build(deps): bump github/codeql-action/upload-sarif
What the developer wrote
Authored by dependabot[bot]
build(deps): bump github/codeql-action/upload-sarif
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.35.2 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...68bde559dea0fdcac2102bfdf6230c5f70eb485e)
---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.35.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine patch-version update of a GitHub-maintained security scanning helper (the CodeQL upload-sarif action) inside a CI workflow. It does not change the project's actual Bitcoin library code, its public interfaces, or how user funds or data are handled. There is no indication this commit fixes or introduces a security vulnerability.
No action required. Treat as normal dependency hygiene for CI infrastructure.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps github/codeql-action/upload-sarif from 4.35.2 to 4.35.4 in .github/workflows/cron-zizmor.yml. This action only uploads SARIF output from the zizmor workflow-security scanner to GitHub; it is not part of the rust-bitcoin crate’s runtime, build artifacts, or cryptographic code. The diff is a single SHA pin change with no functional workflow alterations.
Changed components
.github/workflows/cron-zizmor.ymlInspect captured patch +1 / −1
diff --git a/.github/workflows/cron-zizmor.yml b/.github/workflows/cron-zizmor.yml
index 6b6940d2..b3ab0ce7 100644
--- a/.github/workflows/cron-zizmor.yml
+++ b/.github/workflows/cron-zizmor.yml
@@ -27,7 +27,7 @@ jobs:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+ uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
with:
sarif_file: results.sarif
category: zizmor
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.