mirrors/lima
0
0 Fork 0
mirror of https://github.com/lima-vm/lima.git synced 2026-10-28 11:44:35 +08:00
Code Activity
6,866 Commits 13 Branches 106 Tags
master
Commit Graph
591 Commits
Author SHA1 Message Date
dependabot[bot] c2273669d7 build(deps): bump ls-lint/action from 2.3.1 to 2.3.2 
Bumps [ls-lint/action](https://github.com/ls-lint/action) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/ls-lint/action/releases)
- [Commits](https://github.com/ls-lint/action/compare/02e380fe8733d499cbfc9e22276de5085508a5bd...a87c5eb4fb26d7af1bd0adba203dd1e76f7e94eb)

---
updated-dependencies:
- dependency-name: ls-lint/action
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-26 01:46:04 +00:00
Jan Dubois 48ce1d3fa2 Merge pull request #5659 from lima-vm/dependabot/github_actions/codeql-action-1b1ce9824d 
build(deps): bump the codeql-action group with 3 updates
 2026-10-21 19:39:59 -07:00
dependabot[bot] d93603b75c build(deps): bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.4 to 0.7.1.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/cc914d7f3750a2d13d75c7f184a1060aa0e9d482...85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-22 01:44:31 +00:00
dependabot[bot] bffc089077 build(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)

Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)

Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-22 01:44:27 +00:00
Akihiro Suda affe60b779 CI: run a smoke test for HCS 
Merge the windows-plain-wsl2 and windows-plain-qemu jobs into a
windows-plain matrix job, and add HCS to the matrix, running the
plain-Windows smoke test against templates/experimental/hcs.yaml.

The full test suite is not run for HCS, as the HCS driver still lacks
several features (mounts, port forwarding, ...).

Fixes #5465

Assisted-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2026-10-21 19:10:38 +09:00
dependabot[bot] 94519fe386 build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-19 01:45:35 +00:00
Rana Md Ali Ahsan c388098fae vz: add networkOpts.hostLoopback to block guest access to host loopback 
The default user-mode network maps the gateway IP to the host's 127.0.0.1,
so the guest can reach every host service via `host.lima.internal`,
including ones bound only to the loopback. That is useful for dev VMs but
exposes local databases and dev servers to a guest that runs untrusted
code, such as a CI runner.

Add `networkOpts.hostLoopback` to lima.yaml (default true, unchanged),
in a new `networkOpts` group for network options. When false, the
in-process gvisor-tap-vsock gateway maps the gateway IP and
0.0.0.0 to 0.0.0.1 instead of 127.0.0.1. The host has no route to 0.0.0.1,
so connections to `host.lima.internal` are refused at once, rather than
going to the host's LAN, and UDP to 0.0.0.0 cannot reach the host's
loopback either. DNS, outbound access and SSH are unaffected.

Only `vmType: vz` supports it. `qemu`, `krunkit`, `wsl2` and `hcs` reject
`false` rather than ignore it (krunkit's default host resolver sends DNS
through `host.lima.internal`, so it needs separate work), and so does a
`user-v2` network, which is a daemon shared by instances. The refusals
are in each driver's Validate, not in validateConfig, which Configure also
runs on deletion.

A proxy on the host's loopback, whether it comes from the host's network
settings, `env`, or `propagateProxyEnv`, is rewritten to the gateway
address, which `networkOpts.hostLoopback: false` makes unreachable. Lima
warns when that happens, and the docs say so.

A BATS test, run in the vz CI job, checks end to end that a host
loopback service is refused at once with `false` and reachable after
switching to `true`, that DNS keeps working, and that a `user-v2`
network is rejected.

Refs #5574

Assisted-by: Claude Code
Signed-off-by: Rana Md Ali Ahsan <rana@codesamplez.com>
 2026-10-15 08:16:40 -04:00
dependabot[bot] 4d8113d65d build(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)

Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)

Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-15 01:45:34 +00:00
Ansuman Sahoo 9ba4e668b0 Merge pull request #5613 from lima-vm/dependabot/github_actions/actions/upload-artifact-7.0.2 
build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2
 2026-10-14 19:51:15 +05:30
dependabot[bot] f7bd9e0ec8 build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-14 12:35:44 +00:00
dependabot[bot] 23bc73afe8 build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.1 to 8.0.2.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-14 12:35:27 +00:00
Jan Dubois e12791225d Update nobin config with base64 and confusables checking 
* Move the flags from the Makefile to .nobin.yaml
* Check for unexpected base64 data of 32 characters or more
* Check for Unicode characters that can be confused with Latin letters
  or digits
* Run nobin in lint-quick.yml instead of test.yml

test.yml skips docs-only changes, but docs are a likely place for a
link spelled with a look-alike letter. lint-quick.yml runs on every
change.

Both checks rely on heuristics and skip some candidates to avoid false
positives. The config file lists the known exceptions.

Signed-off-by: Jan Dubois <jan.dubois@suse.com>
 2026-10-12 21:10:21 -07:00
Jan Dubois ea021aed31 wsl2: skip the SSH address lookup while no host agent runs 
`limactl stop` waits until the instance reports Stopped, and each status
check of a running WSL2 instance looks up its SSH address with `wsl -d`.
WSL stops a distro 15 seconds (by default) after the last `wsl` command
in it exits, and these checks come every half second. So when another
program launches the distro right after the host agent terminates it,
the checks keep it running, and the stop times out after three minutes.

A `wsl` command without `-d` runs in the default distro, which is Lima's
when no other distro is installed. GitHub's Windows runners issue one
from time to time (`wsl -u root -e ls`, from their hosted-compute-agent).
A launch that arrives during a terminate waits, then runs right after the
distro stops. Since WSL 3.0.1 a terminate takes ten seconds instead of
under one, which widens that window; older versions hang the same way
when the launch arrives in their shorter one.

Look up the address only while a host agent runs. An instance without
one keeps the default 127.0.0.1.

CI hits this race only now and then, so the plain-host WSL2 job
forces it on every run. Its smoke test launches the default distro with
`wsl -u root -e ls` while `limactl stop` terminates the instance, only
to show that the stop completes anyway.

Signed-off-by: Jan Dubois <jan.dubois@suse.com>
 2026-10-06 10:50:15 -07:00
Jan Dubois fee349adab CI: factor Windows setup into composite actions; add plain-Windows jobs 
Lima should run on a Windows host whose only ssh is the native OpenSSH
client, but the existing Windows jobs run with Git for Windows and MSYS2
installed, so a new dependency on their tools would go unnoticed. The
plain-Windows jobs remove both toolchains before testing.

The MSYS2 jobs got a Cygwin ssh from Git for Windows through
_LIMA_WINDOWS_EXTRA_PATH and now install MSYS2's openssh instead. That
was the experimental variable's last use in the repo, so remove it.

The MSYS2 jobs also install rsync, so the integration tests cover the
rsync copy backend on Windows. Because MSYS2 setup now runs before the
unit tests and make, the unit tests that skip without rsync run on
Windows too.

The WSL2 job's id changes from windows to windows-wsl2.

Signed-off-by: Jan Dubois <jan.dubois@suse.com>
 2026-10-02 00:28:58 -07:00
dependabot[bot] 6c08ffa914 build(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.38.1 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

Updates `github/codeql-action/analyze` from 4.38.1 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

Updates `github/codeql-action/upload-sarif` from 4.38.1 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-01 01:46:07 +00:00
Jan Dubois 4158dc2ddb CI: lint-quick: ignore deepwiki.com 429 
deepwiki.com now answers non-browser clients with a Vercel bot
challenge that returns 429, so the README's DeepWiki badge has failed
every lint-quick run since 2026-09-28. GitHub's image proxy still
fetches the badge, so readers see it.

Signed-off-by: Jan Dubois <jan.dubois@suse.com>
 2026-09-29 21:21:12 -07:00
Jan Dubois 4210053c62 Merge pull request #5117 from pirate/secure-vz-block-devices 
Secure macOS VZ block-device attachment
 2026-09-28 16:58:51 -07:00
dependabot[bot] 9db59ff457 build(deps): bump the codeql-action group across 1 directory with 3 updates 
Bumps the codeql-action group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.38.0 to 4.38.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...1c5b675653bb5c22dbe9b12b556ec555138e09fd)

Updates `github/codeql-action/analyze` from 4.38.0 to 4.38.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...1c5b675653bb5c22dbe9b12b556ec555138e09fd)

Updates `github/codeql-action/upload-sarif` from 4.38.0 to 4.38.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...1c5b675653bb5c22dbe9b12b556ec555138e09fd)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-28 01:45:23 +00:00
Ansuman Sahoo dc3d16d309 fix broken X link in README 
Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>
 2026-09-25 15:04:46 +05:30
Nick Sweeting aa8f132f00 Support secure host block-device attachment on macOS VZ 
Attach explicitly allowed host disks through a dedicated root-owned helper,
passing validated file descriptors to unprivileged VZ over an authenticated
Unix socket. Scope sudoers grants to the invoking user and exact device paths,
reject unsafe helper paths and socket symlinks, authenticate both peers, and
validate the received device identity.

Retain descriptors per VM while preserving process-lifetime network wrappers
used by krunkit. Lock whole host disks across instances sharing LIMA_HOME,
including raw/block aliases and partitions. Reject duplicate configuration
entries and external VZ drivers at runtime.

Compose network and block-device sudoers fragments through pkg/sudoers, match
complete generated lines, and warn when regeneration removes existing grants.
Keep integration-test grants in temporary fragments and revoke them before
detaching the test RAM disk. Add security, lifecycle, and real-disk regression
coverage and document installation requirements and remaining grant limits.

Signed-off-by: Nick Sweeting <git@sweeting.me>
 2026-09-23 10:08:04 -07:00
Akihiro Suda 5539e86df5 Merge pull request #5220 from afbjorklund/sbom 
Add SBOM artifact using cyclonedx-gomod
 2026-09-17 19:55:52 +09:00
Jan Dubois 328d4afb5f Merge pull request #5506 from lima-vm/dependabot/github_actions/codeql-action-8213001b74 
build(deps): bump the codeql-action group with 3 updates
 2026-09-15 21:11:40 -07:00
dependabot[bot] b66bb9660f build(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.3 to 0.6.4.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/70fb788f84895a7701f5643d103d587e460b5c99...cc914d7f3750a2d13d75c7f184a1060aa0e9d482)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-16 01:46:12 +00:00
dependabot[bot] 425233b183 build(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63)

Updates `github/codeql-action/upload-sarif` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-16 01:45:53 +00:00
Akihiro Suda 95b6316b3e Merge pull request #5192 from AkihiroSuda/fix-4389 
Rewrite test-port-forwarding.pl in BATS
 2026-09-12 01:22:53 +09:00
Anders F Björklund 9426db7649 Add SBOM artifact to the release notes 
Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
 2026-09-11 13:18:00 +02:00
Akihiro Suda c80fad98ad gomodjail: update to v2.0.1, enforce gomodjail analyze in CI 
gomodjail v2 moves the focus to static analysis: `gomodjail analyze`
verifies that the modules annotated `gomodjail:confined` in go.mod cannot
reach a denied capability (filesystem, network, process execution, raw
syscalls, OS state modification, or cgo).

Add gomodjail to ./hack/tools, add a `gomodjail` lint target, and wire it
into `make lint` and the "Lints" job. Unlike the legacy dynamic mode, this
gate is blocking.

The verdicts are platform-dependent, so the gate is pinned to linux/amd64
and linux/arm64. These are the only platforms that can be analyzed from any
host: analyzing darwin needs a macOS host, as the "vz" driver requires cgo.
The linux verdicts are a superset of the darwin ones anyway. Windows is
deliberately left out, as it would unconfine 18 more modules (go-yaml,
containerd/log, go-runewidth, ...) and weaken the gate for the other
platforms.

`gomodjail fix` downgraded 36 modules to `gomodjail:unconfined` to make the
gate pass. 65 modules remain confined: 37 clean, 28 warning-only.
`make gomodjail-fix` is added for redoing this on dependency bumps, so that
the decision stays visible and reviewable in go.mod.

The macOS job that exercises the legacy dynamic mode (`gomodjail run`) is
kept as an experiment, with its checkout pinned to v2.0.1 instead of HEAD.

Assisted-by: Claude Code (Opus 5)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2026-09-09 12:32:12 +09:00
Akihiro Suda 85c17e7bc3 Rewrite test-port-forwarding.pl in BATS 
Add hack/bats/tests/port-forwarding.bats, covering the same portForwards
rule matrix as hack/test-port-forwarding.pl, with one @test per
forward/ignore scenario, and run it in CI on every host platform:
- Linux: the existing "bats" job
- macOS: the "qemu" job (QEMU driver) and the "vz" job (vz driver)
- Windows: the "windows" job (WSL2 driver) and the "windows-qemu" job

Instead of grepping hostagent log strings and sleeping for a fixed time
(issue 4388), the test records `limactl watch --json` events and waits
for the "forwarding"/"not-forwarding" event of each guest listener
before connecting.

The test honors LIMACTL_CREATE_ARGS (e.g. --vm-type), allows overriding
the base template via LIMA_BATS_PORT_FORWARDING_BASE_TEMPLATE (the WSL2
job uses template:experimental/wsl2), and installs socat in the guest
with whatever package manager the guest image provides.

Notable differences from the Perl script:
- Uses socat on both the host and the guest (the nc/socat choice is
  dropped; CI was already running the socat mode).
- The tests for the `guestPortRange: [305, 309]` rule now actually use
  ports 305-309; the Perl script tested ports 325-329 by mistake, which
  are not covered by any rule.
- Test names are ASCII-only ("->" instead of a Unicode arrow): the MSYS2
  bash mangles multibyte characters inconsistently between bats' test
  registration and dispatch, making every such test fail with
  "bats: unknown test name".
- Guest paths passed to `limactl shell` are embedded in an `sh -c`
  command string instead of being passed as arguments, because MSYS2
  path conversion would rewrite a bare /tmp/... argument to
  C:/msys64/tmp/... before limactl.exe sees it.

hack/test-port-forwarding.pl is removed. The only piece of it that
test-templates.sh still needs is the `guestPort: 8888` rule for the
"CONTAINER_ENGINE run" test, which is now injected with `limactl yq`.
The injected rule replaces any portForwards rules from the template, as
the Perl script did: all instances share the host port namespace, so
e.g. test-misc.yaml's own rules would collide with a concurrently
running instance created from the same template. The modified template
is round-tripped through `limactl tmpl copy --embed` so that it still
passes the template-embedding check (`limactl yq` indents sequences
differently than the embed encoder).

The perl/nc/socat host requirements and the guest netcat/socat installs
are gone; the external host IP is now looked up with getent instead of
perl.

The test passed 56/56 (16 skipped as designed on a Linux host) against
the QEMU driver without KVM.

Fix #4389

Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2026-09-08 11:41:18 +09:00
dependabot[bot] 80837ea609 build(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.2 to 0.6.3.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/3dc1ecc9bcb9e94e9b2c709687979e1298497054...70fb788f84895a7701f5643d103d587e460b5c99)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-07 15:04:53 +00:00
Ansuman Sahoo 8644017740 ci(zizmor): use self-repository syntax 
Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>
 2026-09-07 15:48:23 +05:30
dependabot[bot] bd03fdb9ce build(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938)

Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938)

Updates `github/codeql-action/upload-sarif` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-02 01:45:14 +00:00
dependabot[bot] ff0ac08133 build(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.7 to 4.37.8
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28)

Updates `github/codeql-action/analyze` from 4.37.7 to 4.37.8
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28)

Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.37.8
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 01:45:57 +00:00
dependabot[bot] 8bcf361467 build(deps): bump the codeql-action group across 1 directory with 3 updates 
Bumps the codeql-action group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/d1ba80a13dd99fba24a470575428917156a28b43...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

Updates `github/codeql-action/analyze` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/d1ba80a13dd99fba24a470575428917156a28b43...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

Updates `github/codeql-action/upload-sarif` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/d1ba80a13dd99fba24a470575428917156a28b43...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-26 01:46:01 +00:00
Akihiro Suda 9d642b4483 CI: lint-quick: ignore cloud-native.slack.com 403 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2026-08-20 00:54:47 +09:00
Akihiro Suda d2fdf0100d CI: Windows: install perl 
perl is no longer installed on Windows runners
(actions/runner-images issue 14562)

Fix issue 5424

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2026-08-19 20:37:06 +09:00
dependabot[bot] 70c5f53e9a build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 4.1.1 to 4.2.2.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/0f67c3f4856b2e3261c31976d6725780e5e4c373...4d101475d8b20a2381f78447822ac1eab6504dd8)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-13 01:43:09 +00:00
Ansuman Sahoo c01ab548bc Merge pull request #5339 from afbjorklund/schema-release 
Add jsonschema to the release artifacts
 2026-08-11 14:48:22 +05:30
Ansuman Sahoo 11a2952774 Merge pull request #5404 from lima-vm/dependabot/github_actions/zizmorcore/zizmor-action-0.6.2 
build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2
 2026-08-11 13:56:29 +05:30
dependabot[bot] 78cd07aeeb build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/6fc4b006235f201fdab3722e17240ab420d580e5...3dc1ecc9bcb9e94e9b2c709687979e1298497054)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 01:46:17 +00:00
dependabot[bot] f03352844a build(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43)

Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43)

Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 01:46:10 +00:00
dependabot[bot] 656315b3df build(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-06 01:46:20 +00:00
Anders F Björklund a39168726d Add jsonschema to the release artifacts 
So that the json can be referenced from schema store.

Generate the file before cleaning the native limactl.

Add included base templates as default.yaml dependencies.

Add variable for "cp" since it seems to be not be default.

Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
 2026-08-01 20:31:24 +02:00
Jan Dubois e2f8093ebb Merge pull request #5371 from lima-vm/dependabot/github_actions/ossf/scorecard-action-2.4.4 
build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4
 2026-07-29 19:56:46 -07:00
dependabot[bot] a79bd7fc19 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-30 01:47:01 +00:00
dependabot[bot] 29aaf68e44 build(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.0 to 0.6.1.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/6599ee8b7a49aef6a770f63d261d214911a7ce02...6fc4b006235f201fdab3722e17240ab420d580e5)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-30 01:46:31 +00:00
Akihiro Suda 90515e33a1 Merge pull request #5363 from lima-vm/dependabot/github_actions/github/codeql-action/init-4.37.3 
build(deps): bump github/codeql-action/init from 4.37.2 to 4.37.3
 2026-07-29 17:08:31 +09:00
Jan Dubois 53c65e22f8 Merge pull request #5361 from lima-vm/dependabot/github_actions/github/codeql-action/analyze-4.37.3 
build(deps): bump github/codeql-action/analyze from 4.37.2 to 4.37.3
 2026-07-28 22:48:37 -07:00
dependabot[bot] e6ed8d5c8e build(deps): bump github/codeql-action/init from 4.37.2 to 4.37.3 
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.2 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-29 01:46:09 +00:00
dependabot[bot] 9840681b12 build(deps): bump github/codeql-action/upload-sarif 
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.2 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-29 01:44:57 +00:00
dependabot[bot] ef62bab833 build(deps): bump github/codeql-action/analyze from 4.37.2 to 4.37.3 
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.2 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-29 01:43:35 +00:00