chore(actions)(deps): bump the actions-minor-patch group across 1 directory with 4 updates by dependabot[bot] · Pull Request #1 · DredusCLWN/hermes-agent-fork

dependabot · 2026-08-10T15:58:59Z

Bumps the actions-minor-patch group with 4 updates in the / directory: hadolint/hadolint-action, docker/build-push-action, docker/login-action and google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml.

Updates hadolint/hadolint-action from 3.1.0 to 3.4.0

Release notes

Sourced from hadolint/hadolint-action's releases.

v3.4.0

3.4.0 (2026-07-30)

Features

Bump Hadolint to v2.15.0 (2a66e89)

v3.3.0

3.3.0 (2025-09-22)

Features

trigger release workflow (2332a7b)

v3.2.0

3.2.0 (2025-09-03)

Features

new minor release (3fc49fb)

Commits

2a66e89 feat: Bump Hadolint to v2.15.0
2332a7b feat: trigger release workflow
2bfd2b9 Don't trigger release workflow on Tag
0931ae0 Release v3.3.0
3fc49fb feat: new minor release
45eb072 Trigger release workflow on tag
97f3e4f Merge pull request #94 from felipecrs/patch-1
3e9a095 Merge branch 'master' into patch-1
3285327 Merge pull request #96 from m-ildefons/update-ci-yml
8bde06f Update CI yml
Additional commits viewable in compare view

Updates docker/build-push-action from 7.1.0 to 7.3.0

Release notes

Sourced from docker/build-push-action's releases.

v7.3.0

Preserve names in esbuild bundle by @crazy-max in docker/build-push-action#1567

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/build-push-action#1545 docker/build-push-action#1572

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/build-push-action#1568

Bump js-yaml from 4.1.1 to 4.3.0 in docker/build-push-action#1566

Bump tmp from 0.2.5 to 0.2.7 in docker/build-push-action#1547

Bump undici from 6.24.1 to 6.27.0 in docker/build-push-action#1564

Bump vite from 7.3.2 to 7.3.6 in docker/build-push-action#1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

v7.2.0

Bump @actions/core from 3.0.0 to 3.0.1 in docker/build-push-action#1525

Bump @docker/actions-toolkit from 0.87.0 to 0.90.0 in docker/build-push-action#1517

Bump brace-expansion from 2.0.2 to 5.0.6 in docker/build-push-action#1534

Bump fast-xml-builder from 1.1.4 to 1.2.0 in docker/build-push-action#1529

Bump fast-xml-parser from 5.5.7 to 5.8.0 in docker/build-push-action#1521

Bump postcss from 8.5.6 to 8.5.10 in docker/build-push-action#1526

Bump tar from 6.2.1 to 7.5.15 in docker/build-push-action#1533

Full Changelog: docker/build-push-action@v7.1.0...v7.2.0

Commits

53b7df9 Merge pull request #1572 from docker/dependabot/npm_and_yarn/docker/actions-t...
154298c [dependabot skip] chore: update generated content
cb1238b chore(deps): Bump @docker/actions-toolkit from 0.91.0 to 0.92.0
24f845d Merge pull request #1566 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
9c69730 [dependabot skip] chore: update generated content
bc3a3a5 Merge pull request #1574 from docker/dependabot/github_actions/aws-actions/co...
a82c504 chore(deps): Bump js-yaml from 4.1.1 to 4.3.0
0285a75 Merge pull request #1573 from docker/dependabot/github_actions/actions/cache-...
c6ad2a3 Merge pull request #1575 from docker/dependabot/github_actions/actions/checko...
d37484f Merge pull request #1564 from docker/dependabot/npm_and_yarn/undici-6.27.0
Additional commits viewable in compare view

Updates docker/login-action from 4.1.0 to 4.6.0

Release notes

Sourced from docker/login-action's releases.

v4.6.0

Harden buildx scoped config path handling by @crazy-max in docker/login-action#1059

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1095.0 in docker/login-action#1051

Bump js-yaml from 5.2.1 to 5.2.2 in docker/login-action#1057

Bump postcss from 8.5.10 to 8.5.22 in docker/login-action#1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Surface Docker Hub OIDC error responses by @crazy-max in docker/login-action#1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Support dhi.io as Docker Hub OIDC registry by @crazy-max in docker/login-action#1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Docker Hub OIDC login support by @crazy-max in docker/login-action#1048

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1091.0 in docker/login-action#1037

Bump @docker/actions-toolkit from 0.92.0 to 0.94.0 in docker/login-action#1044 docker/login-action#1050

Bump brace-expansion from 1.1.13 to 1.1.16 in docker/login-action#1046

Bump js-yaml from 5.2.0 to 5.2.1 in docker/login-action#1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Skip empty registry-auth secret mask by @crazy-max in docker/login-action#1035

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Preserve names in esbuild bundle by @crazy-max in docker/login-action#1022

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 docker/login-action#999 docker/login-action#1030

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/login-action#1023

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/login-action#1029

Bump http-proxy-agent and https-proxy-agent to 9.1.0 in docker/login-action#1017

Bump js-yaml from 4.1.1 to 5.2.0 in docker/login-action#1028

Bump sigstore from 4.1.0 to 4.1.1 in docker/login-action#1031

Bump tmp from 0.2.5 to 0.2.7 in docker/login-action#1002

Bump undici from 6.24.1 to 6.27.0 in docker/login-action#1020

Bump vite from 7.3.3 to 7.3.6 in docker/login-action#1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

v4.2.0

Bump @actions/core from 3.0.0 to 3.0.1 in docker/login-action#976

... (truncated)

Commits

dbcb813 Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
5bcb015 [dependabot skip] chore: update generated content
b30b2f2 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
9087f1e Merge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.2
0009830 [dependabot skip] chore: update generated content
2325523 build(deps): bump js-yaml from 5.2.1 to 5.2.2
4ec1d4a Merge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.22
5fc99ba Merge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...
e512bd5 Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...
a146c91 Merge pull request #1059 from crazy-max/harden-buildx-scope-paths
Additional commits viewable in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.8 to 2.5.0

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases.

v2.5.0

This updates OSV-Scanner to v2.5.0 as well as:

What's Changed

feat: gate reusable workflow outputs with a flag by @another-rex in google/osv-scanner-action#130

Pin download-artifact action to SHA by @SVilgelm in google/osv-scanner-action#127

feat: add runs-on input to reusable workflows by @BeyondEvil in google/osv-scanner-action#131

fix: address zizmor warnings by @another-rex in google/osv-scanner-action#135

fix: add GOTOOLCHAIN=auto env to osv-scanner calls by @another-rex in google/osv-scanner-action#138

New Contributors

@SVilgelm made their first contribution in google/osv-scanner-action#127

@BeyondEvil made their first contribution in google/osv-scanner-action#131

Full Changelog: google/osv-scanner-action@v2.3.8...v2.5.0

Commits

8deb546 Merge pull request #140 from google/update-to-v2.5.0
8fb3f8c Update unified workflow example to point to v2.5.0 reusable workflows
0c58c54 Update reusable workflows to point to v2.5.0 actions
06b2ab4 "Update actions to use v2.5.0 osv-scanner image"
9fd1bcc Merge pull request #138 from google/fix/gotoolchain-auto
01a87d5 fix: add GOTOOLCHAIN=auto env to osv-scanner calls
a82132c Merge pull request #135 from google/fix-zizmor-excessive-permissions
272ff57 fix: address zizmor template injection warnings
10621fb refactor: move permissions to job level to satisfy zizmor
fa4ff67 Merge pull request #131 from BeyondEvil/feat/add-runs-on-input
Additional commits viewable in compare view

dependabot · 2026-08-10T15:59:00Z

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-08-10T16:26:05Z

૮ >ﻌ< ა ci review

_{ran on 9abfbdc}

❌ Job failures

Check uv.lock / uv lock --check · View job

Job Check uv.lock / uv lock --check failed.

JS & TS checks / apps/desktop / check:lint · View job

Job JS & TS checks / apps/desktop / check:lint failed.

JS & TS checks / apps/desktop / check:test:ui · View job

Job JS & TS checks / apps/desktop / check:test:ui failed.

JS & TS checks / ui-tui / check · View job

Job JS & TS checks / ui-tui / check failed.

Python tests / Run tests slice 1/12 · View job

Job Python tests / Run tests slice 1/12 failed.

Python tests / Run tests slice 10/12 · View job

Job Python tests / Run tests slice 10/12 failed.

Python tests / Run tests slice 11/12 · View job

Job Python tests / Run tests slice 11/12 failed.

Python tests / Run tests slice 12/12 · View job

Job Python tests / Run tests slice 12/12 failed.

Python tests / Run tests slice 2/12 · View job

Job Python tests / Run tests slice 2/12 failed.

Python tests / Run tests slice 3/12 · View job

Job Python tests / Run tests slice 3/12 failed.

Python tests / Run tests slice 4/12 · View job

Job Python tests / Run tests slice 4/12 failed.

Python tests / Run tests slice 5/12 · View job

Job Python tests / Run tests slice 5/12 failed.

Python tests / Run tests slice 6/12 · View job

Job Python tests / Run tests slice 6/12 failed.

Python tests / Run tests slice 7/12 · View job

Job Python tests / Run tests slice 7/12 failed.

Python tests / Run tests slice 8/12 · View job

Job Python tests / Run tests slice 8/12 failed.

Python tests / Run tests slice 9/12 · View job

Job Python tests / Run tests slice 9/12 failed.

Python tests / e2e · View job

Job Python tests / e2e failed.

⚠️ Action required

CI-sensitive file review · View job

This PR changes CI-sensitive files (eslint config, workflow YAMLs, or composite actions). These influence what the js-autofix job executes and pushes to main.

Sensitive files changed:

How to fix:

Add the ci-reviewed label after verifying:

no new eslint rules with custom fix functions that write outside linted paths,
no workflow changes that widen permissions or remove guards,
no composite action changes that alter what gets executed.

uv.lock out of sync · View job

uv.lock is out of sync with pyproject.toml.

How to fix:

Run uv lock locally and commit the result. If on a PR, sync with main first:

git fetch origin main
git rebase origin/main
uv lock
git add uv.lock
git commit -m "chore: refresh uv.lock"

⚠️ Warnings

CI timings · View report · View job

Wall time 11m49s vs 7m52s (+50.2%). 26 job(s) slower, 9 faster, 3 unchanged.

JS & TS checks / apps/desktop / check:lint: -16.0s
JS & TS checks / apps/desktop / check:test:ui: -14.0s
OSV scan / Scan lockfiles / osv-scan: +9.0s
Lint Docker scripts / Lint Dockerfile (hadolint): +9.0s
JS & TS checks / apps/desktop / check:test:desktop:platforms: +8.0s

…ectory with 4 updates Bumps the actions-minor-patch group with 4 updates in the / directory: [hadolint/hadolint-action](https://github.com/hadolint/hadolint-action), [docker/build-push-action](https://github.com/docker/build-push-action), [docker/login-action](https://github.com/docker/login-action) and [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action). Updates `hadolint/hadolint-action` from 3.1.0 to 3.4.0 - [Release notes](https://github.com/hadolint/hadolint-action/releases) - [Commits](hadolint/hadolint-action@54c9adb...2a66e89) Updates `docker/build-push-action` from 7.1.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@bcafcac...53b7df9) Updates `docker/login-action` from 4.1.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@4907a6d...dbcb813) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.3.8 to 2.5.0 - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@9a49870...8deb546) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: hadolint/hadolint-action dependency-version: 3.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

DredusCLWN force-pushed the main branch from 033dbb7 to 727b3c3 Compare August 10, 2026 17:11

dependabot Bot changed the title ~~chore(actions)(deps): bump the actions-minor-patch group with 4 updates~~ chore(actions)(deps): bump the actions-minor-patch group across 1 directory with 4 updates Aug 10, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-a44b896c39 branch from 7f24170 to 98203d8 Compare August 10, 2026 17:34

DredusCLWN force-pushed the main branch from da5c208 to 3f9e35f Compare August 10, 2026 17:52

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-a44b896c39 branch from 98203d8 to 9abfbdc Compare August 11, 2026 19:40

Navigation Menu

chore(actions)(deps): bump the actions-minor-patch group across 1 directory with 4 updates - #1

chore(actions)(deps): bump the actions-minor-patch group across 1 directory with 4 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-minor-patch-a44b896c39

dependabot Bot commented on behalf of github Aug 10, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

github-actions Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.4.0

3.4.0 (2026-07-30)

Features

v3.3.0

3.3.0 (2025-09-22)

Features

v3.2.0

3.2.0 (2025-09-03)

Features

v7.3.0

v7.2.0

v4.6.0

v4.5.2

v4.5.1

v4.5.0

v4.4.0

v4.3.0

v4.2.0

v2.5.0

What's Changed

New Contributors

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Labels

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

૮ >ﻌ< ა ci review

❌ Job failures

Check uv.lock / uv lock --check · View job

JS & TS checks / apps/desktop / check:lint · View job

JS & TS checks / apps/desktop / check:test:ui · View job

JS & TS checks / ui-tui / check · View job

Python tests / Run tests slice 1/12 · View job

Python tests / Run tests slice 10/12 · View job

Python tests / Run tests slice 11/12 · View job

Python tests / Run tests slice 12/12 · View job

Python tests / Run tests slice 2/12 · View job

Python tests / Run tests slice 3/12 · View job

Python tests / Run tests slice 4/12 · View job

Python tests / Run tests slice 5/12 · View job

Python tests / Run tests slice 6/12 · View job

Python tests / Run tests slice 7/12 · View job

Python tests / Run tests slice 8/12 · View job

Python tests / Run tests slice 9/12 · View job

Python tests / e2e · View job

⚠️ Action required

CI-sensitive file review · View job

uv.lock out of sync · View job

⚠️ Warnings

CI timings · View report · View job

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading