build(deps): bump github/codeql-action/upload-sarif
What the developer wrote
Authored by dependabot[bot]
build(deps): bump github/codeql-action/upload-sarif
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.35.5 to 4.36.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/9e0d7b8d25671d64c341c19c0152d693099fb5ba...7211b7c8077ea37d8641b6271f6a365a22a5fbfa)
---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that bumps the version of a GitHub-owned action used to upload security scan results. It changes one pinned commit hash in a CI workflow file and does not alter any project code, cryptographic logic, or user-facing behavior. There is no indication this introduces or fixes a security vulnerability in the rust-bitcoin library itself.
No action required. Treat as routine CI maintenance. Review the upstream codeql-action release notes if organizational policy requires confirming the dependency update does not affect SARIF processing behavior.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates the github/codeql-action/upload-sarif action from commit 9e0d7b8d25671d64c341c19c0152d693099fb5ba to 7211b7c8077ea37d8641b6271f6a365a22a5fbfa (v4.35.5 to v4.36.0) in .github/workflows/cron-zizmor.yml. This workflow runs the zizmor tool to scan GitHub Actions for misconfigurations and uploads the SARIF output. The change is a minor version bump of a GitHub-maintained dependency, with no diff evidence of a security fix or vulnerability in rust-bitcoin.
Changed components
.github/workflows/cron-zizmor.ymlInspect captured patch +1 / −1
diff --git a/.github/workflows/cron-zizmor.yml b/.github/workflows/cron-zizmor.yml
index 034209b4..c0a0072a 100644
--- a/.github/workflows/cron-zizmor.yml
+++ b/.github/workflows/cron-zizmor.yml
@@ -27,7 +27,7 @@ jobs:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
+ uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
with:
sarif_file: results.sarif
category: zizmor
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.