[dependabot]

Bumps the github-actions group with 3 updates: jdx/jactionlint, ruby/setup-ruby and sbt/setup-sbt.

Updates jdx/jactionlint from 2.3.0 to 2.4.0

Release notes

Sourced from jdx/jactionlint's releases.

v2.4.0: Private Use Area detection and fixes for artipacked, Dependabot groups and SARIF uploads

jactionlint 2.4.0 extends invisible-characters to report Private Use Area characters. It also fixes false positives in artipacked and dependabot-syntax, and stops the "inconsistent fingerprint" warnings when you upload SARIF to code scanning.

Added

• invisible-characters reports Private Use Area characters (U+E000–U+F8FF and the two supplementary private-use planes). Most fonts have no glyph for these characters, so they can hide a payload that a script decodes at run time, the same way variation selectors can. The message calls them PRIVATE USE CHARACTER. The rule ID, profile, level and the fix that removes the character have not changed. If you use Nerd Font or Powerline icons on purpose, write them as escape sequences before you apply the fix. Otherwise the fix removes them. (#311, @​jdx)

Fixed

• artipacked no longer reports actions/checkout v6 and later. Starting with v6, checkout stores the credential in a file under $RUNNER_TEMP instead of the workspace, so uploading the workspace doesn't publish it. The rule skips v6+ tag refs, and also commit pins whose version comment says v6 or later. v5 and earlier are still reported. (#308, @​jdx)
• dependabot-syntax no longer reports an update with multi-ecosystem-group as a duplicate of the regular update for the same ecosystem and directory. Two updates are now duplicates only when they match on ecosystem, directory, target branch and group. Two ungrouped updates, or two updates in the same group, are still reported. (#314, @​jdx)
• SARIF output no longer writes primaryLocationLineHash. github/codeql-action/upload-sarif computes this value itself and logs an "inconsistent fingerprint" warning when a file supplies a different one. The fingerprint value is unchanged and is now stored under jactionlint/contextHash/v1 in partialFingerprints. If your tools read jactionlint's fingerprint from primaryLocationLineHash, switch them to the new key. (#307, @​jdx)

Full Changelog: jdx/jactionlint@v2.3.0...v2.4.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.

Changelog

Sourced from jdx/jactionlint's changelog.

Changelog

2.4.0 (2026-10-28)

Features

• invisible-characters: report Private Use Area characters (#311) (b4a8d08)

Bug Fixes

• artipacked: skip actions/checkout v6 and later (#308) (7a5eb59)
• dependabot-syntax: don't report a multi-ecosystem group update as a duplicate (#314) (1950126)
• sarif: stop writing primaryLocationLineHash (#307) (beecbca)

2.3.0 (2026-10-21)

Features

• config: add allow-unused to durable ignores (#297) (69311d3)
• upstream: catch workflow analyzer gaps earlier (#288) (439e97d)

Bug Fixes

• build with Go 1.27.3 to reject compromised eMudhra certificates (#301) (cca9bb8)
• workflow-call-permissions: grant id-token to a silent caller under the permissive default (#299) (493a916)

2.2.0 (2026-10-14)

Features

• action-input-dependencies: report inputs of well-known actions that need each other (#207) (ef17270)
• action-release-cooldown: report an action at a version younger than N days (online, opt-in) (#235) (7dbd838)
• action: check the inputs of any remote action against its action.yml with --online (#231) (ac30cbe)
• actions-lock: lint GitHub's Actions lock file against the workflows (#237) (c9d8944)
• argument-injection: report free text in the program or the options of sed, awk, find and tar (#221) (ecf46dc)
• aube: understand aube in the rules that know npm, pnpm, yarn and bun (#254) (f6d9319)
• cache-poisoning: add pnpm/setup, graalvm and composer, and report caches of credential files (#216) (e3c29f0)
• cache-poisoning: report more zizmor findings and add a pedantic tier (#160) (c725459)
• cli: add --ruff, --show-doc-urls, --finding-context, platform forgejo and jujutsu roots (#215) (8e31c5c)
• cli: add shell completions and --explain RULE (#204) (b3b09d3)
• cli: add the options select, no-ignores and list-rules (#200) (dca5092)
• cli: show only the findings on what changed since a revision (--changed-since) (#274) (ea0ac90)
• command-injection: report input that a script runs as code after it moved to env (#202) (ebeeb6f)
• comment-trigger-authorization: report comment-triggered jobs that do not check who commented (pedantic) (#217) (60fa75e)
• concurrency-deadlock: report a group that a workflow shares with the workflow it calls (#210) (c41e2ad)

... (truncated)

Commits

• baa8d68 chore(main): release 2.4.0 (#309)
• 1950126 fix(dependabot-syntax): don't report a multi-ecosystem group update as a dupl...
• b4a8d08 feat(invisible-characters): report Private Use Area characters (#311)
• beecbca fix(sarif): stop writing primaryLocationLineHash (#307)
• 7a5eb59 fix(artipacked): skip actions/checkout v6 and later (#308)
• 09478a8 test(schema): pin the latest actions/runner schemas (#306)
• 556be51 update version to 2.3.0 in download-jactionlint.bash and the action examples
• 426f1a2 Brew cask update for jactionlint version v2.3.0
• See full diff in compare view

Updates ruby/setup-ruby from 1.334.0 to 1.335.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.335.0

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in ruby/setup-ruby#959

Full Changelog: ruby/setup-ruby@v1.334.0...v1.335.0

Commits

• 7f79781 Update CRuby releases on Windows
• See full diff in compare view

Updates sbt/setup-sbt from 1.5.12 to 1.5.13

Release notes

Sourced from sbt/setup-sbt's releases.

v1.5.13

updates

• Update sbt to 2.0.12 by @​scala-steward in sbt/setup-sbt#154
• Bump actions/setup-java from 6.0.1 to 6.1.0 by @​dependabot[bot] in sbt/setup-sbt#150
• Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 by @​dependabot[bot] in sbt/setup-sbt#152
• Bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @​dependabot[bot] in sbt/setup-sbt#151
• Bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 by @​dependabot[bot] in sbt/setup-sbt#153

Full Changelog: sbt/setup-sbt@v1.5.12...v1.5.13

Commits

• b113b96 Merge pull request #154 from scala-steward/update/sbt-2.0.12
• f23886a Regenerated action.yml
• 0a03ad0 Update sbt to 2.0.12
• 1644854 Merge pull request #153 from sbt/dependabot/github_actions/github/codeql-acti...
• 265a80f Bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1
• a656b34 Merge pull request #151 from sbt/dependabot/github_actions/ossf/scorecard-act...
• f319409 Merge pull request #152 from sbt/dependabot/github_actions/github/codeql-acti...
• 810af81 Merge pull request #150 from sbt/dependabot/github_actions/actions/setup-java...
• 20b11d1 Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0
• 05a485c Bump ossf/scorecard-action from 2.4.4 to 2.5.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 94bb4a96-7026-4a70-9dc2-b417deeb6ecd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn