[dependabot]

Bumps the github-actions group with 3 updates in the / directory: github/codeql-action/upload-sarif, securego/gosec and zizmorcore/zizmor-action.

Updates github/codeql-action/upload-sarif from 4.39.0 to 4.39.1

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates securego/gosec from 2.29.0 to 2.30.0

Release notes

Sourced from securego/gosec's releases.

v2.30.0

Changelog

• 5eb1d104ef85ff2c905c877eb600e8c1dee33a22 fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
• cc750ddcf0d2219e121034f86db3c6c2f3c76d50 fix(G112): honor read timeouts assigned through a struct field (#1798)
• 1cbfd7e6488c2464f18603623354de1be9565b39 fix(G112): report read timeouts explicitly set to zero (#1797)
• 05b9c4c0a7f49e421d7a459922a11bc0c0dd7197 feat(G706): extend log/slog method coverage (#1795)
• 17ad2dd7533fd4c773d916e2bc81446917d593b5 fix(autofix): read the first text block of a Claude response (#1794)
• b23171c64c662de0bc757c17feced6f4c10a877e fix(autofix): give every AI request its own timeout (#1793)
• 20b9e5b1bcc56518b240bf1afc333d6589163cae fix(resolve): treat constants from other packages as resolved (#1792)
• 86d3c26c060940ea7b6832c3b0d41e8ebf07a146 fix(autofix): return an error when a Gemini candidate has no content (#1791)
• 14ef84f6feccf40be7f5092fd2db119bf3f5f836 Update to go version 1.27.3 and 1.26.10 (#1790)
• 7cbd7a927365c48badf18bfb118e5503d606351f fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
• 1e26bcef55d71e330db7ca5e494be6165ffbc35f fix(G102): resolve concatenated and constant listen addresses (#1787)
• 836dbdb55d40238f021780afc91c237898db85e3 fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786)
• bbd69e23f657862f7e6d615dd8ba077663d593a3 fix(g602): track statically known lengths for append results in slice bounds check (#1773)
• 30e2d38421dc927e1f4f7148dcb822c1308cf4cc feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777)
• 57c45b800aa0cbd12994ea142537673fd15d54b8 fix: load absolute file paths so nested modules are analysed from the parent directory (#1779)
• 77fa84e3a47a5532d6893467f3df13d2af907541 fix(G118): treat a cancel sent on a channel as handed off (#1782)
• ca547ab2f2c6c7c378bbb91e76e5b97321b55934 fix(G112): honor read timeouts assigned after the http.Server literal (#1781)
• 024084bafcb4182ad1c0af86134aa71a819d6f52 fix(G303): resolve constant temp file paths (#1784)
• 782eeb188eebedaf2335f3adac7052d106670324 fix(deps): update all dependencies (#1783)
• 707f2271f66579a18e1da25794b1e8012247274b fix(G203): treat constant template arguments as safe (#1770)
• 8c5daa67d0e2bec9069da20146b0e928fb9fa53b fix(G402): check TLS settings assigned through a *tls.Config (#1769)
• 71577268350e1e0f2f1491de1ef53f1227b43c1f fix(deps): update all dependencies (#1775)
• 7b1b5cebe007d62fb58eacb90fc571112939ec30 Update to go version 1.27.2 and 1.26.9 (#1772)
• d2b649ec01825c20bd101ec584e559adb287e578 Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767)
• 1f52e64f6dfe434ae4261574baa9495c2532a6de fix(G602): track append() results for slice bounds checking (#1754)
• ea75d9ff49b6bbea15f0eb5e0483408a553019a6 fix(deps): update all dependencies (#1768)
• 65c2c082857febe898116edeb1fcddea0193634a fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752)
• 6ff893e9ef3f172b24f235acba2a31dab66fa379 fix(G407): treat an array IV/nonce as a zeroed buffer (#1763)
• aaca8946492fb2a6ff3598c185ff97776e12ea6f fix(fileperms): resolve constant file and directory permissions (#1766)
• 826f6f4fd18b7b0cf0a76b2df1994b3eb90da8f3 fix(G102): detect binding to the IPv6 unspecified address (#1760)
• 021cc2eae58ed8ea0160ca8beab93648daefc0e7 fix(G407): stop the nonce source walk on cycles (#1761)
• ccb369da13791bade6e735e70e833d0d095b7db0 fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762)
• 9b318063d35cfc5cdf2456de3b92830270e80326 fix(deps): update all dependencies (#1764)
• 8c77519419e934a3e158dbf1a3fbbc0871b8c691 fix(G602): validate inequality len guards (#1757)
• 027baa29ac97f58e9200d664d4ba63c9ea47a5ae fix(G121): track request captured by closures (#1759)
• 9ede89eea46b783aa0a1d28804b817c6d57ff36d fix(deps): update all dependencies (#1756)
• 29a042eca11db9ff0b3985146c5dd3ac46bbd24e fix: make nosec suppression independent of comment order (#1741)
• 681347199262bc33b9b5119ae2b448dec5718240 fix(G403): resolve constant RSA key sizes (#1751)
• 201d4136b42ab474d230d73ada12f7f98e57d8b0 fix(G602): validate subslice bounds under equality guards (#1749)
• accb42475d41cfbf54df86bdf7e3e97b9f9bfbe5 fix(G124): resolve negated constant cookie flags (#1748)
• 61fa1dafbaa3e41a5cb42a02eba204af91f60a41 fix(G602): report constant index equal to the length asserted by an equality guard (#1746)
• 78fbcc7b89a935cdf88bb6a4ecd2a73d1c2e26c5 Skip taint call graphs when no sinks match (#1745)
• 79b4fcd5e4aeed2f53ce93c499b63e4cb51e516e Fix brittle test for html writer (#1744)
• d70cac375c74052389aed6f2209fd2fd942dc6ab fix(G404): ignore non-cryptographic Shuffle calls (#1742)
• 9e8e5d91f2f39f90a574a18f55351b4a4832dacb fix(deps): update all dependencies (#1743)
• 8075fd2e520d33330afe168f26fc7a91f57f2cbc fix(taint): remove Result.Source field that is never populated (#1739)
• 58362d8a331e123b887741c27056f459c8b0660f Update all dependencies (#1737)
• d98945a5b2856e4586445089f564085c3b453e8f Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738)

... (truncated)

Commits

• 5eb1d10 fix(g602): recognize equality comparison in minimumLenForBranch (#1796)
• cc750dd fix(G112): honor read timeouts assigned through a struct field (#1798)
• 1cbfd7e fix(G112): report read timeouts explicitly set to zero (#1797)
• 05b9c4c feat(G706): extend log/slog method coverage (#1795)
• 17ad2dd fix(autofix): read the first text block of a Claude response (#1794)
• b23171c fix(autofix): give every AI request its own timeout (#1793)
• 20b9e5b fix(resolve): treat constants from other packages as resolved (#1792)
• 86d3c26 fix(autofix): return an error when a Gemini candidate has no content (#1791)
• 14ef84f Update to go version 1.27.3 and 1.26.10 (#1790)
• 7cbd7a9 fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788)
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.7.1 to 0.8.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.8.1

Sponsorship is appreciated!

zizmor 1.32 is now the default version used by this action.

Full release notes: zizmorcore/zizmor-action#1320

Full Changelog: zizmorcore/zizmor-action@v0.8.0...v0.8.1

v0.8.0

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version of zizmor or version: prerelease to get whatever latest prerelease the action knows about.

What's Changed

• Support prereleases by @​woodruffw in zizmorcore/zizmor-action#182
• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#184

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

Commits

• 45d7276 Sync zizmor versions (#191)
• ff38741 chore(deps): bump the github-actions group across 1 directory with 2 updates ...
• 4a9eca4 README: another troubleshooting section (#186)
• 83a0416 Bump pins (#185)
• 53290ba Sync zizmor versions (#184)
• 76da2ee Support prereleases (#182)
• fb1d87b chore(deps): bump the github-actions group with 2 updates (#180)
• be36601 README: bump pins (#179)
• See full diff in compare view

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/scorecard.yml
• .github/workflows/security.yml
• .github/workflows/test.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

🟢 Approved

No active review issues are reported for the CI security action updates.

No open issues 🎉

What changed in this PR

Updates three SHA-pinned GitHub Actions used by the Fizzy CLI’s CI security checks. Workflow settings and application code remain unchanged.

Changes:

• Updates CodeQL’s SARIF upload action from v4.39.0 to v4.39.1.
• Updates gosec from v2.29.0 to v2.30.0.
• Updates zizmor-action from v0.7.1 to v0.8.0.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
.github/​workflows/​test.yml	Updates zizmor-action for workflow security checks.
.github/​workflows/​security.yml	Updates gosec and both SARIF upload action references.
.github/​workflows/​scorecard.yml	Updates the Scorecard SARIF upload action.

_{Review effort: Balanced}