From 636df8b561699c226d953b91ecab7b2a80bf68f0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 23:55:15 +0000
Subject: [PATCH] build(deps): bump the github-actions group with 3 updates

Bumps the github-actions group with 3 updates: [google/osv-scanner-action/osv-scanner-action](https://github.com/google/osv-scanner-action), [google/osv-scanner-action/osv-reporter-action](https://github.com/google/osv-scanner-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `google/osv-scanner-action/osv-scanner-action` from 2.6.0 to 2.7.0
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](https://github.com/google/osv-scanner-action/compare/a345acffa64b0eaede81a3d9aae6141214d9c8fc...b1d267aea5211fa648d9d442fa64b90dbdcbdd36)

Updates `google/osv-scanner-action/osv-reporter-action` from 2.6.0 to 2.7.0
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](https://github.com/google/osv-scanner-action/compare/a345acffa64b0eaede81a3d9aae6141214d9c8fc...b1d267aea5211fa648d9d442fa64b90dbdcbdd36)

Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)

---
updated-dependencies:
- dependency-name: google/osv-scanner-action/osv-scanner-action
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: google/osv-scanner-action/osv-reporter-action
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/osv-pull-request.yml | 6 +++---
 .github/workflows/osv-weekly.yml       | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/osv-pull-request.yml b/.github/workflows/osv-pull-request.yml
index baedae3c..3a21fba4 100644
--- a/.github/workflows/osv-pull-request.yml
+++ b/.github/workflows/osv-pull-request.yml
@@ -82,7 +82,7 @@ jobs:
       # function is reachable is what the govulncheck job answers.
       - name: scan the branch this merges into
         id: old
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         continue-on-error: true
         with:
           scan-args: |-
@@ -99,7 +99,7 @@ jobs:
 
       - name: scan the merge of this pull request
         id: new
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         continue-on-error: true
         with:
           scan-args: |-
@@ -138,7 +138,7 @@ jobs:
       # table come out byte for byte as they did under the deprecated
       # --output and --gh-annotations (docs/OSV-2-2026-10-15.md).
       - name: what this pull request adds
-        uses: google/osv-scanner-action/osv-reporter-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-reporter-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         with:
           scan-args: |-
             --old=osv-old.json
diff --git a/.github/workflows/osv-weekly.yml b/.github/workflows/osv-weekly.yml
index 9b2f0454..8f82a269 100644
--- a/.github/workflows/osv-weekly.yml
+++ b/.github/workflows/osv-weekly.yml
@@ -67,7 +67,7 @@ jobs:
 
       - name: scan
         id: scan
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         continue-on-error: true
         with:
           scan-args: |-
@@ -93,7 +93,7 @@ jobs:
       # way the deprecated --output printed it, measured byte for byte
       # 2026-10-15 (docs/OSV-2-2026-10-15.md).
       - name: results for the Security tab
-        uses: google/osv-scanner-action/osv-reporter-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-reporter-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         with:
           scan-args: |-
             --new=osv-results.json
@@ -102,7 +102,7 @@ jobs:
 
       - name: upload to the Security tab
         if: ${{ !cancelled() && hashFiles('osv-results.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
         with:
           sarif_file: osv-results.sarif
           category: osv-scanner