Bump the minor-updates group across 1 directory with 4 updates

[dependabot]

Bumps the minor-updates group with 4 updates in the / directory: step-security/harden-runner, zizmorcore/zizmor-action, OWASP/cve-lite-cli and github/codeql-action/upload-sarif.

Updates step-security/harden-runner from 2.20.1 to 2.21.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.21.1

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

Commits

• e14015d Merge pull request #690 from step-security/rc-43
• 9001249 docs: update harden-runner version pin to v2.21.0 in getting started example
• a447fba docs: expand enterprise feature list and document custom VM and ubuntu-slim l...
• b0eaf8d docs: clarify community vs enterprise tiers and add maintained actions section
• 063e8e3 Merge pull request #687 from rohan-stepsecurity/rp/fix/bin-echo-fallback
• f46bdc1 chore: bump agent-ebpf to v1.9.1 and agent to v0.16.3
• 42e6daa fix: fall back to /bin/echo for non-usr-merged distros
• 05e3151 Merge pull request #684 from step-security/rc-42
• 0f37afa fix: ignore denied-endpoints on non-enterprise tier
• 93b58ee fix: resolve cache host read-first and never downgrade egress policy
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.6.2 to 0.6.3

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.3

zizmor 1.30.0 is now the default version.

Release notes: zizmorcore/zizmor-action#1300

Commits

• 70fb788 Sync zizmor versions (#162)
• 7999d8c chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 in ...
• 2ae1ce9 chore(deps): bump github/codeql-action/upload-sarif (#160)
• 951a5ee Skip prerelease versions in sync-zizmor-versions workflow (#158)
• 79f0191 chore(deps): bump github/codeql-action/upload-sarif (#156)
• 26a3ae6 sync-zizmor-versions: retry up to 5 times (#155)
• 435cb31 chore(deps): bump github/codeql-action/upload-sarif (#151)
• d6cec10 Try the new self-referencing syntax (#148)
• edd9b84 README: bump pins (#150)
• See full diff in compare view

Updates OWASP/cve-lite-cli from 1.28.0 to 1.31.0

Release notes

Sourced from OWASP/cve-lite-cli's releases.

v1.31.0 - Action informational mode, npm links in HTML report

Added

• HTML report: package names in the findings table now link directly to the npm registry page (#1021, @​bharatmalik-cs)

Fixed

• GitHub Action: scan step now truly informational when fail-on is not configured - the CLI's internal default was applying even when the action input was empty, causing exit 1 on criticals regardless of intent; split into three paths so only real errors propagate in the no-fail-on case; same fix applied to the overrides audit step; reachesFailOn now returns false for empty failOn
• Scanner: findFirstFixedVersion scoped to the package being evaluated, preventing a multi-package advisory from surfacing a fix version meant for a different package in the same advisory (@​vaibhav8a, closes #1042)
• pnpm v9: strip leading slash from package keys in pnpm-lock.yaml (@​Kunal241207, closes #1012)
• Flag validation: conflict and missing-argument errors now include the correct flag name and a concrete suggestion (@​Anikesh348, closes #401)

Tests

• Add SARIF fingerprint hash coverage (@​ramcharan07-gh)

Docs

• CLI reference: document --create-pr, --base, and --debug flags (@​Kakashi15-pix, closes #993)

Validation

• npm test
• npm run build

Contributors

@​bharatmalik-cs, @​vaibhav8a, @​Kunal241207, @​Anikesh348, @​ramcharan07-gh, @​Kakashi15-pix

v1.30.0 - Root column, auto within-range fixes, and Node 26 support

Added

• Root column showing the top-level direct dependency behind each transitive finding, across terminal, JSON, and HTML report (including multi-folder). HTML detail view Parent: label renamed to Root: for consistency
• --fix now auto-applies safe within-range transitive refreshes when the fix is available within the parent's declared range, without requiring a parent-level upgrade

Changed

• pnpm scan performance: lockfile parsed once per scan instead of up to three times - approximately 14% faster warm scan on large monorepos
• --fix unapplied-fix summary is now honest and categorized - each skipped fix includes a reason
• Workspace --fix commands scoped to the declaring workspace member rather than the root
• Transitive risk message refactored for clarity and reuse across terminal and HTML output

Fixed

• npm transitive remediation: resolves the correct installed instance of an intermediate package when the same package name appears at multiple versions in the tree
• Ratchet rejects incomplete scan data, preventing a partial scan from generating a misleadingly clean baseline
• OSV batch query: a 200 response with no results array now throws a descriptive error instead of crashing
• Parent-update "Recommended target" column shows the resolved version instead of the literal install command
• Quick take summary verb now agrees with the finding count
• 0.x cross-minor upgrades flagged as breaking in the Breaking? column, HTML report, and --fix confirmation
• Node 26 compatibility: better-sqlite3 bumped to 12.11.1, engines tightened to >=20

Docs

... (truncated)

Changelog

Sourced from OWASP/cve-lite-cli's changelog.

Changelog

All notable changes to CVE Lite CLI will be documented in this file.

[1.33.0] - 2026-09-01

Added

• EPSS Priority Signal: combines CVSS severity with EPSS exploitation likelihood percentile into four actionable tiers - fix_now (high impact + top 10% EPSS), fix_soon (high impact), monitor (lower severity + top 10% EPSS), low_priority (all else). Surfaces as an EPSS Priority column in the verbose terminal table, a prioritySignal field in JSON output, and a column plus four-tier legend in the HTML report. Null when no EPSS data is available (#1067, closes #1066)

Fixed

• Scan header now counts unique packages (by name@version) rather than advisory rows; the same package appearing under multiple advisory sources was previously counted twice (#1067)

[1.32.0] - 2026-09-01

Added

• --incomplete-policy warn|error (default: warn): when detection data is incomplete, warn exits 0 with a warning; error exits 3. GitHub Action gains incomplete-policy input with empty default for backward compatibility (#1019, @​luojiyin1987, closes #898)
• EPSS scores: findings are enriched with FIRST.org Exploit Prediction Scoring System data after the OSV pass. All CVE aliases are batch-fetched in a single API call. Highest-EPSS score shown in compact terminal top-3 block, verbose table column, and HTML report detail panel; full array in JSON output. Skipped in offline mode and for GHSA-only findings (#1053)
• npm advisory secondary source: after the OSV batch pass, packages with zero OSV matches are checked against the npm registry advisory API (POST https://registry.npmjs.org/-/npm/v1/security/advisories/bulk). Closes the coverage gap for CVEs that exist in OSV but have no npm ecosystem mapping. Skips in offline mode, non-fatal on error (#1056, closes #1054)
• --check-licenses flag: detect copyleft (LC001: GPL-2.0/3.0, AGPL-3.0, LGPL, EUPL, OSL, CDDL, CPL, EPL) and unknown (LC002: no declared license) licenses across the dependency tree in the same pass as the CVE scan. Informational only - never affects exit code or --fail-on. Surfaces in terminal, JSON, SARIF, and HTML reports. GitHub Action gains check-licenses input (#1059, closes #1058)

Fixed

• Direct parent version collision: resolveDirectParentContext used a name-keyed Map (last-write-wins) to find the direct parent version, producing wrong currentVersion baselines and downgrade suggestions when the same package name is installed at multiple different versions. Fixed by using findPackageAlongPath with the path prefix to the direct parent position (#1051, closes #1050)

Tests

• Add unit coverage for src/utils/advisory.ts (git+ssh:// protocol parsing, short-SHA alias resolution, scope handling, parseAdvisoryOrCommand edge cases) (#1046, @​suhanemathur, closes #1024)

Docs

• README comparison table: link each capability row to its corresponding docs page (#1064, closes #1063)
• Comparison tables and homepage updated for --check-licenses: new row in README and comparison.md, socket.md updated, snyk.md prose updated, homepage FeatureCard and capability pill added, workflow-integration.md gains "License compliance in CI" section (#1061, closes #1060)
• Vulnerability data source descriptions updated to reflect OSV + npm registry advisory API dual-source approach across README, how-it-works, caching, cli-reference, getting-started (#1062, closes #1057)

[1.31.0] - 2026-08-27

Added

• HTML report: package names in the findings table now link directly to the npm registry page for each package (#1021, @​bharatmalik-cs)

Fixed

• GitHub Action: scan step now truly informational when fail-on is not configured - the CLI's internal default was applying even when the action input was left empty, causing the step to exit 1 on critical findings regardless of the user's intent; split the run block into three paths so only real errors (exit > 1) propagate in the no-fail-on case; same fix applied to the overrides audit step which had the identical root cause; reachesFailOn now returns false for an empty failOn string (#1048, closes #1047)
• Scanner: findFirstFixedVersion now scopes its search to the specific package being evaluated, preventing a multi-package advisory from incorrectly surfacing a fix version meant for a different package in the same advisory (#1044, @​vaibhav8a, closes #1042)
• pnpm v9: strip the leading slash from package keys in pnpm-lock.yaml so packages are resolved correctly and findings are not missed (#1014, @​Kunal241207, closes #1012)
• Flag validation: conflict and missing-argument errors now include the correct flag name and a concrete suggestion for how to proceed (#1022, @​Anikesh348, closes #401)

... (truncated)

Commits

• a9072cb release: v1.31.0 (#1049)
• cad8ed2 fix: make action scan informational when fail-on is not configured (#1048)
• 8c5fd29 Add SARIF fingerprint hash tests (#1045)
• 8d09129 fix(scanner): scope findFirstFixedVersion to the package being scanned (#1044)
• 963b5a9 fix(pnpm): strip leading slashes from pnpm v9 package keys (#1014)
• c60a064 feat: link package names to npm in html report (#1021)
• 2748d82 Improve flag validation guidance (#1022)
• 5aa72d2 docs: add --create-pr, --base, and --debug flags to CLI reference (#998)
• 7a064db release: v1.30.0 (#1043)
• 6e9aca7 docs(contributing): document advisory DB setup for full test suite (#1041)
• Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.37.6 to 4.37.9

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions