SQSCANGHA-134 Upgrade the libraries to latest version by claire-villard-sonarsource · Pull Request #227 · SonarSource/sonarqube-scan-action

claire-villard-sonarsource · 2026-04-08T08:52:18Z

Fixes CVE-2026-1526 CVE-2026-1528 CVE-2026-2229 CVE-2026-1525 CVE-2025-25285 CVE-2025-25288 CVE-2025-25290 CVE-2026-1527 CVE-2026-22036
Fixes Repox authentication
Pins all the external actions using the SHA to prevent supply chain attacks
Fixes outdate action version in README.md

hashicorp-vault-sonar-prod · 2026-04-08T08:52:38Z

sonar-review-alpha · 2026-04-13T09:32:14Z

Summary

This PR upgrades core GitHub Actions dependencies to the latest versions and pins all external action calls with commit SHAs for supply chain security.

Dependency upgrades:

@actions/core: 1.11.1 → 3.0.0
@actions/github: 6.0.1 → 9.0.0
@actions/tool-cache: 2.0.2 → 4.0.0
Build tool updates: @rollup plugins and rollup

These upgrades address 9 CVEs and fix Repox authentication. The large diff is mainly due to regenerated dist bundles (30KB new core module) after dependency updates.

Workflow security hardening:
All workflow files switch from actions/checkout@v5 to pinned SHA: de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2. This prevents supply chain attacks by locking to a specific commit rather than a version tag.

Documentation:
README examples updated from actions/checkout@v4 to actions/checkout@v6 (still use version tags in examples for clarity/maintainability).

What reviewers should know

Where to focus:

package.json & package-lock.json: Review the dependency changes. The major version bumps should have been validated for compatibility.
Workflow YAML files: Verify the SHA pinning is correct and intentional (this is a security best practice). All workflows use the same SHA consistently.
dist/ files: These are generated bundles—ignore detailed diffs unless checking that they were properly rebuilt. The large size change is expected from upgrading dependencies.

Things to watch for:

API compatibility: Major version bumps in @actions/core, @actions/github, and @actions/tool-cache may have breaking changes. Verify the code using these dependencies wasn't affected (check src/main files referenced in the main entry point).
README examples use version tags (v6) while workflows use SHAs—this is intentional for clarity and is the correct approach.
The CVE fixes should be confirmed against the actual vulnerabilities if needed (9 CVEs listed in commit message).

CI status:
Unit tests should validate the build works correctly with the new dependencies. Check that all workflows pass with the pinned actions.

Generate Walkthrough
Generate Diagram

🗣️ Give feedback

Fixes CVE-2026-1526 CVE-2026-1528 CVE-2026-2229 CVE-2026-1525 CVE-2025-25285 CVE-2025-25288 CVE-2025-25290 CVE-2026-1527 CVE-2026-22036

sonarqubecloud · 2026-04-13T09:47:33Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonar-review-alpha

Clean, consistent upgrade PR. All SHA pins are correct and uniformly applied across every changed workflow file.

🗣️ Give feedback

aleksandra-bozhinoska-sonarsource

Looks good!

…(#8) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [SonarSource/sonarqube-scan-action](https://github.com/SonarSource/sonarqube-scan-action) | action | minor | `v7.1.0` → `v7.2` | --- ### Release Notes <details> <summary>SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)</summary> ### [`v7.2`](SonarSource/sonarqube-scan-action@v7.2.0...v7.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v7.2.0...v7.2.0) ### [`v7.2.0`](https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v7.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v7.1.0...v7.2.0) #### What's Changed - SQSCANGHA-133 Upgrade the Node version used in UTs + contribution guide by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#226](SonarSource/sonarqube-scan-action#226) - SC-45750 Migrate to dateless license headers by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#229](SonarSource/sonarqube-scan-action#229) - SQSCANGHA-134 Upgrade the libraries to latest version by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#227](SonarSource/sonarqube-scan-action#227) - SQSCANGHA-138 Update dist and add ci test by [@antoine-vinot-sonarsource](https://github.com/antoine-vinot-sonarsource) in [#233](SonarSource/sonarqube-scan-action#233) - SQSCANGHA-140 Add OpenPGP signature verification for scanner downloads by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#235](SonarSource/sonarqube-scan-action#235) **Full Changelog**: <SonarSource/sonarqube-scan-action@v7...v7.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/epage-go/pulls/8 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

…(#440) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [SonarSource/sonarqube-scan-action](https://github.com/SonarSource/sonarqube-scan-action) | action | minor | `v7.1.0` → `v7.2` | --- ### Release Notes <details> <summary>SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)</summary> ### [`v7.2`](SonarSource/sonarqube-scan-action@v7.2.0...v7.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v7.2.0...v7.2.0) ### [`v7.2.0`](https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v7.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v7.1.0...v7.2.0) #### What's Changed - SQSCANGHA-133 Upgrade the Node version used in UTs + contribution guide by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#226](SonarSource/sonarqube-scan-action#226) - SC-45750 Migrate to dateless license headers by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#229](SonarSource/sonarqube-scan-action#229) - SQSCANGHA-134 Upgrade the libraries to latest version by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#227](SonarSource/sonarqube-scan-action#227) - SQSCANGHA-138 Update dist and add ci test by [@antoine-vinot-sonarsource](https://github.com/antoine-vinot-sonarsource) in [#233](SonarSource/sonarqube-scan-action#233) - SQSCANGHA-140 Add OpenPGP signature verification for scanner downloads by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#235](SonarSource/sonarqube-scan-action#235) **Full Changelog**: <SonarSource/sonarqube-scan-action@v7...v7.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/pypilot/pulls/440 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

…(#445) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [SonarSource/sonarqube-scan-action](https://github.com/SonarSource/sonarqube-scan-action) | action | minor | `v7.1.0` → `v7.2` | --- ### Release Notes <details> <summary>SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)</summary> ### [`v7.2`](SonarSource/sonarqube-scan-action@v7.2.0...v7.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v7.2.0...v7.2.0) ### [`v7.2.0`](https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v7.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v7.1.0...v7.2.0) #### What's Changed - SQSCANGHA-133 Upgrade the Node version used in UTs + contribution guide by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#226](SonarSource/sonarqube-scan-action#226) - SC-45750 Migrate to dateless license headers by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#229](SonarSource/sonarqube-scan-action#229) - SQSCANGHA-134 Upgrade the libraries to latest version by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#227](SonarSource/sonarqube-scan-action#227) - SQSCANGHA-138 Update dist and add ci test by [@antoine-vinot-sonarsource](https://github.com/antoine-vinot-sonarsource) in [#233](SonarSource/sonarqube-scan-action#233) - SQSCANGHA-140 Add OpenPGP signature verification for scanner downloads by [@claire-villard-sonarsource](https://github.com/claire-villard-sonarsource) in [#235](SonarSource/sonarqube-scan-action#235) **Full Changelog**: <SonarSource/sonarqube-scan-action@v7...v7.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/roboluke/pulls/445 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

hashicorp-vault-sonar-prod Bot changed the title ~~Upgrade the libraries to latest version~~ SQSCANGHA-134 Upgrade the libraries to latest version Apr 8, 2026

claire-villard-sonarsource force-pushed the claire/upgrade-libs branch 2 times, most recently from 335eaf6 to 8e7de7c Compare April 13, 2026 09:13

claire-villard-sonarsource requested a review from aleksandra-bozhinoska-sonarsource April 13, 2026 09:30

claire-villard-sonarsource marked this pull request as ready for review April 13, 2026 09:31

This comment was marked as resolved.

Sign in to view

This comment was marked as outdated.

Sign in to view

claire-villard-sonarsource and others added 4 commits April 13, 2026 11:46

SQSCANGHA-134 Upgrade the libraries to latest version

9d949a1

Fixes CVE-2026-1526 CVE-2026-1528 CVE-2026-2229 CVE-2026-1525 CVE-2025-25285 CVE-2025-25288 CVE-2025-25290 CVE-2026-1527 CVE-2026-22036

PREQ-5138 authenticate NPM (#230)

6d4fcee

Pin all external GitHub Actions versions using SHA1

d2364e7

Upgrade the version of actions/checkout in README.md

1fc347b

claire-villard-sonarsource force-pushed the claire/upgrade-libs branch from 495dc40 to 1fc347b Compare April 13, 2026 09:47

sonar-review-alpha Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread package-lock.json

aleksandra-bozhinoska-sonarsource approved these changes Apr 14, 2026

View reviewed changes

claire-villard-sonarsource merged commit c835722 into master Apr 14, 2026
73 checks passed

claire-villard-sonarsource deleted the claire/upgrade-libs branch April 14, 2026 13:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SQSCANGHA-134 Upgrade the libraries to latest version#227

SQSCANGHA-134 Upgrade the libraries to latest version#227
claire-villard-sonarsource merged 4 commits into
masterfrom
claire/upgrade-libs

claire-villard-sonarsource commented Apr 8, 2026 •

edited

Loading

Uh oh!

hashicorp-vault-sonar-prod Bot commented Apr 8, 2026 •

edited by atlassian Bot

Loading

Uh oh!

sonar-review-alpha Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

sonarqubecloud Bot commented Apr 13, 2026

Uh oh!

sonar-review-alpha Bot left a comment

Uh oh!

Uh oh!

aleksandra-bozhinoska-sonarsource left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

claire-villard-sonarsource commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hashicorp-vault-sonar-prod Bot commented Apr 8, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonar-review-alpha Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What reviewers should know

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

sonarqubecloud Bot commented Apr 13, 2026

Quality Gate passed

Uh oh!

sonar-review-alpha Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aleksandra-bozhinoska-sonarsource left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

claire-villard-sonarsource commented Apr 8, 2026 •

edited

Loading

hashicorp-vault-sonar-prod Bot commented Apr 8, 2026 •

edited by atlassian Bot

Loading

sonar-review-alpha Bot commented Apr 13, 2026 •

edited

Loading