[dependabot]

Bumps the actions group with 2 updates in the / directory: github/codeql-action and hyperpolymath/smtp-notify-action.

Updates github/codeql-action from 4.39.1 to 4.39.3

Release notes

Sourced from github/codeql-action's releases.

v4.39.3

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action's changelog.

4.39.3 - 04 Nov 2026

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Commits

• 33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
• 24393f8 Update changelog for v4.39.3
• 064910b Merge pull request #4297 from github/mbg/update-glob
• f532ac5 Update glob to 14.0.3
• 8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
• cea289b Return different exit code when a language is not recognised
• 7287bb3 Remove exclude entry that's no longer needed
• 8eb7cdf Use normal .editorconfig pattern
• 160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
• 913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
• Additional commits viewable in compare view

Updates hyperpolymath/smtp-notify-action from 0.5.0 to 0.5.1

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.5.1

Protocol-neutral server_address metadata

server_address is the host input for both SMTP and NNTP, and remained the only input in action.yml still described as SMTP-only ('SMTP server host name'). It now reads:

description: 'Server host name (SMTP or NNTP, per protocol: `protocol`)'

The secure and diagnose folded scalar descriptions were also rewrapped to line width (Reports → reports after the colon in diagnose), and the download URL in action.yml now points to v0.5.1.

Because workflow editors, consumers, and GitHub Marketplace read action.yml from the release tag — and tags are immutable here — this ships as v0.5.1 rather than moving v0.5.0. v0.5.0 remains supported in SECURITY.md since the binary and input surface are unchanged.

For the full NNTP posting (protocol: nntp, newsgroups) and Marketplace readiness notes introduced in the 0.5 series, see v0.5.0 and CHANGELOG.adoc.

Provenance

Zero Zig or Idris2 source files changed between v0.5.0 and v0.5.1. CI rebuilt both static musl binaries from this tag and verified they hash byte-identically to the unchanged SHA-256 pins inside action.yml before publishing. SHA256SUMS is attached:

2683da8f619dd5f310c9f6884da39e825c807c2c86a6319c19aba39b27f9c5c9  smtp-notify-x86_64-linux-musl
a58138308fb9832e1ceb551a12f1b04e591dc38ba5fd336c9acfb3f263161f29  smtp-notify-aarch64-linux-musl

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

== v0.5.1 — 2026-10-24

A metadata correction, and the release to publish the Marketplace listing from. The binary is byte-identical to v0.5.0's — the two SHA-256 pins are unchanged and re-verified by the release workflow — so v0.5.0 remains supported and correct for anyone already pinned to it. A new tag rather than an edit of the existing one because a tag is immutable here: consumers pin SHAs, and GitHub reads action.yml from the tag, which is the same property that made v0.5.0 necessary in the first place.

NOTE: The v0.5.0 heading below carries a note that the tag had to be pushed immediately after its merge. That was done, and the release published the same day; the note is left in place because it describes a property of the release process, not a pending task.

=== Fixed

• server_address is no longer described as SMTP-only. The field is the host for both protocols, and the description said 'SMTP server host name' — the last input description that still read as if the news transport did not exist. It now reads 'Server host name (SMTP or NNTP, per protocol: protocol)'. Cosmetic, but workflow editors and consumers read action.yml from the release ref, which is why it ships as a new tag rather than a main-only edit.

=== Changed

• The asset URL names v0.5.1. The pins do not move: the binary did not change.
• The secure and diagnose input descriptions were rewrapped to the file's line width (and Reports lowercased after the colon in diagnose).
• README.adoc's three pinned examples and .github/SECURITY.md's supported-versions table follow the current release.

Commits

• e384daf fix(action): protocol-neutral server_address wording (needs tag v0.5.1) (#28)
• See full diff in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a7f71506-584a-496b-8777-5833f65217ff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T12:46:11.913498Z	1ef4ff7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Fork governance

Lane	Status	Run
DEED syntax (repo deed)	🟢 conformant	run 42619776521
K9-DEED conformance (L0–L2; L3 not verified)	🟢 conformant (job: success)	same run
Hypatia verdict grid	🟡 medium findings (job: success) · advisory in grid scope: 🟢 green (0 critical, 0 high, not grading)	same run

Scope: the three lanes below are static checks at the named commit. A
green row means every applicable check in its declared scope passed;
orange means evidence is missing, not that nothing was found. The
Hypatia verdict covers GATING rows only; advisory reporters are listed
in its grid and their severity counts are limited to the grid scope.
A blocking gate may inspect findings outside the delta grid’s grade; open
the linked run and check annotations for the failing step and, where
applicable, the finding. No row is a security certification.

K9-DEED conformance

🟢 conformant · commit 2ef979ae3903 · run 42619776521 · validator hyperpolymath/standards@e064539116c2

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
K9 contract typecheck	🟢 conformant	1	0	0	0	— no comparable baseline
K9 validator self-test	🟢 conformant	49	0	0	0	— no comparable baseline
K9 live corpus (L0–L2)	🟢 conformant	106	0	0	1	— no comparable baseline

K9 live corpus (L0–L2): 1 finding(s) / scope notes

• coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.

Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run.

Hypatia verdict grid

🟡 medium · commit 2ef979ae3903 · run 42619776521 · scope: this change (3 file(s)) · excludes 9-archive/

Advisory: 2 row(s), worst 🟢 clean (0 critical, 0 high in grid scope) — reported, never grading the change.

Unique graded findings across gating and advisory rows: 1 (1 reporter observations; 0 without sufficient identity to corroborate). Row counts remain per reporter; unique totals do not change gating.
Raw Hypatia alert-derived observations: 31 (code-scanning, Dependabot and secret-scanning; some may also be in SARIF; not an extra total).

Reporter	Gate	Status	Critical	High	Medium	Minor	Since previous revision
Hypatia scan	gating	🟡 medium	0	0	1	0	— no comparable baseline (no prior PR grid or unreadable snapshot)
panic-attack assail	advisory	🟢 clean	0	0	0	0	— no comparable baseline (no prior PR grid or unreadable snapshot)
pons asinorum	advisory	🟢 clean	0	0	0	0	— no comparable baseline (no prior PR grid or unreadable snapshot)

Hypatia scan: 57 finding(s)

• medium research_extensions/RE001 — .github/workflows/push-email-notify.yml:45 — job `notify` in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring
• 56 further finding(s) in files this change does not touch: reported, not graded (7 critical, 4 high).

panic-attack assail: 59 finding(s)

• 59 further finding(s) in files this change does not touch: reported, not graded (4 critical, 0 high).

pons asinorum: 9 finding(s)

• 9 further finding(s) in files this change does not touch: reported, not graded (0 critical, 0 high).

Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud