Ludy87
e4e9bba413
Update tauri-build.yml
2025-11-30 20:23:11 +01:00
Ludy87
4f66948ed6
Add libglib2.0-dev to Ubuntu build dependencies
...
Included libglib2.0-dev in the list of packages installed for Ubuntu builds to ensure all required libraries are available for Tauri application compilation.
2025-11-30 19:45:14 +01:00
Ludy87
7b726496c7
Update tauri-build.yml
2025-11-30 18:56:27 +01:00
Ludy87
93c11d1702
Refactor Linux build steps in Tauri workflow
...
Linux build matrix no longer passes bundle arguments directly; instead, a dedicated step for building AppImage, deb, and rpm is added for the Ubuntu platform. Other platforms use the general Tauri build step, improving workflow clarity and separation of build logic.
2025-11-30 18:50:26 +01:00
Ludy87
1bfe37f2fe
Fix typo in tauri-build workflow args
...
Replaces '--buildes' with '--bundles' in the matrix configuration for Linux builds in the tauri-build GitHub Actions workflow to ensure correct argument usage.
2025-11-30 18:23:11 +01:00
Ludy87
5099dc049e
Update build workflow and bundle targets
...
Adds explicit build targets (appimage, deb, rpm) for Linux in the GitHub Actions workflow and expands Tauri bundle targets to include deb, rpm, dmg, app, and msi. Removes JRE caching step to always rebuild the custom JRE during CI.
2025-11-30 18:18:33 +01:00
Ludy87
b9d71cdef0
Update tauri-build.yml
2025-11-30 17:54:36 +01:00
Ludy87
98fdf1a01b
Update tauri-build.yml
2025-11-30 17:48:58 +01:00
Ludy87
d5453a06cd
Update tauri-build.yml
2025-11-30 17:18:58 +01:00
Ludy87
6009310c69
Update tauri-build.yml
2025-11-30 17:17:19 +01:00
Ludy87
b0fe3877a9
Update tauri-build.yml
2025-11-30 17:17:03 +01:00
Ludy87
640aa861d4
Refactor JRE build and dependencies in CI workflows
2025-11-30 17:12:17 +01:00
Ludy87
2f33d0318e
Update multiOSReleases.yml
2025-11-30 16:51:05 +01:00
Ludy87
4634ccb25d
Update multiOSReleases.yml
2025-11-30 16:22:50 +01:00
Ludy87
153faec52a
Update app version to 2.0.2 and fix workflow dependencies
...
Bump app version from 2.0.0 to 2.0.2 in tauri config and simulation configs. Add missing 'linuxdeploy' package and fix typo in GitHub Actions workflow dependencies for Ubuntu builds.
2025-11-30 15:06:10 +01:00
Ludy87
f06f6d30d1
Update Ubuntu dependencies in CI workflow
...
Added desktop-file-utils and libglib2.0-bin to the list of packages installed for Ubuntu-22.04 in the multiOSReleases workflow to ensure required tools are available for builds.
2025-11-30 14:39:37 +01:00
Anthony Stirling and GitHub
e47ed13be8
Builds custom Jar ( #5029 )
...
# Description of Changes
Change jar files to contain frontend if provided with param, else
doesnt... add release artifact -server version which wont have frontend
---
## Checklist
### General
- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md )
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md )
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md )
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings
### Documentation
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/ )
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags )
(for new translation tags only)
### Translations (if applicable)
- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md )
### UI Changes (if applicable)
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)
### Testing (if applicable)
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing )
for more details.
2025-11-26 17:21:42 +00:00
Anthony Stirling and GitHub
d4765938a8
publish GHAs ( #5026 )
...
# Description of Changes
<!--
Please provide a summary of the changes, including:
- What was changed
- Why the change was made
- Any challenges encountered
Closes #(issue_number)
-->
---
## Checklist
### General
- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md )
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md )
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md )
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings
### Documentation
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/ )
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags )
(for new translation tags only)
### Translations (if applicable)
- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md )
### UI Changes (if applicable)
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)
### Testing (if applicable)
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing )
for more details.
2025-11-26 15:22:02 +00:00
Anthony Stirling and GitHub
8757a80fda
Update tauri-build.yml ( #4978 )
...
# Description of Changes
<!--
Please provide a summary of the changes, including:
- What was changed
- Why the change was made
- Any challenges encountered
Closes #(issue_number)
-->
---
## Checklist
### General
- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md )
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md )
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md )
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings
### Documentation
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/ )
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags )
(for new translation tags only)
### Translations (if applicable)
- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md )
### UI Changes (if applicable)
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)
### Testing (if applicable)
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing )
for more details.
2025-11-24 23:31:09 +00:00
b0397da19e
PDF Text editor ( #4724 )
...
## Summary
- add a `PdfJsonConversionService` that serializes PDF text, fonts, and
metadata to JSON and rebuilds a PDF from the same structure
- expose REST endpoints for `/pdf/json` and `/json/pdf` conversions
using the existing convert API infrastructure
- define JSON model classes capturing document metadata, font
information, and positioned text elements
## Testing
- `./gradlew spotlessApply` *(fails: plugin
org.springframework.boot:3.5.4 unavailable in build environment)*
- `./gradlew build` *(fails: plugin org.springframework.boot:3.5.4
unavailable in build environment)*
------
https://chatgpt.com/codex/tasks/task_b_68f8e98d94ac8328a0e499e541528b6f
---------
Co-authored-by: EthanHealy01 <ethan.healy.21@gmail.com >
2025-11-24 14:15:02 +00:00
James Brunton and GitHub
e8e98128d2
Allow login to SaaS for desktop instead of offline mode ( #4941 )
...
# Description of Changes
Makes the desktop options to sign in with your Stirling account, or sign
into self-hosted:
<img width="608" height="456" alt="image"
src="https://github.com/user-attachments/assets/a49988ab-db3f-4333-b242-790aee5c07c6 "
/>
The first option still runs everything locally, just enforces that
you've signed in for now. Future work will enable sending operations
that can't be run locally to the server.
2025-11-22 00:38:59 +00:00
6c8d2c89fe
Add initial Windows signing infrastructure ( #4945 )
...
# Description of Changes
<!--
Please provide a summary of the changes, including:
- What was changed
- Why the change was made
- Any challenges encountered
Closes #(issue_number)
-->
---
## Checklist
### General
- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md )
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md )
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md )
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings
### Documentation
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/ )
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags )
(for new translation tags only)
### Translations (if applicable)
- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md )
### UI Changes (if applicable)
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)
### Testing (if applicable)
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing )
for more details.
---------
Co-authored-by: James Brunton <james@stirlingpdf.com >
Co-authored-by: James Brunton <jbrunton96@gmail.com >
2025-11-20 12:21:42 +00:00
James Brunton and GitHub
be78c72887
Only build Tauri for things that touch desktop specifically, or main/V2 ( #4897 )
...
# Description of Changes
Only build Tauri for things that touch desktop specifically, or main/V2
2025-11-14 13:41:07 +00:00
James Brunton and GitHub
d06391a927
Redesign and enable macOS signing ( #4883 )
...
# Description of Changes
Re-enable macOS signing and tweak so it runs successfully through CI.
Also changes the runner to use macOS 15 instead of 13, which was
throwing a deprecation warning in GitHub. Note that the runner doesn't
affect the minimum target, which I've still got set to 10.15 (no idea if
it actually works on 10.15 but let's assume that if it builds it works
until someone can test it)
2025-11-13 12:11:59 +00:00
Anthony Stirling and GitHub
00fb40fb74
Update PR-Auto-Deploy-V2.yml
2025-11-05 23:33:53 +00:00
4c0c9b28ef
V2 Tauri integration ( #3854 )
...
# Description of Changes
Please provide a summary of the changes, including:
## Add PDF File Association Support for Tauri App
### 🎯 **Features Added**
- PDF file association configuration in Tauri
- Command line argument detection for opened files
- Automatic file loading when app is launched via "Open with"
- Cross-platform support (Windows/macOS)
### 🔧 **Technical Changes**
- Added `fileAssociations` in `tauri.conf.json` for PDF files
- New `get_opened_file` Tauri command to detect file arguments
- `fileOpenService` with Tauri fs plugin integration
- `useOpenedFile` hook for React integration
- Improved backend health logging during startup (reduced noise)
### 🧪 **Testing**
See
* https://v2.tauri.app/start/prerequisites/
*
[DesktopApplicationDevelopmentGuide.md](DesktopApplicationDevelopmentGuide.md)
```bash
# Test file association during development:
cd frontend
npm install
cargo tauri dev --no-watch -- -- "path/to/file.pdf"
```
For production testing:
1. Build: npm run tauri build
2. Install the built app
3. Right-click PDF → "Open with" → Stirling-PDF
🚀 User Experience
- Users can now double-click PDF files to open them directly in
Stirling-PDF
- Files automatically load in the viewer when opened via file
association
- Seamless integration with OS file handling
---
## Checklist
### General
- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md )
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md )
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/HowToAddNewLanguage.md )
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings
### Documentation
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/ )
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/HowToAddNewLanguage.md#add-new-translation-tags )
(for new translation tags only)
### UI Changes (if applicable)
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)
### Testing (if applicable)
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#6-testing )
for more details.
---------
Co-authored-by: Connor Yoh <connor@stirlingpdf.com >
Co-authored-by: James Brunton <james@stirlingpdf.com >
Co-authored-by: James Brunton <jbrunton96@gmail.com >
2025-11-05 11:44:59 +00:00
Anthony Stirling
2ed68d25a9
Merge remote-tracking branch 'origin/V2' into mainToV2
2025-11-03 23:01:41 +00:00
James Brunton and GitHub
d2b38ef4b8
Restructure frontend code to allow for extensions ( #4721 )
...
# Description of Changes
Move frontend code into `core` folder and add infrastructure for
`proprietary` folder to include premium, non-OSS features
2025-10-28 10:29:36 +00:00
20600ac1c3
ci(deps): pin GitHub Actions to SHAs, upgrade to checkout v5 & setup-* v5/6, adopt Node 22, harden runner, bump docker-compose ( #4591 )
...
# Description of Changes
<!--
Please provide a summary of the changes, including:
- What was changed
- Why the change was made
- Any challenges encountered
Closes #(issue_number)
-->
---
## Checklist
### General
- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md )
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md )
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md )
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings
### Documentation
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/ )
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags )
(for new translation tags only)
### UI Changes (if applicable)
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)
### Testing (if applicable)
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing )
for more details.
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-10-27 16:32:45 +00:00
Anthony Stirling
884944527e
conflict fix again
2025-10-12 21:13:01 +01:00
Anthony Stirling
45c438d66d
Merge remote-tracking branch 'origin/V2' into mainToV2
2025-10-12 20:45:25 +01:00
b18c652727
build(deps): bump actions/stale from 10.0.0 to 10.1.0 ( #4603 )
...
Bumps [actions/stale](https://github.com/actions/stale ) from 10.0.0 to
10.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/stale/releases ">actions/stale's
releases</a>.</em></p>
<blockquote>
<h2>v10.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add <code>only-issue-types</code> option to filter issues by type by
<a href="https://github.com/Bibo-Joshi "><code>@Bibo-Joshi</code></a> in
<a
href="https://redirect.github.com/actions/stale/pull/1255 ">actions/stale#1255</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/Bibo-Joshi "><code>@Bibo-Joshi</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/stale/pull/1255 ">actions/stale#1255</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/stale/compare/v10...v10.1.0 ">https://github.com/actions/stale/compare/v10...v10.1.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/stale/commit/5f858e3efba33a5ca4407a664cc011ad407f2008 "><code>5f858e3</code></a>
Add <code>only-issue-types</code> option to filter issues by type (<a
href="https://redirect.github.com/actions/stale/issues/1255 ">#1255</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/stale/compare/3a9db7e6a41a89f618792c92c0e97cc736e1b13f...5f858e3efba33a5ca4407a664cc011ad407f2008 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-06 10:47:53 +01:00
5b90ad4a92
build(deps): bump github/codeql-action from 3.30.5 to 3.30.6 ( #4601 )
...
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps [github/codeql-action](https://github.com/github/codeql-action )
from 3.30.5 to 3.30.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases ">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v3.30.6</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases ">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>3.30.6 - 02 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.2. <a
href="https://redirect.github.com/github/codeql-action/pull/3168 ">#3168</a></li>
</ul>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v3.30.6/CHANGELOG.md ">CHANGELOG.md</a>
for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md ">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases ">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.30.6 - 02 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.2. <a
href="https://redirect.github.com/github/codeql-action/pull/3168 ">#3168</a></li>
</ul>
<h2>3.30.5 - 26 Sep 2025</h2>
<ul>
<li>We fixed a bug that was introduced in <code>3.30.4</code> with
<code>upload-sarif</code> which resulted in files without a
<code>.sarif</code> extension not getting uploaded. <a
href="https://redirect.github.com/github/codeql-action/pull/3160 ">#3160</a></li>
</ul>
<h2>3.30.4 - 25 Sep 2025</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the
workflow it is used in does not use different versions of the CodeQL
Action for different workflow steps. Mixing different versions of the
CodeQL Action in the same workflow is unsupported and can lead to
unpredictable results. A warning will now be emitted from the
<code>codeql-action/init</code> step if different versions of the CodeQL
Action are detected in the workflow file. Additionally, an error will
now be thrown by the other CodeQL Action steps if they load a
configuration file that was generated by a different version of the
<code>codeql-action/init</code> step. <a
href="https://redirect.github.com/github/codeql-action/pull/3099 ">#3099</a>
and <a
href="https://redirect.github.com/github/codeql-action/pull/3100 ">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java
analyses, which will reduce cache usage and speed up workflows. This
will be enabled automatically at a later time. <a
href="https://redirect.github.com/github/codeql-action/pull/3107 ">#3107</a></li>
<li>You can now run the latest CodeQL nightly bundle by passing
<code>tools: nightly</code> to the <code>init</code> action. In general,
the nightly bundle is unstable and we only recommend running it when
directed by GitHub staff. <a
href="https://redirect.github.com/github/codeql-action/pull/3130 ">#3130</a></li>
<li>Update default CodeQL bundle version to 2.23.1. <a
href="https://redirect.github.com/github/codeql-action/pull/3118 ">#3118</a></li>
</ul>
<h2>3.30.3 - 10 Sep 2025</h2>
<p>No user facing changes.</p>
<h2>3.30.2 - 09 Sep 2025</h2>
<ul>
<li>Fixed a bug which could cause language autodetection to fail. <a
href="https://redirect.github.com/github/codeql-action/pull/3084 ">#3084</a></li>
<li>Experimental: The <code>quality-queries</code> input that was added
in <code>3.29.2</code> as part of an internal experiment is now
deprecated and will be removed in an upcoming version of the CodeQL
Action. It has been superseded by a new <code>analysis-kinds</code>
input, which is part of the same internal experiment. Do not use this in
production as it is subject to change at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3064 ">#3064</a></li>
</ul>
<h2>3.30.1 - 05 Sep 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3077 ">#3077</a></li>
</ul>
<h2>3.30.0 - 01 Sep 2025</h2>
<ul>
<li>Reduce the size of the CodeQL Action, speeding up workflows by
approximately 4 seconds. <a
href="https://redirect.github.com/github/codeql-action/pull/3054 ">#3054</a></li>
</ul>
<h2>3.29.11 - 21 Aug 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3044 ">#3044</a></li>
</ul>
<h2>3.29.10 - 18 Aug 2025</h2>
<p>No user facing changes.</p>
<h2>3.29.9 - 12 Aug 2025</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/64d10c13136e1c5bce3e5fbde8d4906eeaafc885 "><code>64d10c1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3172 ">#3172</a>
from github/update-v3.30.6-10feb5d2a</li>
<li><a
href="https://github.com/github/codeql-action/commit/909610e8a847f0bd00aec15db1ca9e69b006b832 "><code>909610e</code></a>
Update changelog for v3.30.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/10feb5d2a2535fc4a649a440d3cc1605adc4b401 "><code>10feb5d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3167 ">#3167</a>
from github/mbg/upload-sarif/find-then-filter</li>
<li><a
href="https://github.com/github/codeql-action/commit/4182ea3d4e571a0ef1fe400e2be7dac377d0bfab "><code>4182ea3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3168 ">#3168</a>
from github/update-bundle/codeql-bundle-v2.23.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/34afe5b7b14d3606c13bf651daa19ddd8a0f7266 "><code>34afe5b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3171 ">#3171</a>
from github/mbg/start-proxy/telemetry</li>
<li><a
href="https://github.com/github/codeql-action/commit/096fe67f97e494ef06346b2edba7862069e6f879 "><code>096fe67</code></a>
Merge branch 'main' into update-bundle/codeql-bundle-v2.23.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/b4964014adc5c667e691999fa475b29d2634750c "><code>b496401</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3170 ">#3170</a>
from github/mbg/start-proxy/remove-update-workflow</li>
<li><a
href="https://github.com/github/codeql-action/commit/d573787cca00bdd533d895012a2af0dad5f2e66a "><code>d573787</code></a>
Report registry types that are configured for CodeQL in
<code>start-proxy</code> telemetry</li>
<li><a
href="https://github.com/github/codeql-action/commit/15916800df051ff24b89c0f961260e8bea28d85f "><code>1591680</code></a>
Send a basic status report in <code>start-proxy</code> Action if it
succeeds</li>
<li><a
href="https://github.com/github/codeql-action/commit/cb5a2849ac05d53b82c70a5feb2a56a85feb20d4 "><code>cb5a284</code></a>
Send status report when <code>start-proxy</code> fails</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/3599b3baa15b485a2e49ef411a7a4bb2452e7f93...64d10c13136e1c5bce3e5fbde8d4906eeaafc885 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-06 10:47:49 +01:00
1120f54cda
build(deps): bump softprops/action-gh-release from 2.3.3 to 2.3.4 ( #4602 )
...
Bumps
[softprops/action-gh-release](https://github.com/softprops/action-gh-release )
from 2.3.3 to 2.3.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/softprops/action-gh-release/releases ">softprops/action-gh-release's
releases</a>.</em></p>
<blockquote>
<h2>v2.3.4</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Bug fixes 🐛 </h3>
<ul>
<li>fix(action): handle 422 already_exists race condition by <a
href="https://github.com/stephenway "><code>@stephenway</code></a> in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/665 ">softprops/action-gh-release#665</a></li>
</ul>
<h3>Other Changes 🔄 </h3>
<ul>
<li>chore(deps): bump actions/setup-node from 4.4.0 to 5.0.0 in the
github-actions group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/656 ">softprops/action-gh-release#656</a></li>
<li>chore(deps): bump <code>@types/node</code> from 20.19.11 to
20.19.13 in the npm group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/655 ">softprops/action-gh-release#655</a></li>
<li>chore(deps): bump vite from 7.0.0 to 7.1.5 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/657 ">softprops/action-gh-release#657</a></li>
<li>chore(deps): bump the npm group across 1 directory with 2 updates by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/662 ">softprops/action-gh-release#662</a></li>
<li>chore(deps): bump the npm group with 3 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/666 ">softprops/action-gh-release#666</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/softprops/action-gh-release/compare/v2...v2.3.4 ">https://github.com/softprops/action-gh-release/compare/v2...v2.3.4 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md ">softprops/action-gh-release's
changelog</a>.</em></p>
<blockquote>
<h2>2.3.4</h2>
<h2>What's Changed</h2>
<h3>Bug fixes 🐛 </h3>
<ul>
<li>fix(action): handle 422 already_exists race condition by <a
href="https://github.com/stephenway "><code>@stephenway</code></a> in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/665 ">softprops/action-gh-release#665</a></li>
</ul>
<h3>Other Changes 🔄 </h3>
<ul>
<li>dependency updates</li>
</ul>
<h2>2.3.3</h2>
<h2>What's Changed</h2>
<h3>Exciting New Features 🎉 </h3>
<ul>
<li>feat: add input option <code>overwrite_files</code> by <a
href="https://github.com/asfernandes "><code>@asfernandes</code></a> in
<a
href="https://redirect.github.com/softprops/action-gh-release/pull/343 ">softprops/action-gh-release#343</a></li>
</ul>
<h3>Other Changes 🔄 </h3>
<ul>
<li>dependency updates</li>
</ul>
<h2>2.3.2</h2>
<ul>
<li>fix: revert fs <code>readableWebStream</code> change</li>
</ul>
<h2>2.3.1</h2>
<h3>Bug fixes 🐛 </h3>
<ul>
<li>fix: fix file closing issue by <a
href="https://github.com/WailGree "><code>@WailGree</code></a> in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/629 ">softprops/action-gh-release#629</a></li>
</ul>
<h2>2.3.0</h2>
<ul>
<li>Migrate from jest to vitest</li>
<li>Replace <code>mime</code> with <code>mime-types</code></li>
<li>Bump to use node 24</li>
<li>Dependency updates</li>
</ul>
<h2>2.2.2</h2>
<h2>What's Changed</h2>
<h3>Bug fixes 🐛 </h3>
<ul>
<li>fix: updating release draft status from true to false by <a
href="https://github.com/galargh "><code>@galargh</code></a> in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/316 ">softprops/action-gh-release#316</a></li>
</ul>
<h3>Other Changes 🔄 </h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/softprops/action-gh-release/commit/62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 "><code>62c96d0</code></a>
release 2.3.4</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/7dc9b8ac0f2368b3a87cf0705832afc474fc7cd8 "><code>7dc9b8a</code></a>
fix(action): handle 422 already_exists race condition (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/665 ">#665</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/0f0e0b98e953d8219f04f51a8608dd41c902f012 "><code>0f0e0b9</code></a>
chore(deps): bump the npm group with 3 updates (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/666 ">#666</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/97d42c1b50f585f357413698aa1b779307aa0d52 "><code>97d42c1</code></a>
chore(deps): bump the npm group across 1 directory with 2 updates (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/662 ">#662</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/19cd0bcd2b95a5f9e0aab8377b3cae33e51c2234 "><code>19cd0bc</code></a>
chore(deps): bump vite from 7.0.0 to 7.1.5 (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/657 ">#657</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/5d1b0b11643723aa24b0a5f8cef9618f9c2ed69b "><code>5d1b0b1</code></a>
chore(deps): bump <code>@types/node</code> from 20.19.11 to 20.19.13 in
the npm group (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/655 ">#655</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/f6021cf9a4e291961602215a20006a3bcfb743c1 "><code>f6021cf</code></a>
chore(deps): bump actions/setup-node in the github-actions group (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/656 ">#656</a>)</li>
<li>See full diff in <a
href="https://github.com/softprops/action-gh-release/compare/6cbd405e2c4e67a21c47fa9e383d020e4e28b836...62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 ">compare
view</a></li>
</ul>
</details>
<br />
<details>
<summary>Most Recent Ignore Conditions Applied to This Pull
Request</summary>
| Dependency Name | Ignore Conditions |
| --- | --- |
| softprops/action-gh-release | [>= 2.2.a, < 2.3] |
</details>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-06 10:47:37 +01:00
31b03475e7
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 ( #4604 )
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action )
from 2.4.2 to 2.4.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ossf/scorecard-action/releases ">ossf/scorecard-action's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.3</h2>
<h2>What's Changed</h2>
<p>This update bumps the Scorecard version to the v5.3.0 release. For a
complete list of changes, please refer to the <a
href="https://github.com/ossf/scorecard/releases/tag/v5.3.0 ">Scorecard
v5.3.0 release notes</a>.</p>
<h2>Documentation</h2>
<ul>
<li>docs: clarify <code>GITHUB_TOKEN</code> permissions needed for
private repos by <a
href="https://github.com/pankajtaneja5 "><code>@pankajtaneja5</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1574 ">ossf/scorecard-action#1574</a></li>
<li>📖 Fix recommended command to test the image in development by
<a
href="https://github.com/deivid-rodriguez "><code>@deivid-rodriguez</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1583 ">ossf/scorecard-action#1583</a></li>
</ul>
<h2>Other</h2>
<ul>
<li>add missing top-level token permissions to workflows by <a
href="https://github.com/timothyklee "><code>@timothyklee</code></a> in
<a
href="https://redirect.github.com/ossf/scorecard-action/pull/1566 ">ossf/scorecard-action#1566</a></li>
<li>setup codeowners for requesting reviews by <a
href="https://github.com/spencerschrock "><code>@spencerschrock</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1576 ">ossf/scorecard-action#1576</a></li>
<li>🌱 Improve printing options by <a
href="https://github.com/deivid-rodriguez "><code>@deivid-rodriguez</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1584 ">ossf/scorecard-action#1584</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/timothyklee "><code>@timothyklee</code></a>
made their first contribution in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1566 ">ossf/scorecard-action#1566</a></li>
<li><a
href="https://github.com/pankajtaneja5 "><code>@pankajtaneja5</code></a>
made their first contribution in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1574 ">ossf/scorecard-action#1574</a></li>
<li><a
href="https://github.com/deivid-rodriguez "><code>@deivid-rodriguez</code></a>
made their first contribution in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1584 ">ossf/scorecard-action#1584</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/ossf/scorecard-action/compare/v2.4.2...v2.4.3 ">https://github.com/ossf/scorecard-action/compare/v2.4.2...v2.4.3 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ossf/scorecard-action/commit/4eaacf0543bb3f2c246792bd56e8cdeffafb205a "><code>4eaacf0</code></a>
bump docker to ghcr v2.4.3 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1587 ">#1587</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/42e3a017b9617c5bbc5f1c692cdbc2cd041bd97a "><code>42e3a01</code></a>
🌱 Bump the github-actions group with 3 updates (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1585 ">#1585</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/88c07acb7bc818897f9ea58eba9d81c53b322f15 "><code>88c07ac</code></a>
🌱 Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.6.0 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1579 ">#1579</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/6c690f2f38ab31402da4e3f8d698c15405764128 "><code>6c690f2</code></a>
Bump github.com/ossf/scorecard/v5 from v5.2.1 to v5.3.0 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1586 ">#1586</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/92083b52695004080225eb9301fde390183707cd "><code>92083b5</code></a>
📖 Fix recommended command to test the image in development (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1583 ">#1583</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/7975ea6064717f16f09a57ad5f8e24017ad4dbd9 "><code>7975ea6</code></a>
🌱 Bump the docker-images group across 1 directory with 2
updates (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/0d1a74394f208e63c946c1b5377d3ad15f0265bf "><code>0d1a743</code></a>
🌱 Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1575 ">#1575</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/46e6e0c0ac415287a696b2be6d98071134fd27a7 "><code>46e6e0c</code></a>
🌱 Bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1580 ">#1580</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/c3f13501596645d3bd6fee6b843bd36b66df4f5d "><code>c3f1350</code></a>
🌱 Improve printing options (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1584 ">#1584</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/43e475b79a8bd5217334edc08879005b2229d79a "><code>43e475b</code></a>
🌱 Bump golang.org/x/net from 0.42.0 to 0.44.0 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1578 ">#1578</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ossf/scorecard-action/compare/05b42c624433fc40578a4040d5cf5e36ddca8cde...4eaacf0543bb3f2c246792bd56e8cdeffafb205a ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-06 10:47:25 +01:00
612c7e06e7
build(deps): bump gradle/actions from 4.4.4 to 5.0.0 ( #4605 )
...
Bumps [gradle/actions](https://github.com/gradle/actions ) from 4.4.4 to
5.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/actions/releases ">gradle/actions's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<h3>Breaking Changes</h3>
<ul>
<li>Upgrade to node 24 by <a
href="https://github.com/amyu "><code>@amyu</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/721 ">gradle/actions#721</a></li>
</ul>
<p>Make sure your runner is updated to this version or newer to use this
release. v2.327.1 <a
href="https://github.com/actions/runner/releases/tag/v2.327.1 ">Release
Notes</a></p>
<h3>Dependency upgrades</h3>
<ul>
<li>Bump the github-actions group across 1 directory with 2 updates by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/748 ">gradle/actions#748</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gradle/actions/compare/v4...v5.0.0 ">https://github.com/gradle/actions/compare/v4...v5.0.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/actions/commit/4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 "><code>4d9f0ba</code></a>
Bump the github-actions group across 1 directory with 2 updates (<a
href="https://redirect.github.com/gradle/actions/issues/748 ">#748</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/4b530e369bfef1ac8fc2160ec97b9fda1ccd9901 "><code>4b530e3</code></a>
Bump the github-actions group across 1 directory with 2 updates</li>
<li><a
href="https://github.com/gradle/actions/commit/e60655a8a03bf3b9a7ff400dc5ef49bed725bec8 "><code>e60655a</code></a>
Upgrade to node 24 (<a
href="https://redirect.github.com/gradle/actions/issues/721 ">#721</a>)</li>
<li>See full diff in <a
href="https://github.com/gradle/actions/compare/748248ddd2a24f49513d8f472f81c3a07d4d50e1...4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-06 10:47:14 +01:00
Ludy and GitHub
655471ef29
fix(ci): 🛡️ mitigate CVE-2025-8869 by enforcing wheels-only pip installs and upgrading pinned dependencies ( #4598 )
...
# Description of Changes
This PR mitigates **CVE-2025-8869** (GHSA-4xh5-x5gv-qwph), a
high-severity vulnerability in `pip` ≤ 25.2 that allows arbitrary file
overwrite via unsafe tar extraction in sdist fallback handling.
**What was changed:**
- Added environment variables to all GitHub Actions (`pre_commit.yml`,
`sync_files.yml`) to **enforce binary-only installs**:
- `PIP_ONLY_BINARY=":all:"`
- `PIP_DISABLE_PIP_VERSION_CHECK="1"`
- Updated multiple `.github/scripts/*.txt` requirements to use Python
3.12 as the generation base.
- Upgraded pinned dependencies to latest secure versions:
- `filelock 3.19.1`, `identify 2.6.15`, `platformdirs 4.4.0`, `pyyaml
6.0.3`, `behave 1.3.3`, `pypdf 6.1.1`, `reportlab 4.4.4`, `requests
2.32.5`
- Adjusted file path formatting (`\` → `/`) for consistent
cross-platform compatibility.
**Why the change was made:**
To prevent exploitation of the tar extraction vulnerability in
vulnerable pip versions when installing from source distributions during
CI runs.
---
## Checklist
### General
- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md )
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md )
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md )
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings
### Documentation
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/ )
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags )
(for new translation tags only)
### UI Changes (if applicable)
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)
### Testing (if applicable)
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing )
for more details.
2025-10-04 12:50:37 +01:00
Anthony Stirling and GitHub
a15b0e33d5
test ( #4559 )
2025-10-01 00:03:26 +01:00
f337c8485e
build(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 ( #4547 )
...
Bumps
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer )
from 3.9.2 to 3.10.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign-installer/releases ">sigstore/cosign-installer's
releases</a>.</em></p>
<blockquote>
<h2>v3.10.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump default Cosign to v2.6.0 in <a
href="https://redirect.github.com/sigstore/cosign-installer/pull/200 ">sigstore/cosign-installer#200</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/cosign-installer/compare/v3.9.2...v3.10.0 ">https://github.com/sigstore/cosign-installer/compare/v3.9.2...v3.10.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/cosign-installer/commit/d7543c93d881b35a8faa02e8e3605f69b7a1ce62 "><code>d7543c9</code></a>
Bump default Cosign to v2.6.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/200 ">#200</a>)</li>
<li><a
href="https://github.com/sigstore/cosign-installer/commit/920f20f8c1514a0b54f0557e19ff74bfeb5f413d "><code>920f20f</code></a>
Bump actions/setup-go from 5.5.0 to 6.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/199 ">#199</a>)</li>
<li><a
href="https://github.com/sigstore/cosign-installer/commit/bb9dfc10d272e67bed086b504aaf14f8fe455b05 "><code>bb9dfc1</code></a>
Bump actions/github-script from 7.0.1 to 8.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/198 ">#198</a>)</li>
<li><a
href="https://github.com/sigstore/cosign-installer/commit/074636bf86584fb361059563d092a9cfb6560f80 "><code>074636b</code></a>
Bump actions/checkout from 4.2.2 to 5.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/197 ">#197</a>)</li>
<li>See full diff in <a
href="https://github.com/sigstore/cosign-installer/compare/d58896d6a1865668819e1d91763c7751a165e159...d7543c93d881b35a8faa02e8e3605f69b7a1ce62 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-30 11:50:09 +01:00
bdb721a482
build(deps): bump gradle/actions from 4.4.2 to 4.4.4 ( #4548 )
...
Bumps [gradle/actions](https://github.com/gradle/actions ) from 4.4.2 to
4.4.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/actions/releases ">gradle/actions's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump the github-actions group across 2 directories with 3 updates by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/726 ">gradle/actions#726</a></li>
<li>Regenerating package lock by <a
href="https://github.com/cdsap "><code>@cdsap</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/729 ">gradle/actions#729</a></li>
<li>Update known wrapper checksums by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/730 ">gradle/actions#730</a></li>
<li>Bump the github-actions group across 1 directory with 3 updates by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/735 ">gradle/actions#735</a></li>
<li>Bump the gradle group across 3 directories with 1 update by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/734 ">gradle/actions#734</a></li>
<li>Bump the npm-dependencies group in /sources with 4 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/733 ">gradle/actions#733</a></li>
<li>Bump references to Develocity Gradle plugin from 4.1.1 to 4.2 by <a
href="https://github.com/bot-githubaction "><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/736 ">gradle/actions#736</a></li>
<li>Handle gracefully parse errors in checksum file by <a
href="https://github.com/jprinet "><code>@jprinet</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/737 ">gradle/actions#737</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/kotlin-dsl by <a
href="https://github.com/bot-githubaction "><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/742 ">gradle/actions#742</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/java-toolchain by <a
href="https://github.com/bot-githubaction "><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/741 ">gradle/actions#741</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/groovy-dsl by <a
href="https://github.com/bot-githubaction "><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/740 ">gradle/actions#740</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/gradle-plugin by <a
href="https://github.com/bot-githubaction "><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/739 ">gradle/actions#739</a></li>
<li>Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/sources/test/init-scripts by <a
href="https://github.com/bot-githubaction "><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/738 ">gradle/actions#738</a></li>
<li>Update known wrapper checksums by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/743 ">gradle/actions#743</a></li>
<li>Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre in
/.github/workflow-samples/kotlin-dsl in the gradle group across 1
directory by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/746 ">gradle/actions#746</a></li>
<li>Bump the npm-dependencies group in /sources with 5 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/745 ">gradle/actions#745</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gradle/actions/compare/v4...v4.4.4 ">https://github.com/gradle/actions/compare/v4...v4.4.4 </a></p>
<h2>v4.4.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Adapt tests to future new Build Scan publication message by <a
href="https://github.com/alextu "><code>@alextu</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/708 ">gradle/actions#708</a></li>
<li>Add missing Gradle version input to setup-gradle by <a
href="https://github.com/jprinet "><code>@jprinet</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/713 ">gradle/actions#713</a></li>
<li>Bump the github-actions group across 2 directories with 4 updates by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/710 ">gradle/actions#710</a></li>
<li>Bump references to Develocity Gradle plugin from 4.1 to 4.1.1 by <a
href="https://github.com/bot-githubaction "><code>@bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/712 ">gradle/actions#712</a></li>
<li>Update known wrapper checksums by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/709 ">gradle/actions#709</a></li>
<li>Bump the npm-dependencies group across 1 directory with 4 updates by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/711 ">gradle/actions#711</a></li>
<li>Do not run setup-gradle post action if workflow is cancelled by <a
href="https://github.com/jprinet "><code>@jprinet</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/716 ">gradle/actions#716</a></li>
<li>Bump the github-actions group across 2 directories with 2 updates by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/715 ">gradle/actions#715</a></li>
<li>Bump the npm-dependencies group across 1 directory with 3 updates by
<a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/720 ">gradle/actions#720</a></li>
<li>Bump github/codeql-action from 3.29.11 to 3.30.0 in the
github-actions group across 1 directory by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/719 ">gradle/actions#719</a></li>
<li>Bump com.fasterxml.jackson.dataformat:jackson-dataformat-smile from
2.19.2 to 2.20.0 in /sources/test/init-scripts in the gradle group
across 1 directory by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/718 ">gradle/actions#718</a></li>
<li>Update known wrapper checksums by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/723 ">gradle/actions#723</a></li>
<li>Bump the npm-dependencies group in /sources with 5 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/gradle/actions/pull/725 ">gradle/actions#725</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gradle/actions/compare/v4.4.2...v4.4.3 ">https://github.com/gradle/actions/compare/v4.4.2...v4.4.3 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/actions/commit/748248ddd2a24f49513d8f472f81c3a07d4d50e1 "><code>748248d</code></a>
Bump the npm-dependencies group in /sources with 5 updates (<a
href="https://redirect.github.com/gradle/actions/issues/745 ">#745</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/81b68c9429570ef0a0bbd7f1898f1ddb06002c33 "><code>81b68c9</code></a>
Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre in
/.github/workflo...</li>
<li><a
href="https://github.com/gradle/actions/commit/13617309e3fe4d0361ccb3c9528a8d0d57ea2b2b "><code>1361730</code></a>
Bump com.google.guava:guava</li>
<li><a
href="https://github.com/gradle/actions/commit/a86ac1167d7d23eea103a711871cddc6a0d88e70 "><code>a86ac11</code></a>
Bump the npm-dependencies group in /sources with 5 updates</li>
<li><a
href="https://github.com/gradle/actions/commit/182e4d39a69c621df8047e4504c7be47bacfd8d6 "><code>182e4d3</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/a48a0fa47fcef8e9b77628e176ac1e207c2e07c5 "><code>a48a0fa</code></a>
Update known wrapper checksums (<a
href="https://redirect.github.com/gradle/actions/issues/743 ">#743</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/6d7d019840e00d27b4af224d3e11fff785a4cbe1 "><code>6d7d019</code></a>
Update known wrapper checksums</li>
<li><a
href="https://github.com/gradle/actions/commit/0e052761e2b444a9db1681a00dc8730b80af3fc0 "><code>0e05276</code></a>
Bump Gradle Wrapper from 9.0.0 to 9.1.0 in /sources/test/init-scripts
(<a
href="https://redirect.github.com/gradle/actions/issues/738 ">#738</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/2e40f51ba36cdf7e19f8744141b58b714cfb10ad "><code>2e40f51</code></a>
Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/gradle-p...</li>
<li><a
href="https://github.com/gradle/actions/commit/ed3ef92603f04047856e47e53ebf0001f7bcbd80 "><code>ed3ef92</code></a>
Bump Gradle Wrapper from 9.0.0 to 9.1.0 in
/.github/workflow-samples/groovy-d...</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/actions/compare/017a9effdb900e5b5b2fddfb590a105619dca3c3...748248ddd2a24f49513d8f472f81c3a07d4d50e1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-30 11:42:09 +01:00
2198ad840c
build(deps): bump docker/login-action from 3.5.0 to 3.6.0 ( #4552 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from
3.5.0 to 3.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases ">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v3.6.0</h2>
<ul>
<li>Add <code>registry-auth</code> input for raw authentication to
registries by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/887 ">docker/login-action#887</a></li>
<li>Bump <code>@aws-sdk/client-ecr</code> to 3.890.0 in <a
href="https://redirect.github.com/docker/login-action/pull/882 ">docker/login-action#882</a>
<a
href="https://redirect.github.com/docker/login-action/pull/890 ">docker/login-action#890</a></li>
<li>Bump <code>@aws-sdk/client-ecr-public</code> to 3.890.0 in <a
href="https://redirect.github.com/docker/login-action/pull/882 ">docker/login-action#882</a>
<a
href="https://redirect.github.com/docker/login-action/pull/890 ">docker/login-action#890</a></li>
<li>Bump <code>@docker/actions-toolkit</code> from 0.62.1 to 0.63.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/883 ">docker/login-action#883</a></li>
<li>Bump brace-expansion from 1.1.11 to 1.1.12 in <a
href="https://redirect.github.com/docker/login-action/pull/880 ">docker/login-action#880</a></li>
<li>Bump undici from 5.28.4 to 5.29.0 in <a
href="https://redirect.github.com/docker/login-action/pull/879 ">docker/login-action#879</a></li>
<li>Bump tmp from 0.2.3 to 0.2.4 in <a
href="https://redirect.github.com/docker/login-action/pull/881 ">docker/login-action#881</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v3.5.0...v3.6.0 ">https://github.com/docker/login-action/compare/v3.5.0...v3.6.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/5e57cd118135c172c3672efd75eb46360885c0ef "><code>5e57cd1</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/890 ">#890</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li>
<li><a
href="https://github.com/docker/login-action/commit/97e31439e8b415da4e1322633630e1563c42c0f2 "><code>97e3143</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/3a0796b57f440ff1af59165907392527fa832e0c "><code>3a0796b</code></a>
build(deps): bump the aws-sdk-dependencies group with 2 updates</li>
<li><a
href="https://github.com/docker/login-action/commit/5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2 "><code>5b7b28b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/882 ">#882</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li>
<li><a
href="https://github.com/docker/login-action/commit/abc9fb3154ad354cf35d6c78a862bee018dd4cb8 "><code>abc9fb3</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/d46868881477a1d16bdcc80a5b2c05208b1befe4 "><code>d468688</code></a>
build(deps): bump the aws-sdk-dependencies group with 2 updates</li>
<li><a
href="https://github.com/docker/login-action/commit/a99b2f88fc4efabea32b8ba09581cf535c1577e9 "><code>a99b2f8</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/883 ">#883</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="https://github.com/docker/login-action/commit/0d7fae8057d840a981e4132ce97862f6c8f48b42 "><code>0d7fae8</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/9832253cb7b14f93bd4134396bd26e855e8e4bd2 "><code>9832253</code></a>
build(deps): bump <code>@docker/actions-toolkit</code> from 0.62.1 to
0.63.0</li>
<li><a
href="https://github.com/docker/login-action/commit/09e05bbdf68bd9ce9eedefa6d2ebe03008c32b08 "><code>09e05bb</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/881 ">#881</a>
from docker/dependabot/npm_and_yarn/tmp-0.2.4</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/184bdaa0721073962dff0199f1fb9940f07167d1...5e57cd118135c172c3672efd75eb46360885c0ef ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-30 11:38:24 +01:00
Ludy and GitHub
2228ae7197
ci(frontend): update licenses workflow dependencies and Node.js version ( #4520 )
...
# Description of Changes
- Added the workflow file itself
(`.github/workflows/frontend-licenses-update.yml`) to the trigger paths.
- Updated `step-security/harden-runner` from **v2.12.2** → **v2.13.1**.
- Bumped `actions/checkout` from **v4.2.2** → **v5.0.0**.
- Upgraded `actions/setup-node` from **v4.1.0** (Node.js 18) →
**v5.0.0** (Node.js 22).
- Updated `actions/github-script` from **v7.0.1** → **v8.0.0**.
These changes modernize the workflow, ensure compatibility with newer
Node.js versions, and keep GitHub Actions up to date.
---
## Checklist
### General
- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md )
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md )
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md )
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings
### Documentation
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/ )
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags )
(for new translation tags only)
### UI Changes (if applicable)
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)
### Testing (if applicable)
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing )
for more details.
2025-09-29 12:21:48 +01:00
37877582e7
build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 ( #4538 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-28 21:22:40 +01:00
9c098103a1
build(deps): bump actions/github-script from 7.0.1 to 8.0.0 ( #4378 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-28 21:22:29 +01:00
d5a3f768bc
build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 ( #4539 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-28 20:55:01 +01:00
cb583fb42f
build(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 ( #4540 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-28 20:54:51 +01:00
edb555f517
build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 ( #4541 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-28 20:54:42 +01:00
8afa0c9b23
build(deps): bump actions/setup-python from 5.6.0 to 6.0.0 ( #4379 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-28 16:29:22 +01:00
37b581e0dd
build(deps): bump actions/stale from 9.1.0 to 10.0.0 ( #4380 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-28 16:28:50 +01:00
5b3b7575c2
build(deps): bump actions/checkout from 4.2.2 to 5.0.0 ( #4382 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-28 16:28:41 +01:00
Ludy87