Alfresco · dependabot · Oct 8, 2025
diff --git a/.github/workflows/bumpVersions.yml b/.github/workflows/bumpVersions.yml
@@ -36,22 +36,22 @@ jobs:
           token: ${{ secrets.BOT_GITHUB_TOKEN }}
 
       - name: Login to quay.io
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_PASSWORD }}
 
       - name: Install Updatecli
-        uses: Alfresco/alfresco-build-tools/.github/actions/setup-updatecli@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/setup-updatecli@v9.3.1
 
       - run: updatecli apply
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
 
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-helm-docs@v9.0.1
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-helm-docs@v9.3.1
       - name: Regenerate helm docs if necessary
-        uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.3.1
         with:
           pre-commit-args: helm-docs || true
           skip_checkout: "true"
@@ -77,7 +77,7 @@ jobs:
           token: ${{ secrets.BOT_GITHUB_TOKEN }}
 
       - name: Install Updatecli
-        uses: Alfresco/alfresco-build-tools/.github/actions/setup-updatecli@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/setup-updatecli@v9.3.1
 
       - name: Checkout updatecli configs
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
@@ -99,9 +99,9 @@ jobs:
           QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
           UPDATECLI_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
 
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-helm-docs@v9.0.1
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-helm-docs@v9.3.1
       - name: Regenerate helm docs if necessary
-        uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.3.1
         with:
           pre-commit-args: helm-docs || true
           skip_checkout: "true"

diff --git a/.github/workflows/docker-compose-community.yml b/.github/workflows/docker-compose-community.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - uses: >-
-          Alfresco/alfresco-build-tools/.github/actions/dbp-charts/verify-compose@v9.0.1
+          Alfresco/alfresco-build-tools/.github/actions/dbp-charts/verify-compose@v9.3.1
         with:
           compose_file_path: docker-compose/community-compose.yaml
           postman_path: test/postman/docker-compose

diff --git a/.github/workflows/docker-compose-enterprise.yml b/.github/workflows/docker-compose-enterprise.yml
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - name: Verify docker-compose
         uses: >-
-          Alfresco/alfresco-build-tools/.github/actions/dbp-charts/verify-compose@v9.0.1
+          Alfresco/alfresco-build-tools/.github/actions/dbp-charts/verify-compose@v9.3.1
         timeout-minutes: 10
         with:
           postman_path: test/postman/docker-compose

diff --git a/.github/workflows/helm-community.yml b/.github/workflows/helm-community.yml
@@ -64,15 +64,15 @@ jobs:
          version: "3.12.1"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
         if: >-
           ! github.event.pull_request.head.repo.fork
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Setup cluster
-        uses: Alfresco/alfresco-build-tools/.github/actions/setup-kind@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/setup-kind@v9.3.1
         with:
           ingress-nginx-ref: controller-v1.12.1
           import-docker-credentials-secret-name: ${{ env.REGISTRY_SECRET_NAME }}

diff --git a/.github/workflows/helm-enterprise.yml b/.github/workflows/helm-enterprise.yml
@@ -72,20 +72,20 @@ jobs:
           version: "3.14.3"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to Quay.io
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_PASSWORD }}
 
       - name: Setup cluster
-        uses: Alfresco/alfresco-build-tools/.github/actions/setup-kind@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/setup-kind@v9.3.1
         with:
           ingress-nginx-ref: controller-v1.12.1
           metrics: "true"
@@ -122,21 +122,21 @@ jobs:
           ${{ steps.configurable-extra-values.outputs.helm_install_params }}
 
       - name: Wait for deployments to be ready
-        uses: Alfresco/alfresco-build-tools/.github/actions/kubectl-wait@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/kubectl-wait@v9.3.1
         with:
           wait-resource: "deployments"
           wait-condition: "Available"
 
       - name: Wait for statefulsets to be ready
-        uses: Alfresco/alfresco-build-tools/.github/actions/kubectl-wait@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/kubectl-wait@v9.3.1
         with:
           wait-resource: "sts"
           wait-for-what: "jsonpath"
           wait-condition: "'{.status.readyReplicas}'=1"
 
       - name: Wait for jobs to be completed
         if: matrix.values != '7.4.N_values.yaml'
-        uses: Alfresco/alfresco-build-tools/.github/actions/kubectl-wait@v9.0.1
+        uses: Alfresco/alfresco-build-tools/.github/actions/kubectl-wait@v9.3.1
         with:
           wait-resource: "jobs"
           wait-condition: "complete"

diff --git a/.github/workflows/helm-release.yml b/.github/workflows/helm-release.yml
@@ -20,7 +20,7 @@ jobs:
 
       - name: Publish chart
         uses: >-
-          Alfresco/alfresco-build-tools/.github/actions/dbp-charts/publish-chart@v9.0.1
+          Alfresco/alfresco-build-tools/.github/actions/dbp-charts/publish-chart@v9.3.1
         with:
           chart_name: alfresco-content-services
           github_token: ${{ secrets.BOT_GITHUB_TOKEN }}

diff --git a/.github/workflows/helm-static-checks.yml b/.github/workflows/helm-static-checks.yml
@@ -40,11 +40,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - uses: >-
-          Alfresco/alfresco-build-tools/.github/actions/helm-build-chart@v9.0.1
+          Alfresco/alfresco-build-tools/.github/actions/helm-build-chart@v9.3.1
         with:
           chart-dir: helm/${{ matrix.charts.name }}
       - uses: >-
-          Alfresco/alfresco-build-tools/.github/actions/helm-plugin@v9.0.1
+          Alfresco/alfresco-build-tools/.github/actions/helm-plugin@v9.3.1
         with:
           plugin_url: https://github.com/helm-unittest/helm-unittest
           plugin_version: v1.0.0
@@ -64,11 +64,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - uses: >-
-          Alfresco/alfresco-build-tools/.github/actions/helm-build-chart@v9.0.1
+          Alfresco/alfresco-build-tools/.github/actions/helm-build-chart@v9.3.1
         with:
           chart-dir: helm/${{ matrix.charts.name }}
       - uses: >-
-          Alfresco/alfresco-build-tools/.github/actions/helm-template-yamllint@v9.0.1
+          Alfresco/alfresco-build-tools/.github/actions/helm-template-yamllint@v9.3.1
         with:
           chart-dir: helm/${{ matrix.charts.name }}
           helm-options: >-

diff --git a/.github/workflows/kics.yml b/.github/workflows/kics.yml
@@ -36,6 +36,6 @@ jobs:
           config_path: .github/kics.yml
       - name: Upload SARIF file
         if: github.actor != 'dependabot[bot]'
-        uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
+        uses: github/codeql-action/upload-sarif@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
         with:
           sarif_file: report-dir/results.sarif
diff --git a/.github/workflows/pre-commit-compose.yml b/.github/workflows/pre-commit-compose.yml
@@ -24,4 +24,4 @@ jobs:
     name: Run pre-commit
     runs-on: ubuntu-latest
     steps:
-      - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.0.1
+      - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.3.1
diff --git a/.github/workflows/pre-commit-helm.yml b/.github/workflows/pre-commit-helm.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # 5.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-helm-docs@v9.0.1
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-helm-docs@v9.3.1
       - name: Add dependency chart repos
         run: |
           for repo in $(yq eval-all \