Skip to content

Bump the gha group with 2 updates#517

Merged
psiinon merged 1 commit into
mainfrom
dependabot/github_actions/gha-bbea8d63e1
Jul 1, 2026
Merged

Bump the gha group with 2 updates#517
psiinon merged 1 commit into
mainfrom
dependabot/github_actions/gha-bbea8d63e1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the gha group with 2 updates: actions/checkout and gradle/actions/setup-gradle.

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates gradle/actions/setup-gradle from 6.1.0 to 6.2.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.2.0

Highlights

This release brings significant behaviour improvements to Enhanced caching, improvements to the generated Job Summary, and a number of correctness and security fixes.

  1. Improved cache-cleanup mechanism. Cleanup of stale files from the Gradle User Home is now faster, and no longer depends on Gradle or a JVM. It works by inspecting the local file state directly, removing the Gradle invocation from the post-build step.
  2. More granular, more stable caching. The local build cache is stored as a separate cache entry, so it can be restored and invalidated independently of the main Gradle User Home entry. Transient Gradle housekeeping files are excluded from the cache, reducing its size and improving stability.
  3. Hide obsolete Job summaries in PR commments: When a new Job summary comment is added to a PR, previous outdated Job summaries are now hidden.
  4. Improved caching report in the job summary. The cache report now uses a single, consistent layout across all cache states and providers. Provider information is integrated directly into the report, and per-entry details are available in an expandable section. (#985)
  5. Correctness and security fixes. A unique cache key is now used per run attempt, so re-runs no longer collide; the job summary shows the cache key string rather than an internal id; and bundled dependencies have been updated, including a ReDoS fix and a fast-xml CVE fix.

What's Changed

New Contributors

Full Changelog: gradle/actions@v6.1.1...v6.2.0

v6.1.1

This release updates various dependency versions, resolving several reported security vulnerabilities. No functional changes are included

What's Changed

Full Changelog: gradle/actions@v6.1.0...v6.1.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the gha group with 2 updates
77864b6 
Bumps the gha group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [gradle/actions/setup-gradle](https://github.com/gradle/actions).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

Updates `gradle/actions/setup-gradle` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@50e97c2...3f131e8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha
- dependency-name: gradle/actions/setup-gradle
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 1, 2026
@psiinon

psiinon commented Jul 1, 2026

Copy link
Copy Markdown
Member

Logo
Checkmarx One – Scan Summary & Details – 417dd337-d36b-4040-bab1-bbe6ea1895be

New Issues (9) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 HIGH Last User Is 'root' /docker-wrapper: 10
detailsLeaving the last user as root can cause security risks. Change to another user after running the commands that need privileges
2 MEDIUM Hardcoded_Password_in_Connection_String other/api/sdlc-integration/core/scan_module/scan.py: 219
detailsThe application contains hardcoded connection details, "PASS: ", at line 219 of /other/api/sdlc-integration/core/scan_module/scan.py. This conn...
Attack Vector
3 MEDIUM Use_of_Broken_or_Risky_Cryptographic_Algorithm payloadgenerator/associated_fields.py: 34
detailsIn , the application protects sensitive data using a cryptographic algorithm, hexdigest, that is considered weak or even trivially broken, in /payl...
Attack Vector
4 LOW Filtering_Sensitive_Logs other/api/sdlc-integration/core/scan_module/scan.py: 218
detailsThe application logs various user events, and in method  writes sensitive user details to debug, in /other/api/sdlc-integration/core/scan_module/...
Attack Vector
5 LOW Filtering_Sensitive_Logs other/api/sdlc-integration/core/scan_module/scan.py: 243
detailsThe application logs various user events, and in method  writes sensitive user details to debug, in /other/api/sdlc-integration/core/scan_module/...
Attack Vector
6 LOW MAINTAINER Instruction Being Used /docker-wrapper: 3
detailsThe MAINTAINER instruction sets the Author field of the generated images. The LABEL instruction is a much more flexible version of this and you sh...
7 LOW Unpinned Actions Full Length Commit SHA /codeql.yml: 31
detailsPinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
8 LOW Unpinned Actions Full Length Commit SHA /codeql.yml: 34
detailsPinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
9 LOW Unpinned Actions Full Length Commit SHA /codeql.yml: 35
detailsPinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

@psiinon psiinon merged commit da8634d into main Jul 1, 2026
9 checks passed
@dependabot dependabot Bot deleted the dependabot/github_actions/gha-bbea8d63e1 branch July 1, 2026 10:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@psiinon psiinon psiinon approved these changes
@thc202 thc202 thc202 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@psiinon @thc202