Skip to content

chore(deps): bump the github-actions group across 1 directory with 2 updates - #440

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-7b43af0644
Jul 31, 2026
Merged

chore(deps): bump the github-actions group across 1 directory with 2 updates#440
github-actions[bot] merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-7b43af0644

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates in the / directory: anthropics/claude-code-action and oasdiff/oasdiff-action/breaking.

Updates anthropics/claude-code-action from 1.0.182 to 1.0.183

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.183

Full Changelog: anthropics/claude-code-action@v1...v1.0.183

Commits
  • be7b93b chore: bump Claude Code to 2.1.220 and Agent SDK to 0.3.220
  • See full diff in compare view

Updates oasdiff/oasdiff-action/breaking from 0.1.9 to 0.1.10

Release notes

Sourced from oasdiff/oasdiff-action/breaking's releases.

v0.1.10

Security release. Every action now runs on oasdiff v1.26.1.

Highlights

Security fix: git revision parsed as a git option (GHSA-m3wq-w7x2-4q6m)

All six actions (breaking, changelog, diff, pr-comment, validate, verify) move their base image from tufin/oasdiff:v1.26.0 to tufin/oasdiff:v1.26.1, which fixes an option-injection issue on the git-revision load path.

oasdiff passed git revisions to git as operands with no end-of-options separator, so a revision beginning with - was parsed by git as an option rather than a revision. git show --output=<path> writes git's output to a chosen path (an arbitrary file overwrite running as the invoking user), and git fetch --upload-pack=<program> makes git execute a program.

oasdiff v1.26.1 fixes this in two layers: every git invocation now passes --end-of-options, and a revision beginning with - is rejected before git is invoked.

Who should upgrade: anyone pinned to an exact action version. If you pin @v0, you already have this, since v0 now points at this release.

Workflow authors: if you interpolate untrusted input into the base: or revision: inputs, upgrade. Workflows that pass literal refs or file paths were not affected.

Full Changelog: oasdiff/oasdiff-action@v0.1.9...v0.1.10

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 28, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) July 28, 2026 08:54
@thomasluizon

Copy link
Copy Markdown
Owner

@dependabot rebase

…updates

Bumps the github-actions group with 2 updates in the / directory: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [oasdiff/oasdiff-action/breaking](https://github.com/oasdiff/oasdiff-action).


Updates `anthropics/claude-code-action` from 1.0.182 to 1.0.183
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@e0cf66d...be7b93b)

Updates `oasdiff/oasdiff-action/breaking` from 0.1.9 to 0.1.10
- [Release notes](https://github.com/oasdiff/oasdiff-action/releases)
- [Commits](oasdiff/oasdiff-action@45c956e...0ab8ad2)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.183
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: oasdiff/oasdiff-action/breaking
  dependency-version: 0.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the github-actions group with 2 updates chore(deps): bump the github-actions group across 1 directory with 2 updates Jul 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-7b43af0644 branch from fcb89cb to ae9d07f Compare July 31, 2026 00:42
@sonarqubecloud

Copy link
Copy Markdown

@github-actions
github-actions Bot merged commit 7eba2ff into main Jul 31, 2026
23 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-7b43af0644 branch July 31, 2026 00:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant