chore(deps): bump the actions group across 1 directory with 3 updates#104
Closed
dependabot[bot] wants to merge 1 commit intomainfrom
Closed
chore(deps): bump the actions group across 1 directory with 3 updates#104dependabot[bot] wants to merge 1 commit intomainfrom
dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Bumps the actions group with 3 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action), [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) and [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action). Updates `github/codeql-action` from 4.35.2 to 4.35.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) Updates `DavidAnson/markdownlint-cli2-action` from 20.0.0 to 23.1.0 - [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases) - [Commits](DavidAnson/markdownlint-cli2-action@992badc...6b51ade) Updates `lycheeverse/lychee-action` from 2.4.1 to 2.8.0 - [Release notes](https://github.com/lycheeverse/lychee-action/releases) - [Commits](lycheeverse/lychee-action@82202e5...8646ba3) --- updated-dependencies: - dependency-name: DavidAnson/markdownlint-cli2-action dependency-version: 23.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: lycheeverse/lychee-action dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-4d4fd39f7d
branch
from
7bc709c to
e57b050
Compare
mghabin
added a commit
that referenced
this pull request
May 2, 2026
Audit-driven cleanup folding in **all 6 open Dependabot PRs** + closing the 4 high-impact findings from this session's parallel audit run + addressing all 3 open issues. ## Headline change: 3 docs prescribed a **forbidden** pattern `docs/validation.md:54,57,156` and `docs/decision-trees.md:76,82` showed `[Authorize(Roles = "...")]` — explicitly forbidden by `DOCTRINE.md` (added in PR #110): silently no-ops on Microsoft.Identity.Web JWT schemes (`MapInboundClaims=false` looks for `ClaimTypes.Role`, Entra emits short-name `roles`). Readers copying these snippets would deploy a privilege-escalation bug. ## Six Dependabot PRs absorbed Each as part of this single squash, with their breakage transitively fixed: - **#104** (actions group) — `markdownlint-cli2-action v20→v23` introduced new MD060 enforcement. Realigned 5 doc tables + disabled MD060 in `.markdownlint.yaml` (emoji-width breaks 'aligned' detection). - **#105** Microsoft.Identity.Web 4.8 → 4.9 - **#106** Azure.Monitor.OpenTelemetry.Exporter 1.7 → 1.8 - **#107** Meziantou.Analyzer + SonarAnalyzer.CSharp - **#108** Microsoft.NET.Test.Sdk 18.4.0 → 18.5.1 - **#109** Scalar.AspNetCore 2.14.4 → 2.14.9 ## All 4 audit waves - **A — Doc doctrine**: validation.md + decision-trees.md fixed; operations.md env-rename runbook marked historical. - **B — Test coverage** (+21 new tests, 72 → 93): - new `EntraAuthForwardedHeadersExtensionsTests` (X-Forwarded-* + ForwardLimit cap) - rate-limiter long-form claim Theory (`http://schemas.microsoft.com/identity/claims/{tid,oid,appid}`) + Retry-After RFC 6585 + 2-user partition isolation - claims-challenge RFC 7235 edge-case Theory (case-insensitive params, comma-in-quoted, empty Bearer, multi-Bearer first-wins, non-Bearer scheme) - **bug fix surfaced by Retry-After test**: `MetadataName.RetryAfter` isn't always populated; falls back to `opts.Window` so 429 responses always carry the header. - **C — Infra**: - `log-analytics.bicep` `retentionInDays` parameterized (prod=90d audit floor, others=30d) - new `modules/budget.bicep` (Microsoft.Consumption/budgets, Forecasted+Actual at 80/100%, prod $50/mo, others $10/mo) - new `drift-detection.yml` workflow (weekly `az deployment group what-if`, matrix [ci, ppe], `::warning::` on drift) - container-app `transport='https'` for prod - **D — Polish**: - `DownstreamApiClient.ProbeAsync` `ConfigureAwait(false)` (library code) - `cd-cleanup.yml` PPE auth failure fixed via pre-check before `azure/login` ## Issues closed - **#80** — re-spiked twice (xunit.v3 3.2.2 + M.T.E.* still incompatible). Closing as `wontfix`. Added `Microsoft.Testing.*` to dependabot test-group so future bumps land grouped. - **#83** — keeping open as a focused follow-up (WAF<Program> harness migration is independent doctrine work; existing `IHostBuilder + TestServer` test covers the same matrix). - **#85** — keeping open as a focused follow-up (kitchen-worker → ACA Job is real architectural change; new module + permission-grant rewiring + CD pipeline change deserves its own PR). ## Verification | Gate | Result | |---|---| | `dotnet test EntraAuthPatterns.slnx` | **93/93** | | `az bicep build` (every `.bicep` + `.bicepparam`) | clean | | `actionlint` | clean | | `shellcheck` | clean | | `markdownlint-cli2` (CI version) | clean | Co-authored-by: mghabin <81494213+MohammadGhabin@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Owner
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps the actions group with 3 updates in the / directory: github/codeql-action, DavidAnson/markdownlint-cli2-action and lycheeverse/lychee-action.
Updates
github/codeql-actionfrom 4.35.2 to 4.35.3Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
e46ed2cMerge pull request #3867 from github/update-v4.35.3-8c6e48dbeb73d1d1Add changelog entry for #385324e0bb0Reorder changelog entriesec298daUpdate changelog for v4.35.38c6e48dMerge pull request #3865 from github/update-bundle/codeql-bundle-v2.25.37190983Add changelog note2bb2095Update default bundle to codeql-bundle-v2.25.37851e55Merge pull request #3850 from github/mbg/private-registry/cloudsmith-gcp262a15fAdd generic non-printable chars test for OIDC configsa6109b1Merge pull request #3853 from github/mbg/start-proxy/improved-checksUpdates
DavidAnson/markdownlint-cli2-actionfrom 20.0.0 to 23.1.0Commits
6b51adeUpdate to version 23.1.0.ea6e0daFreshen generated index.js file.3c4c2c8Bump markdownlint-cli2 from 0.22.0 to 0.22.13a933d4Bump@actions/corefrom 3.0.0 to 3.0.1648042eFreshen generated index.js file.d1cf982Bump eslint from 10.2.0 to 10.2.14db3dfcBump eslint from 10.1.0 to 10.2.070dbff9Bump eslint-plugin-unicorn from 63.0.0 to 64.0.0ce4853dUpdate to version 23.0.0.63a898cImprove type fidelity.Updates
lycheeverse/lychee-actionfrom 2.4.1 to 2.8.0Release notes
Sourced from lycheeverse/lychee-action's releases.
... (truncated)
Commits
8646ba3Add message with Summary report URL (#326)c6e7911[create-pull-request] automated change631725aBump peter-evans/create-pull-request from 7 to 8 (#318)942f324Bump actions/cache from 4 to 5 (#319)79de881Bump actions/checkout from 5 to 6 (#316)1ef33e2Update test to use--root-dirinstead of the deprecated--base(#315)50a631eUpdate args for lychee-action to use root-dir (#314)a8c4c7c[create-pull-request] automated change (#312)44b353bUpgrade checkout action from v4 to v5 (#310)e79a91bBump peter-evans/create-issue-from-file from 5 to 6 (#307)