases.

v1.7.1

Fixed

• restore the GitHub cache before automatic configuration and mk_all-check, so those steps can reuse cached dependencies and build artifacts

Changelog

Sourced from leanprover/lean-action's changelog.

v1.7.1 - 2026-11-06

Fixed

• restore the GitHub cache before automatic configuration and mk_all-check, so those steps can reuse cached dependencies and build artifacts

Commits

• ba3fdfe perf: restore .lake before configuration and mk_all (#199)
• bd5cb0b chore: finalize v1.7.0 release (#203)
• See full diff in compare view

Updates dawidd6/action-send-mail from 23 to 24

Release notes

Sourced from dawidd6/action-send-mail's releases.

v24

What's Changed

• chore(deps): update dependency nodemailer to v10.2.1 by @​renovate[bot] in dawidd6/action-send-mail#354
• chore(deps): update dependency nodemailer to v10.3.0 by @​renovate[bot] in dawidd6/action-send-mail#356
• node_modules: update by @​dawidd6 in dawidd6/action-send-mail#355
• build(deps): bump undici from 6.29.0 to 6.29.1 by @​dependabot[bot] in dawidd6/action-send-mail#357
• node_modules: update by @​dawidd6 in dawidd6/action-send-mail#358
• chore(deps): update dependency nodemailer to v10.3.1 by @​renovate[bot] in dawidd6/action-send-mail#359
• node_modules: update by @​dawidd6 in dawidd6/action-send-mail#360

Full Changelog: dawidd6/action-send-mail@v23...v24

Commits

• 27bf7a8 node_modules: update (#360)
• a9703ed chore(deps): update dependency nodemailer to v10.3.1 (#359)
• b6b2177 node_modules: update (#358)
• 0d58990 build(deps): bump undici from 6.29.0 to 6.29.1 (#357)
• f8b8145 node_modules: update (#355)
• b6d53ad chore(deps): update dependency nodemailer to v10.3.0 (#356)
• 67d71b1 chore(deps): update dependency nodemailer to v10.2.1 (#354)
• See full diff in compare view

Updates softprops/action-gh-release from 3.0.3 to 3.0.4

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.4

• maintenance release with updated dependencies

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.4

• maintenance release with updated dependencies

Commits

• 8a0cd65 release 3.0.4 (#865)
• ac01154 chore(deps): bump the npm group across 1 directory with 4 updates (#864)
• ca4c9d5 chore(deps): bump minimatch and glob (#862)
• e4a57ae chore(deps): bump undici from 6.29.0 to 6.29.1 (#859)
• ee55a0e chore(deps): bump vite from 8.3.2 to 8.3.5 (#855)
• 8d42b22 chore(deps): bump actions/setup-node (#853)
• 6680cc0 chore(deps): bump the npm group with 3 updates (#851)
• 4a050ba chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#850)
• b5a645e chore(deps): bump the npm group with 4 updates (#848)
• d99a5de chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 (#846)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 753607c9-0dad-4a02-bdc6-7e1aa3a402f6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud