From b974ef1a6cc88a98013bdcda54607d818f5413b6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:03:23 +0000 Subject: [PATCH 1/6] Bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/code-analysis.yml | 6 +++--- .github/workflows/test.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml index e8e567a4..fad103fd 100644 --- a/.github/workflows/code-analysis.yml +++ b/.github/workflows/code-analysis.yml @@ -23,7 +23,7 @@ jobs: format-and-analyze: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0 with: flutter-version: ${{ env.FLUTTER_VERSION }} @@ -64,7 +64,7 @@ jobs: permissions: checks: write # to publish the report steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: axel-op/dart-package-analyzer@7a6c3c66bce78d82b729a1ffef2d9458fde6c8d2 # v3 id: analysis # set an id for the current step with: @@ -85,7 +85,7 @@ jobs: permissions: checks: write # to publish the report steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Prefer running on Ubuntu over Dart Docker image - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index fa1fcc7b..e7567b02 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -31,7 +31,7 @@ jobs: generator-integ-tests: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Prefer running on Ubuntu over Dart Docker image - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: @@ -47,7 +47,7 @@ jobs: init-script: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0 with: flutter-version: ${{ env.FLUTTER_VERSION }} @@ -75,7 +75,7 @@ jobs: - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: ${{ matrix.sdk }} - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Generator Test working-directory: generator run: | @@ -109,7 +109,7 @@ jobs: - windows-2025 runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0 with: flutter-version: ${{ env.FLUTTER_VERSION }} From 3ed8b46cf1b6bfdf8954721491f8b5d4eea4215b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 12:03:22 +0000 Subject: [PATCH 2/6] Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.10 to 5.5.11 Bumps [danielpalme/ReportGenerator-GitHub-Action](https://github.com/danielpalme/reportgenerator-github-action) from 5.5.10 to 5.5.11. - [Release notes](https://github.com/danielpalme/reportgenerator-github-action/releases) - [Commits](https://github.com/danielpalme/reportgenerator-github-action/compare/049f7ec958c672fd31d5cc1cb01622dc8d2e23ab...d3ebf1f760f7d8ab92cc44d9bcfee7ad73722a31) --- updated-dependencies: - dependency-name: danielpalme/ReportGenerator-GitHub-Action dependency-version: 5.5.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/code-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml index fad103fd..294e9ef9 100644 --- a/.github/workflows/code-analysis.yml +++ b/.github/workflows/code-analysis.yml @@ -113,7 +113,7 @@ jobs: result_path: objectbox/coverage/lcov.info min_coverage: 90 token: ${{ github.token }} - - uses: danielpalme/ReportGenerator-GitHub-Action@049f7ec958c672fd31d5cc1cb01622dc8d2e23ab # v5.5.10 + - uses: danielpalme/ReportGenerator-GitHub-Action@d3ebf1f760f7d8ab92cc44d9bcfee7ad73722a31 # v5.5.11 with: reports: 'objectbox/coverage/lcov.info' targetdir: 'coveragereport' From e35065e0a5be25e0f657f0fbdc2813d26541be2e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 12:03:34 +0000 Subject: [PATCH 3/6] Bump actions/setup-java from 5.3.0 to 5.7.0 Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.3.0 to 5.7.0. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/ad2b38190b15e4d6bdf0c97fb4fca8412226d287...b6effb05e454b25005698d916606bdc6ffcbf961) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e7567b02..241ebc80 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -119,7 +119,7 @@ jobs: # highest supported JDK. # ubuntu-24.04 defaults to JDK 17. # https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md#java - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: distribution: 'temurin' java-version: 21 From bb62f4effbf7f6d8de473911669ec9891401229f Mon Sep 17 00:00:00 2001 From: Uwe Date: Tue, 11 Aug 2026 06:45:10 +0200 Subject: [PATCH 4/6] GitHub Actions: verify JDK signature This helps secure the supply chain a little more. --- .github/workflows/test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 241ebc80..211680a2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -123,6 +123,7 @@ jobs: with: distribution: 'temurin' java-version: 21 + verify-signature: true - if: ${{ startsWith(matrix.os, 'ubuntu') }} # Install Ubuntu packages required for Flutter build # https://docs.flutter.dev/platform-integration/linux/setup#set-up-tooling From a5cc9eda8bb17b5482d5692710327591bff2dec6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 12:03:42 +0000 Subject: [PATCH 5/6] Bump actions/stale from 10.3.0 to 11.0.0 Bumps [actions/stale](https://github.com/actions/stale) from 10.3.0 to 11.0.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...4391f3da665fdf50b6810c1a66712fb9ba21aa93) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/close-no-response.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/close-no-response.yml b/.github/workflows/close-no-response.yml index 8610232b..d2ea8f6f 100644 --- a/.github/workflows/close-no-response.yml +++ b/.github/workflows/close-no-response.yml @@ -17,7 +17,7 @@ jobs: pull-requests: write steps: # https://github.com/marketplace/actions/close-stale-issues - - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: days-before-stale: -1 # Add the stale label manually. days-before-close: 21 From ba24dc1c36bb64cc1ae17e8f158e1543406bab36 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 12:04:12 +0000 Subject: [PATCH 6/6] Bump dart-lang/setup-dart from 1.7.2 to 1.8.0 Bumps [dart-lang/setup-dart](https://github.com/dart-lang/setup-dart) from 1.7.2 to 1.8.0. - [Release notes](https://github.com/dart-lang/setup-dart/releases) - [Changelog](https://github.com/dart-lang/setup-dart/blob/main/CHANGELOG.md) - [Commits](https://github.com/dart-lang/setup-dart/compare/65eb853c7ba17dde3be364c3d2858773e7144260...7654d458321ee25acccccfdb86cd48bd95768ff1) --- updated-dependencies: - dependency-name: dart-lang/setup-dart dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/code-analysis.yml | 2 +- .github/workflows/test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml index 294e9ef9..a1a5b309 100644 --- a/.github/workflows/code-analysis.yml +++ b/.github/workflows/code-analysis.yml @@ -87,7 +87,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Prefer running on Ubuntu over Dart Docker image - - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 + - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1 # v1.8.0 with: sdk: ${{ env.DART_VERSION }} - name: Install coverage tools diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 211680a2..076ef20c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -33,7 +33,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Prefer running on Ubuntu over Dart Docker image - - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 + - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1 # v1.8.0 with: sdk: ${{ env.DART_VERSION }} - name: Install ObjectBox C library @@ -72,7 +72,7 @@ jobs: - 3.7.2 # Use latest bugfix release to get tooling fixes runs-on: ${{ matrix.os }} steps: - - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 + - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1 # v1.8.0 with: sdk: ${{ matrix.sdk }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1