From 107e0927811a0a72b69b48bd649bfa488a8c60dc Mon Sep 17 00:00:00 2001 From: cjimti Date: Tue, 21 Jul 2026 20:23:52 -0700 Subject: [PATCH 1/2] chore(deps): roll up open Dependabot bumps Combines the two open Dependabot PRs into one change: the grouped GitHub Actions bumps (#34) and the Go module bump (#32). Actions: - step-security/harden-runner v2.19.4 -> v2.20.0 - github/codeql-action (init/autobuild/ analyze/upload-sarif) v4.36.2 -> v4.37.1 - goreleaser/goreleaser-action v7.2.2 -> v7.2.3 - securego/gosec v2.27.1 -> v2.28.0 Go: - golang.org/x/sync v0.21.0 -> v0.22.0 (go.sum regenerated with go mod tidy; matches Dependabot #32) Every action SHA was resolved against upstream and matches the commit its tag points at (codeql-action's annotated tag was dereferenced). Refs stay pinned to full 40-char SHAs. make verify checks pass (tidy-check, fmt-check, lint, test). Supersedes #32, #34. --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/dependency-review.yml | 2 +- .github/workflows/fuzz.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/security.yml | 16 ++++++++-------- go.mod | 2 +- go.sum | 4 ++-- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index eaa7579..0fa5af7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,7 +24,7 @@ jobs: outputs: has-source: ${{ steps.detect.outputs.has-source }} steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -51,7 +51,7 @@ jobs: needs: detect runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -106,7 +106,7 @@ jobs: matrix: os: [ubuntu-latest, macos-latest] steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -161,7 +161,7 @@ jobs: GOOS: ${{ matrix.goos }} GOARCH: ${{ matrix.goarch }} steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7a40909..d34662b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,7 +24,7 @@ jobs: security-events: write actions: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -47,17 +47,17 @@ jobs: - name: Initialize CodeQL if: steps.detect.outputs.has-source == 'true' - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: languages: go queries: security-extended,security-and-quality - name: Autobuild if: steps.detect.outputs.has-source == 'true' - uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 - name: Analyze if: steps.detect.outputs.has-source == 'true' - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: category: "/language:go" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index ba55720..4e43699 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -13,7 +13,7 @@ jobs: name: review runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 4b2fbee..e08aed4 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -21,7 +21,7 @@ jobs: targets: ${{ steps.targets.outputs.targets }} has-targets: ${{ steps.targets.outputs.has-targets }} steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -70,7 +70,7 @@ jobs: matrix: target: ${{ fromJson(needs.detect.outputs.targets) }} steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a66ee5a..18a0a44 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: # publishing to ghcr is deferred per spec ยง14.8; restore this scope # when that work lands. steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -48,7 +48,7 @@ jobs: uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 - name: GoReleaser - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: version: "~> v2" args: release --clean diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index dac69f4..eef61f1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: security-events: write id-token: write steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -47,7 +47,7 @@ jobs: retention-days: 5 - name: Upload to security tab - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: sarif_file: results.sarif category: scorecard diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index f211fc3..4e19646 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -26,7 +26,7 @@ jobs: outputs: has-source: ${{ steps.detect.outputs.has-source }} steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -50,17 +50,17 @@ jobs: contents: read security-events: write steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: securego/gosec@9e6a9843d7a4a6e3e9a8539b02612c8a4aa3f889 # v2.27.1 + - uses: securego/gosec@9e75c0576c9878035d4221392108d458abe10fc3 # v2.28.0 with: args: -fmt sarif -out gosec.sarif -no-fail ./... - - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: sarif_file: gosec.sarif category: gosec @@ -74,7 +74,7 @@ jobs: if: needs.detect.outputs.has-source == 'true' runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -113,7 +113,7 @@ jobs: --error \ . - - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 if: always() with: sarif_file: semgrep.sarif @@ -126,7 +126,7 @@ jobs: contents: read security-events: write steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -141,7 +141,7 @@ jobs: ignore-unfixed: true exit-code: "0" # report findings; do not fail the build directly. SARIF gates are visible via security tab. - - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 if: always() with: sarif_file: trivy.sarif diff --git a/go.mod b/go.mod index 0b6a395..bb07118 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ tool ( require ( github.com/modelcontextprotocol/go-sdk v1.6.1 - golang.org/x/sync v0.21.0 + golang.org/x/sync v0.22.0 ) require ( diff --git a/go.sum b/go.sum index da75b5c..bca3b9e 100644 --- a/go.sum +++ b/go.sum @@ -851,8 +851,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= From c7e3cd95fb045b50542d867c39a7bcc15b501ddc Mon Sep 17 00:00:00 2001 From: cjimti Date: Tue, 21 Jul 2026 21:03:43 -0700 Subject: [PATCH 2/2] chore(ci): add Dependabot cooldown to satisfy semgrep Adds a 7-day default cooldown to both the gomod and github-actions update ecosystems. Resolves the pre-existing dependabot-missing-cooldown semgrep finding that was failing the security workflow independently of the dependency bumps in this PR. --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8c95ae2..9c6748e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,8 @@ updates: time: "06:00" timezone: Etc/UTC open-pull-requests-limit: 10 + cooldown: + default-days: 7 commit-message: prefix: "chore(deps)" include: scope @@ -26,6 +28,8 @@ updates: time: "06:00" timezone: Etc/UTC open-pull-requests-limit: 10 + cooldown: + default-days: 7 commit-message: prefix: "chore(ci)" include: scope