From 00d991dca41b0223090b25444a5a814823388a45 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 18:04:34 +0000 Subject: [PATCH 1/2] chore(deps): bump actions/stale Bumps the github-actions group with 1 update in the / directory: [actions/stale](https://github.com/actions/stale). Updates `actions/stale` from 10 to 11 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/stale/compare/v10...v11) --- updated-dependencies: - dependency-name: actions/stale dependency-version: '11' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/stale.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index d08683f8..7815ec9a 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -25,7 +25,7 @@ jobs: name: stale runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@v11 with: days-before-issue-stale: 60 days-before-issue-close: 14 From e08258157e103b14fe6302d095c2f2445c305ef9 Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Tue, 11 Aug 2026 03:15:26 -0400 Subject: [PATCH 2/2] ci(stale): pin actions/stale to the v11.0.0 commit SHA zizmor enforces a blanket `unpinned-uses` policy, so tag refs are rejected. `stale.yml` was never SHA-pinned on main (`actions/stale@v10`), so Dependabot bumped tag -> tag (`@v11`) and the code-scanning `zizmor` check flagged the changed line as a new alert. Pinning to 4391f3da (= tags v11 and v11.0.0, verified identical) clears the alert. It also fixes this going forward: Dependabot updates SHA pins in place and rewrites the trailing `# vX.Y.Z` comment, so future bumps stay SHA-to-SHA instead of reintroducing a tag ref. Verified locally with zizmor v1.29.0: this file goes from 1 high finding (unpinned-uses) to 0. actionlint passes. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/stale.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 7815ec9a..be877c8f 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -25,7 +25,7 @@ jobs: name: stale runs-on: ubuntu-latest steps: - - uses: actions/stale@v11 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: days-before-issue-stale: 60 days-before-issue-close: 14