From 37c8437b48dcd3ac99d778ca135c196ed7255ba9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 10:03:54 +0000 Subject: [PATCH 1/3] chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.38.3 to 4.39.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 85220a3..5fd9956 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -54,6 +54,6 @@ jobs: retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif From d03521ed34d717d8346d53107788b4667263fca2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 10:04:02 +0000 Subject: [PATCH 2/3] chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 85220a3..3b51eee 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -40,7 +40,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif From ed05a544e70b9d302cc021431e9d24880151f4c3 Mon Sep 17 00:00:00 2001 From: Albert Mavashev Date: Mon, 19 Oct 2026 19:27:18 -0400 Subject: [PATCH 3/3] docs: record October 19 dependency review --- AUDIT.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/AUDIT.md b/AUDIT.md index a9d4440..767eb2b 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1,5 +1,15 @@ # Cycles Protocol v0.1.25 — Client (Python) Audit +## 2026-10-19 — Dependabot dependency review + +Consolidates the following reviewed updates on current main: + +- PR #106: chore(deps): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 +- PR #107: chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 + +Workflow actions remain pinned to verified upstream commit SHAs. Existing supported runtime versions, application code, and YAML protocol contracts are preserved. Existing lint, build, test, coverage, conformance, and applicable security checks must pass on the combined commit before merge; coverage requirements are not lowered. + + ## 2026-10-11 — Dependency maintenance PR #104 updates the SHA-pinned download-artifact action from 8.0.1 to 8.0.2, which includes artifact-service rate-limit retry handling. The branch is brought up to date with main. Python dependencies, SDK source, and YAML protocol fixtures are unchanged. Existing Python 3.10/3.12 lint, typing, build, coverage, and durable recovery conformance checks remain enabled and must pass before merge.