From 7d94e2a09d0955e618459059129039c42fa2ab9f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 11:03:51 +0000 Subject: [PATCH 1/7] Bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/linter.yml | 2 +- .github/workflows/main.yml | 4 ++-- .github/workflows/pr.yml | 4 ++-- .github/workflows/test.yml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 9ce5270..27c3d5a 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -6,7 +6,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up JDK 21 uses: actions/setup-java@v5 with: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e4e930a..05e85c2 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -17,7 +17,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Scan With Black Duck uses: cap-java/.github/actions/scan-with-blackduck@9fc20a42d6556aa4cab5fcfe0f58002aa4851103 # main @@ -44,7 +44,7 @@ jobs: packages: read steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Scan With CodeQL uses: cap-java/.github/actions/scan-with-codeql@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index afe608a..ff13b85 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -24,7 +24,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Scan With Black Duck uses: cap-java/.github/actions/scan-with-blackduck@9fc20a42d6556aa4cab5fcfe0f58002aa4851103 # main @@ -52,7 +52,7 @@ jobs: packages: read steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Scan With CodeQL uses: cap-java/.github/actions/scan-with-codeql@9fc20a42d6556aa4cab5fcfe0f58002aa4851103 # main diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e381be7..7caffa8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Test CAP Projects uses: ./.github/actions/test From 825d8095e6b8bb2f06ee44293bef9d415e7ec54e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:52:58 +0000 Subject: [PATCH 2/7] Bump org.codehaus.mojo:flatten-maven-plugin from 1.7.3 to 1.8.0 Bumps [org.codehaus.mojo:flatten-maven-plugin](https://github.com/mojohaus/flatten-maven-plugin) from 1.7.3 to 1.8.0. - [Release notes](https://github.com/mojohaus/flatten-maven-plugin/releases) - [Commits](https://github.com/mojohaus/flatten-maven-plugin/compare/1.7.3...1.8.0) --- updated-dependencies: - dependency-name: org.codehaus.mojo:flatten-maven-plugin dependency-version: 1.8.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 7806491..a243e43 100644 --- a/pom.xml +++ b/pom.xml @@ -93,7 +93,7 @@ org.codehaus.mojo flatten-maven-plugin - 1.7.3 + 1.8.0 true resolveCiFriendliesOnly From cb8491ae89c897b63894e833697fa015b97ef32f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 11:03:39 +0000 Subject: [PATCH 3/7] Bump actions/setup-java from 5 to 6 Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5 to 6. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/linter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 27c3d5a..04cf160 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -8,7 +8,7 @@ jobs: steps: - uses: actions/checkout@v7 - name: Set up JDK 21 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: '21' distribution: 'temurin' From 2ba8d59a7704e6f0e3955bf5f2e5568f0f56b2ec Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:53:09 +0000 Subject: [PATCH 4/7] Bump tarides/changelog-check-action from 3 to 4 Bumps [tarides/changelog-check-action](https://github.com/tarides/changelog-check-action) from 3 to 4. - [Release notes](https://github.com/tarides/changelog-check-action/releases) - [Commits](https://github.com/tarides/changelog-check-action/compare/v3...v4) --- updated-dependencies: - dependency-name: tarides/changelog-check-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-changelog.yml b/.github/workflows/check-changelog.yml index b46ddb1..63e70fe 100644 --- a/.github/workflows/check-changelog.yml +++ b/.github/workflows/check-changelog.yml @@ -9,6 +9,6 @@ jobs: name: Check Changelog Action runs-on: ubuntu-latest steps: - - uses: tarides/changelog-check-action@v3 + - uses: tarides/changelog-check-action@v4 with: changelog: CHANGELOG.md \ No newline at end of file From 422f9af5bd7320910da1c3b73fe805ee1801c612 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 11:03:45 +0000 Subject: [PATCH 5/7] Bump spring.boot.version from 4.1.0 to 4.1.1 Bumps `spring.boot.version` from 4.1.0 to 4.1.1. Updates `org.springframework.boot:spring-boot-dependencies` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.1.0...v4.1.1) Updates `org.springframework.boot:spring-boot-maven-plugin` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.1.0...v4.1.1) --- updated-dependencies: - dependency-name: org.springframework.boot:spring-boot-dependencies dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: org.springframework.boot:spring-boot-maven-plugin dependency-version: 4.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index a243e43..bff0287 100644 --- a/pom.xml +++ b/pom.xml @@ -18,7 +18,7 @@ 21 5.0.0 - 4.1.0 + 4.1.1 https://nodejs.org/dist/ UTF-8 From 7b93846c3460b1bd3b063583c41ccfb622a2f55a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:53:19 +0000 Subject: [PATCH 6/7] Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 Bumps [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) from 3.6.2 to 3.6.3. - [Release notes](https://github.com/apache/maven-enforcer/releases) - [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.6.2...enforcer-3.6.3) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-enforcer-plugin dependency-version: 3.6.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index bff0287..986da22 100644 --- a/pom.xml +++ b/pom.xml @@ -119,7 +119,7 @@ maven-enforcer-plugin - 3.6.2 + 3.6.3 Project Structure Checks From eb62804573dd4279d7404d3670d91140af0443f5 Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Mon, 31 Aug 2026 13:45:36 +0200 Subject: [PATCH 7/7] Pin version shas --- .github/actions/build/action.yml | 6 +++--- .github/actions/test/action.yml | 6 +++--- .github/workflows/check-changelog.yml | 4 ++-- .github/workflows/linter.yml | 4 ++-- .github/workflows/main.yml | 4 ++-- .github/workflows/pr.yml | 4 ++-- .github/workflows/test.yml | 2 +- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml index 1d928c6..eff0f2d 100644 --- a/.github/actions/build/action.yml +++ b/.github/actions/build/action.yml @@ -14,14 +14,14 @@ runs: using: 'composite' steps: - name: Set up Java - uses: actions/setup-java@v4 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6 with: distribution: 'temurin' java-version: ${{ inputs.java-version }} cache: maven - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: ${{ inputs.node-version }} cache: 'npm' @@ -41,4 +41,4 @@ runs: shell: bash working-directory: tests/integration-tests run: | - mvn compile test-compile -DskipTests=true -B -V \ No newline at end of file + mvn compile test-compile -DskipTests=true -B -V diff --git a/.github/actions/test/action.yml b/.github/actions/test/action.yml index 1e2b7c3..a7988c9 100644 --- a/.github/actions/test/action.yml +++ b/.github/actions/test/action.yml @@ -14,14 +14,14 @@ runs: using: 'composite' steps: - name: Set up Java - uses: actions/setup-java@v4 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6 with: distribution: 'temurin' java-version: ${{ inputs.java-version }} cache: maven - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: ${{ inputs.node-version }} cache: 'npm' @@ -35,4 +35,4 @@ runs: shell: bash working-directory: samples/bookshop run: | - mvn test -B -V \ No newline at end of file + mvn test -B -V diff --git a/.github/workflows/check-changelog.yml b/.github/workflows/check-changelog.yml index 63e70fe..cbb975d 100644 --- a/.github/workflows/check-changelog.yml +++ b/.github/workflows/check-changelog.yml @@ -9,6 +9,6 @@ jobs: name: Check Changelog Action runs-on: ubuntu-latest steps: - - uses: tarides/changelog-check-action@v4 + - uses: tarides/changelog-check-action@8f47e0becbfa549e4c82a3f562aa6f90d2c2ee8c # v4 with: - changelog: CHANGELOG.md \ No newline at end of file + changelog: CHANGELOG.md diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 04cf160..6f21b15 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -6,9 +6,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up JDK 21 - uses: actions/setup-java@v6 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6 with: java-version: '21' distribution: 'temurin' diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 05e85c2..250e755 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -17,7 +17,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Scan With Black Duck uses: cap-java/.github/actions/scan-with-blackduck@9fc20a42d6556aa4cab5fcfe0f58002aa4851103 # main @@ -44,7 +44,7 @@ jobs: packages: read steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Scan With CodeQL uses: cap-java/.github/actions/scan-with-codeql@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index ff13b85..5fed8c0 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -24,7 +24,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Scan With Black Duck uses: cap-java/.github/actions/scan-with-blackduck@9fc20a42d6556aa4cab5fcfe0f58002aa4851103 # main @@ -52,7 +52,7 @@ jobs: packages: read steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Scan With CodeQL uses: cap-java/.github/actions/scan-with-codeql@9fc20a42d6556aa4cab5fcfe0f58002aa4851103 # main diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7caffa8..b8ad36a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Test CAP Projects uses: ./.github/actions/test