dependabot: bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: OWASP/cve-lite-cli and github/codeql-action/upload-sarif.

Updates OWASP/cve-lite-cli from 1.28.0 to 1.29.0

Release notes

Sourced from OWASP/cve-lite-cli's releases.

v1.29.0 - Parent-dependency attribution fixes and multi-folder scan improvements

Added

• Honor --usage/--only-used in multi-folder scans - previously accepted (and exposed in the GitHub Action) but silently ignored outside single-folder mode; each subfolder now gets its own source-usage annotation and filtering, isolated from other subfolders
• Surface release-cooldown warnings in SARIF output, exposed as properties.cooldownWarning on the result, so they reach GitHub Code Scanning
• Include DM001 maintenance-risk findings (--check-maintenance) in SARIF output as a dedicated cve-lite-cli-maintenance extension component so GitHub Code Scanning surfaces them
• Expand DM001 maintenance risk (--check-maintenance): deprecated npm packages now surface as their own medium finding (not just an annotation on a drag finding), severity is graduated (constraint drag high, deprecation medium), and a Last release context line is shown for packages abandoned 2+ years - release age is context, never a severity signal on its own. Projects with deprecated direct dependencies will see new medium findings under --check-maintenance (opt-in, advisory)
• Render scan completeness in output: a partial-scan banner/status line in terminal (compact and verbose modes) and a completeness banner in the HTML report, surfacing packument-fetch failures and other scan gaps

Fixed

• Multi-folder --report now writes report.json alongside index.html (matching single-folder artifact shape) and renders override hygiene / maintenance risk panels per folder when --check-overrides/--check-maintenance are set
• Use a callable FetchLike type for injected fetch implementations so clean builds do not break on Node 24, where typeof fetch gains a static preconnect member
• Guard OSV-derived data handling against malformed advisory records so one bad advisory can no longer crash the whole scan
• Reject --fix combined with --sarif or --cdx - previously these silently applied fixes, exited 0, and wrote no output file
• Fix the scan-complete status line printing "vulnerabilitys" when the finding count is not 1
• npm parser: attribute transitive dependencies reached only through a workspace package's dependencies or through a peer dependency, so they no longer report "No parent identified" despite a real parent chain existing
• Update js-yaml to 3.15.1 to clear GHSA-5p4m-2wfm-xmqj
• Yarn parser: correct dev/prod classification for workspace and shared dependencies, fixing workspace-devDependency chains, root/workspace name collisions, and production dependencies also pulled in by a devDependency
• pnpm v9 parser: classify dev/prod by production reachability instead of an aggregated devDependency name set, fixing a monorepo package wrongly marked dev when it was a production dependency in another workspace
• Bun parser: classify dev/prod by production reachability rather than direct declaration only, fixing dev-only transitives leaking into production-scoped results
• Yarn parser: classify dev/prod by production reachability over the full dependency graph instead of the display-capped path list, fixing a production dependency being wrongly marked dev when its path was dropped by the display cap

Changed

• Multi-folder HTML report: replace the unicode chevron on folder sections with an inline SVG chevron that rotates on open, matching the single-folder report

Docs

• Pin actions/checkout to an immutable commit SHA in the README's GitHub Action workflow example
• Document the native GitHub Action inputs for override hygiene in the CI-integration section, with YAML examples and an input reference table
• Fix the mobile navbar drawer opening clipped to the navbar height on the website

Validation

• npm test
• npm run build

Contributors

Thank you to everyone who contributed to this release:

• @​Ayush7614
• @​luojiyin1987
• @​rksharma-owg
• @​RohithPariki
• @​felipeofdev-ai

Changelog

Sourced from OWASP/cve-lite-cli's changelog.

Changelog

All notable changes to CVE Lite CLI will be documented in this file.

[1.29.0] - 2026-08-11

Added

• Honor --usage/--only-used in multi-folder scans - previously accepted (and exposed in the GitHub Action) but silently ignored outside single-folder mode; each subfolder now gets its own source-usage annotation and filtering, isolated from other subfolders (#904)
• Surface release-cooldown warnings in SARIF output, exposed as properties.cooldownWarning on the result, so they reach GitHub Code Scanning (#913, #914)
• Include DM001 maintenance-risk findings (--check-maintenance) in SARIF output as a dedicated cve-lite-cli-maintenance extension component so GitHub Code Scanning surfaces them (#881, #888)
• Expand DM001 maintenance risk (--check-maintenance): deprecated npm packages now surface as their own medium finding (not just an annotation on a drag finding), severity is graduated (constraint drag high, deprecation medium), and a Last release context line is shown for packages abandoned 2+ years - release age is context, never a severity signal on its own. Projects with deprecated direct dependencies will see new medium findings under --check-maintenance (opt-in, advisory) (#732, #835)
• Render scan completeness in output: a partial-scan banner/status line in terminal (compact and verbose modes) and a completeness banner in the HTML report, surfacing packument-fetch failures and other scan gaps (#907, #908, #936)

Fixed

• Multi-folder --report now writes report.json alongside index.html (matching single-folder artifact shape) and renders override hygiene / maintenance risk panels per folder when --check-overrides/--check-maintenance are set (#878, #901)
• Use a callable FetchLike type for injected fetch implementations so clean builds do not break on Node 24, where typeof fetch gains a static preconnect member (#885, #886)
• Guard OSV-derived data handling against malformed advisory records so one bad advisory can no longer crash the whole scan (#917, #918)
• Reject --fix combined with --sarif or --cdx - previously these silently applied fixes, exited 0, and wrote no output file (#903)
• Fix the scan-complete status line printing "vulnerabilitys" when the finding count is not 1 (#927)
• npm parser: attribute transitive dependencies reached only through a workspace package's dependencies or through a peer dependency, so they no longer report "No parent identified" despite a real parent chain existing (#943, #944)
• Update js-yaml to 3.15.1 to clear GHSA-5p4m-2wfm-xmqj (#945, #946)
• Yarn parser: correct dev/prod classification for workspace and shared dependencies, fixing workspace-devDependency chains, root/workspace name collisions, and production dependencies also pulled in by a devDependency (#947, #948)
• pnpm v9 parser: classify dev/prod by production reachability instead of an aggregated devDependency name set, fixing a monorepo package wrongly marked dev when it was a production dependency in another workspace (#949, #950)
• Bun parser: classify dev/prod by production reachability rather than direct declaration only, fixing dev-only transitives leaking into production-scoped results (#951, #952)
• Yarn parser: classify dev/prod by production reachability over the full dependency graph instead of the display-capped path list, fixing a production dependency being wrongly marked dev when its path was dropped by the display cap (#953, #954)

Changed

• Multi-folder HTML report: replace the unicode chevron on folder sections with an inline SVG chevron that rotates on open, matching the single-folder report (#942)

Docs

• Pin actions/checkout to an immutable commit SHA in the README's GitHub Action workflow example (#956)
• Document the native GitHub Action inputs for override hygiene in the CI-integration section, with YAML examples and an input reference table (#909, #910)
• Fix the mobile navbar drawer opening clipped to the navbar height on the website (#921, #922)

[1.28.0] - 2026-07-26

Added

• Cooldown-aware fix resolver: warns when a recommended fix version is newer than the project's configured release cooldown (npm min-release-age, pnpm minimumReleaseAge, yarn npmMinimalAgeGate); advisory only (no flag, no exit-code change, on by default), renders in terminal, --verbose, JSON, and HTML report; npm/pnpm/yarn, Bun not yet covered (#872)
• --check-maintenance (DM001) maintenance risk detector: flags direct dependencies that block a transitive CVE fix via a major-version constraint drag, or that are deprecated on npm; renders in terminal, JSON, multi-folder, and HTML report, and counts toward --fail-on (#854)
• advisories init command to create an empty offline advisory database for air-gapped users to populate themselves (#847)
• Show skipped manifest dependencies in the HTML report and report.json (#841)

Fixed

• Verify parent-upgrade recommendations actually resolve the vulnerable package before recommending them: the resolver walks the dependency path and only recommends a parent upgrade when the terminal package resolves to a fixed version or is dropped from the path; it returns no recommendation when no version fixes it (no more false jest@30.4.2 for a brace-expansion finding), and marks unverifiable suggestions, excluding them from the "should fix all findings" claim (#899)
• Expire OSV detail cache records via CACHE_TTL_MS so refined advisories are refetched instead of served stale; a stale detail no longer forces an unnecessary major bump over an available within-range fix. Cache format bumped to v4 with transparent v1-v3 migration (#865)
• Preserve vulnerability evidence when advisory detail lookups fail: transient getVuln failures (timeout/DNS) now retry instead of being cached as a confirmed miss; only real 404/410 responses are negatively cached. Surfaces unresolvedAdvisoryIds in JSON/HTML output and warns (#869)
• Count multi-folder --check-overrides findings toward --fail-on; previously only single-folder mode gated on them, so a multi-folder CI scan silently passed on high override findings (#874)
• GitHub Action: omit --no-cache when offline mode is active (offline / offline-db / sync-advisories), so the Action no longer fails the CLI's flag validation on the first run (#875)
• Apply --ca-cert to the main scan path via a cert-aware fetch using node:https; NODE_EXTRA_CA_CERTS alone is unreliable in Node.js 18+ with undici (#840)
• Remove a dead null guard and de-collide the skipped-deps icon in the HTML report (#849)

... (truncated)

Commits

• fd481ff release: v1.29.0 (#967)
• 6dd55f5 revert: pull the local CVE fix counter and telemetry feature from main (#965)
• cb97080 feat: honor --usage and --only-used in multi-folder scans (#904)
• 0adbf73 fix: write report.json and OA/DM panels in multi-folder --report (#901)
• ec780cf docs: pin actions/checkout to an immutable commit (#956)
• 0c3d129 feat: add local CVE fix counter and opt-in anonymous telemetry (#961)
• d3b3f34 feat(output): report scan completeness (#936)
• 9177d19 fix(yarn-parser): classify dev/prod by production reachability (#954)
• f7bd67a fix(bun-parser): classify dev/prod by reachability so dev-only transitives ar...
• be05b74 fix(pnpm-parser): classify v9 dev/prod by production reachability (#950)
• Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.37.6 to 4.37.7

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/valibot@1602

commit: 24f62fa