From ad6a02b387abde56b7fbf74cae4b2a8dcaf4cd74 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 19 Jul 2026 07:12:34 +0000 Subject: [PATCH 1/9] chore: bump actions/download-artifact from 4 to 8 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 11162f1..759c8df 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,7 +56,7 @@ jobs: with: fetch-depth: 0 - name: Download coverage report - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: coverage-report - name: SonarCloud Scan From 67b9522e6caad562d16a15984e3efabee10c03f1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 19 Jul 2026 07:13:07 +0000 Subject: [PATCH 2/9] chore: bump aces-sdl from 0.20.0 to 0.23.1 Bumps [aces-sdl](https://github.com/Brad-Edwards/aptl) from 0.20.0 to 0.23.1. - [Release notes](https://github.com/Brad-Edwards/aptl/releases) - [Changelog](https://github.com/Brad-Edwards/aptl/blob/main/CHANGELOG.md) - [Commits](https://github.com/Brad-Edwards/aptl/commits) --- updated-dependencies: - dependency-name: aces-sdl dependency-version: 0.23.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 7f61473..fd335bb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -28,7 +28,7 @@ dependencies = [ "django-ratelimit>=4.1", "django-csp>=4.0", "PyYAML>=6", - "aces-sdl==0.20.0", + "aces-sdl==0.23.1", ] [project.urls] From 75f2d0437715fe7ffe032de08a38683bae846370 Mon Sep 17 00:00:00 2001 From: Brad Edwards Date: Sun, 19 Jul 2026 18:13:12 +0200 Subject: [PATCH 3/9] ci: handle Dependabot Sonar scans --- .github/workflows/ci.yml | 4 ++++ uv.lock | 8 ++++---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 11162f1..989b7ca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -60,6 +60,10 @@ jobs: with: name: coverage-report - name: SonarCloud Scan + if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]' uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + - name: Skip SonarCloud scan for Dependabot + if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' + run: echo "SonarCloud credentials are unavailable to Dependabot pull requests." diff --git a/uv.lock b/uv.lock index 47c41d2..a9159c8 100644 --- a/uv.lock +++ b/uv.lock @@ -10,7 +10,7 @@ resolution-markers = [ [[package]] name = "aces-sdl" -version = "0.20.0" +version = "0.23.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "asyncssh" }, @@ -28,9 +28,9 @@ dependencies = [ { name = "typer" }, { name = "uvicorn", extra = ["standard"] }, ] -sdist = { url = "https://files.pythonhosted.org/packages/aa/99/b7a686060d9e4b5d3df8592f1cd34c0f71aeb805685c69172ffc2d4dd0a1/aces_sdl-0.20.0.tar.gz", hash = "sha256:f816b824c76e6388b5a15971237b499bc8c04576ba62b10f7dfa597f8895dbcf", size = 1561396, upload-time = "2026-07-13T02:50:47.396Z" } +sdist = { url = "https://files.pythonhosted.org/packages/b3/71/c3923fc8713fbab0baf779c902ac82a6030793e98e1219eec0f35e0a321e/aces_sdl-0.23.1.tar.gz", hash = "sha256:0a53f680c5b2420554cc3f6053ba64d0f4ef919a73337ab060f5dc283295bc0d", size = 1674846, upload-time = "2026-07-17T04:06:34.594Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/f4/a5/d1f9bc0227648627b6f9b715dbbd0e9df08e9120ac05e41913adef13b8b3/aces_sdl-0.20.0-py3-none-any.whl", hash = "sha256:2fd9956166326910a3ad439073589fb68c59eb9465d77e06a6890482428e9426", size = 1359387, upload-time = "2026-07-13T02:50:45.393Z" }, + { url = "https://files.pythonhosted.org/packages/c2/b4/77b40bb8214385c243d187d04614175b0f1a162ec7183a5143c016c06be6/aces_sdl-0.23.1-py3-none-any.whl", hash = "sha256:86f5e99d2dff009fe7165bbe8853f6fdf5a41074e7813f2e38e092910c1147a1", size = 1466167, upload-time = "2026-07-17T04:06:32.749Z" }, ] [[package]] @@ -70,7 +70,7 @@ docs = [ [package.metadata] requires-dist = [ - { name = "aces-sdl", specifier = "==0.20.0" }, + { name = "aces-sdl", specifier = "==0.23.1" }, { name = "dj-database-url", specifier = ">=2.2" }, { name = "django", specifier = ">=5.1,<6" }, { name = "django-axes", specifier = ">=7.0" }, From 93b7133317ca6498812f11a5e18b6bfe7a4a0b4f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 19 Jul 2026 16:51:37 +0000 Subject: [PATCH 4/9] chore: bump SonarSource/sonarqube-scan-action from 8.2.0 to 8.2.1 Bumps [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) from 8.2.0 to 8.2.1. - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/713881670b6b3676cda39549040e2d88c70d582e...22918119ff8e1ca75a623e15c8296b6ea4fbe28f) --- updated-dependencies: - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.2.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 989b7ca..ebfc258 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,7 +61,7 @@ jobs: name: coverage-report - name: SonarCloud Scan if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]' - uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8 + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - name: Skip SonarCloud scan for Dependabot From 3a6eb96af029ccd67e0f12b334aed025b65d0430 Mon Sep 17 00:00:00 2001 From: Brad Edwards Date: Sun, 19 Jul 2026 18:54:18 +0200 Subject: [PATCH 5/9] ci: handle Dependabot Sonar scans --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 759c8df..6e11b13 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -60,6 +60,10 @@ jobs: with: name: coverage-report - name: SonarCloud Scan + if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]' uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + - name: Skip SonarCloud scan for Dependabot + if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' + run: echo "SonarCloud credentials are unavailable to Dependabot pull requests." From 084c24c0234495ba79e53b14f2de8416e15b0d09 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 02:03:55 +0000 Subject: [PATCH 6/9] chore: bump astral-sh/setup-uv from 8.3.2 to 9.0.0 Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/v8.3.2...v9.0.0) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 4 ++-- .github/workflows/docs.yml | 2 +- .github/workflows/release-please.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index acfc5ae..4e07e4e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: steps: - uses: actions/checkout@v7 - name: Install uv - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 - name: Export locked runtime dependencies run: uv export --frozen --no-dev --all-extras --no-emit-project --no-hashes --format requirements-txt -o audit-requirements.txt # The export is already a fully resolved tree, so --no-deps audits the pins @@ -34,7 +34,7 @@ jobs: with: fetch-depth: 0 - name: Install uv - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 - name: Lint run: uv run ruff check . - name: Format check diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9fdf4ed..3e3a6bb 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -22,7 +22,7 @@ jobs: steps: - uses: actions/checkout@v7 - name: Install uv - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 - name: Build the docs site run: uv run --group docs mkdocs build --strict - name: Upload the site artifact diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 6e05736..18d2f34 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -53,7 +53,7 @@ jobs: with: python-version: "3.12" - name: Install uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v8 - name: Build sdist + wheel run: uv build --out-dir dist - name: Publish to PyPI (OIDC trusted publishing) From 661958d6dee3f2d5ea57d8b99676ce1953a44f84 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 02:03:58 +0000 Subject: [PATCH 7/9] chore: bump actions/setup-python from 6.3.0 to 7.0.0 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/pr-title.yml | 2 +- .github/workflows/release-please.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 1d563f3..8ed126e 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -34,7 +34,7 @@ jobs: with: ref: ${{ github.event.pull_request.base.sha }} - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Validate PR title diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 6e05736..81fa8ee 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -49,7 +49,7 @@ jobs: id-token: write # OIDC trusted publishing to PyPI (no stored token) steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Install uv From 06770b6df4b0b380fe3ac7c113f8ba09eb0506b4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 02:04:04 +0000 Subject: [PATCH 8/9] chore: bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v7...v7.0.1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 6 +++--- .github/workflows/docs.yml | 2 +- .github/workflows/pr-title.yml | 2 +- .github/workflows/release-please.yml | 4 ++-- .github/workflows/sync-main-to-dev.yml | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index acfc5ae..495f066 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install uv uses: astral-sh/setup-uv@v8.3.2 - name: Export locked runtime dependencies @@ -30,7 +30,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Install uv @@ -52,7 +52,7 @@ jobs: needs: test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Download coverage report diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9fdf4ed..94c562c 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -20,7 +20,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install uv uses: astral-sh/setup-uv@v8.3.2 - name: Build the docs site diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 1d563f3..12ef1dc 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out base ref (trusted policy copy) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.base.sha }} - name: Set up Python diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 6e05736..e14faa2 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -48,7 +48,7 @@ jobs: contents: write # attach the built distributions to the GitHub Release id-token: write # OIDC trusted publishing to PyPI (no stored token) steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" @@ -74,7 +74,7 @@ jobs: contents: read packages: write # push the image to GHCR under this repository's owner steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Log in to GitHub Container Registry run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin - name: Build and push the container image diff --git a/.github/workflows/sync-main-to-dev.yml b/.github/workflows/sync-main-to-dev.yml index 673b39f..e0ce605 100644 --- a/.github/workflows/sync-main-to-dev.yml +++ b/.github/workflows/sync-main-to-dev.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Open or update the back-merge PR From 9cb629d47dcb1a488cf488e2c7d001d1f9491b61 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 02:04:07 +0000 Subject: [PATCH 9/9] chore: bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/cef221092ed1bacb1cc03d23a2d87d1d172e277b...ba38be9e461d3875417946c167d0b5f3d385a247) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/release-please.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 6e05736..47f12e1 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -57,7 +57,7 @@ jobs: - name: Build sdist + wheel run: uv build --out-dir dist - name: Publish to PyPI (OIDC trusted publishing) - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1 with: packages-dir: dist - name: Attach the distributions to the GitHub Release