chore(deps): bump mcp from 1.26.0 to 1.28.1 in the uv group across 1 directory by dependabot[bot] · Pull Request #173 · awslabs/stickler

dependabot · 2026-07-16T20:54:13Z

Bumps the uv group with 1 update in the / directory: mcp.

Updates mcp from 1.26.0 to 1.28.1

Release notes

v1.28.0

Deprecations

Two API surfaces now emit DeprecationWarning ahead of their removal in v2. Nothing is removed in 1.x, and the warnings fire only when the deprecated API is called - importing the modules stays silent.

WebSocket transport - mcp.client.websocket.websocket_client and mcp.server.websocket.websocket_servermodelcontextprotocol/typescript-sdk#1783

Experimental tasks API - ClientSession.experimental, Server.experimental, ServerSession.experimental, and the experimental_task_handlers= kwarg on ClientSession. Tasks (SEP-1686) were removed from the MCP specification and are expected to return as a separate MCP extension.

If your test suite runs with filterwarnings = ["error"] and exercises these paths, add a scoped ignore such as ignore:The experimental tasks API is deprecated:DeprecationWarning or ignore:The WebSocket .* transport is deprecated:DeprecationWarning.

See #2828 for full details.

What's Changed

[v1.x] Support Python 3.14 by @maxisbey in modelcontextprotocol/python-sdk#2769

fix: omit null optional fields from task result payloads by @liuzemei in modelcontextprotocol/python-sdk#2809

[v1.x] Deprecate the WebSocket transport and the experimental tasks entry points by @maxisbey in modelcontextprotocol/python-sdk#2828

[v1.x] Add a v2 status banner to the README by @maxisbey in modelcontextprotocol/python-sdk#2835

[v1.x] Deflake the child process cleanup tests by @maxisbey in modelcontextprotocol/python-sdk#2839

New Contributors

@liuzemei made their first contribution in modelcontextprotocol/python-sdk#2809

Full Changelog: modelcontextprotocol/python-sdk@v1.27.2...v1.28.0

v1.27.2

What's Changed

[v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact by @maxisbey in modelcontextprotocol/python-sdk#2635

[v1.x] Add subject and claims to AccessToken by @maxisbey in modelcontextprotocol/python-sdk#2690

[v1.x] Bind transport sessions to the authenticated principal by @maxisbey in modelcontextprotocol/python-sdk#2719

[v1.x] Scope experimental tasks to the session that created them by @maxisbey in modelcontextprotocol/python-sdk#2720

Full Changelog: modelcontextprotocol/python-sdk@v1.27.1...v1.27.2

v1.27.1

What's Changed

[v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2.13 compat) by @maxisbey in modelcontextprotocol/python-sdk#2435

[v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by @felixweinberger in modelcontextprotocol/python-sdk#2405

[v1.x] build: restrict httpx to <1.0.0 by @maxisbey in modelcontextprotocol/python-sdk#2559

[v1.x] refactor: import SSEError from httpx_sse public API by @maxisbey in modelcontextprotocol/python-sdk#2561

Full Changelog: modelcontextprotocol/python-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

fix: remove unused requests dependency from simple-chatbot example by @maxisbey in modelcontextprotocol/python-sdk#1959

ci: backport conformance tests from main to v1.x by @felixweinberger in modelcontextprotocol/python-sdk#2068

... (truncated)

Commits

777b8d0 [v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...
4720467 [v1.x] Set Development Status classifier to Production/Stable (#2976)
6df3d73 [v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...
32d3290 [v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...
0dca751 [v1.x] Deflake the child process cleanup tests (#2839)
52258a9 [v1.x] Add a v2 status banner to the README (#2835)
b8f4917 [v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...
2309e5e fix: omit null optional fields from task result payloads (#2809)
494eb11 [v1.x] Support Python 3.14 (#2769)
6213787 [v1.x] Scope experimental tasks to the session that created them (#2720)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the uv group with 1 update in the / directory: [mcp](https://github.com/modelcontextprotocol/python-sdk). Updates `mcp` from 1.26.0 to 1.28.1 - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.26.0...v1.28.1) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.28.1 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-16T21:36:46Z

Security Scan Results

ASH Security Scan Report

Report generated: 2026-07-16T21:05:45+00:00
Time since scan: 2 minutes

Scan Metadata

Project: ASH
Scan executed: 2026-07-16T21:03:24+00:00
ASH version: 3.1.2

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

Severity levels:
- Suppressed (S): Findings that have been explicitly suppressed and don't affect scanner status
- Critical (C): Highest severity findings that require immediate attention
- High (H): Serious findings that should be addressed soon
- Medium (M): Moderate risk findings
- Low (L): Lower risk findings
- Info (I): Informational findings with minimal risk
Duration (Time): Time taken by the scanner to complete its execution
Actionable: Number of findings at or above the threshold severity level that require attention
Result:
- PASSED = No findings at or above threshold
- FAILED = Findings at or above threshold
- MISSING = Required dependencies not available
- SKIPPED = Scanner explicitly disabled
- ERROR = Scanner execution error
Threshold: The minimum severity level that will cause a scanner to fail
- Thresholds: ALL, LOW, MEDIUM, HIGH, CRITICAL
- Source: Values in parentheses indicate where the threshold is set:
  - global (global_settings section in the ASH_CONFIG used)
  - config (scanner config section in the ASH_CONFIG used)
  - scanner (default configuration in the plugin, if explicitly set)
Statistics calculation:
- All statistics are calculated from the final aggregated SARIF report
- Suppressed findings are counted separately and do not contribute to actionable findings
- Scanner status is determined by comparing actionable findings to the threshold

Scanner	Critical	Low	Actionable	Result	Threshold
bandit	0	4146	0	PASSED	MEDIUM (global)
cdk-nag	0	0	0	PASSED	MEDIUM (global)
cfn-nag	0	0	0	MISSING	MEDIUM (global)
checkov	0	0	0	PASSED	MEDIUM (global)
detect-secrets	0	0	0	PASSED	MEDIUM (global)
grype	0	0	0	MISSING	MEDIUM (global)
npm-audit	0	0	0	PASSED	MEDIUM (global)
opengrep	0	0	0	MISSING	MEDIUM (global)
semgrep	19	0	19	FAILED	MEDIUM (global)
syft	0	0	0	MISSING	MEDIUM (global)

Top 7 Hotspots

Files with the highest number of security findings:

Finding Count	File Location
7	.github/workflows/workflow.yml
3	.github/workflows/security.yaml
2	.github/workflows/docs.yml
2	.github/workflows/lint.yaml
2	.github/workflows/run_pytest.yaml
2	.github/workflows/security-pr-comment.yaml
1	pyproject.toml

Detailed Findings

Show 19 actionable findings

Finding 1: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/docs.yml:19

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

- uses: actions/checkout@v4

Finding 2: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/docs.yml:22

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: astral-sh/setup-uv@v5

Finding 3: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/lint.yaml:16

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

- uses: actions/checkout@v4

Finding 4: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/lint.yaml:18

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: astral-sh/setup-uv@v5

Finding 5: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/run_pytest.yaml:16

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

- uses: actions/checkout@v4

Finding 6: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/run_pytest.yaml:18

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: astral-sh/setup-uv@v5

Finding 7: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/security-pr-comment.yaml:20

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: actions/download-artifact@v4

Finding 8: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/security-pr-comment.yaml:27

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: actions/github-script@v7

Finding 9: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/security.yaml:18

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

- uses: actions/checkout@v4

Finding 10: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/security.yaml:20

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: astral-sh/setup-uv@v5

Finding 11: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/security.yaml:42

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: actions/upload-artifact@v4

Finding 12: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/workflow.yml:18

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

- uses: actions/checkout@v4

Finding 13: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/workflow.yml:22

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: astral-sh/setup-uv@v5

Finding 14: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/workflow.yml:28

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: actions/upload-artifact@v4

Finding 15: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/workflow.yml:45

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: actions/download-artifact@v4

Finding 16: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/workflow.yml:50

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: pypa/gh-action-pypi-publish@release/v1

Finding 17: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/workflow.yml:64

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: actions/download-artifact@v4

Finding 18: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Severity: HIGH
Scanner: semgrep
Rule ID: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Location: .github/workflows/workflow.yml:69

Description:
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Code Snippet:

uses: pypa/gh-action-pypi-publish@release/v1

Finding 19: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown

Severity: HIGH
Scanner: semgrep
Rule ID: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown
Location: pyproject.toml:116-117

Description:
This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add exclude-newer = "7 days" under [tool.uv] to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns

Code Snippet:

[tool.uv]
default-groups = ["dev"]

Report generated by Automated Security Helper (ASH) at 2026-07-16T21:05:46+00:00

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump mcp from 1.26.0 to 1.28.1 in the uv group across 1 directory#173

chore(deps): bump mcp from 1.26.0 to 1.28.1 in the uv group across 1 directory#173
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/uv-1a1fe7bf02

dependabot Bot commented on behalf of github Jul 16, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026

Finding 1: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 2: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 3: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 4: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 5: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 6: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 7: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 8: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 9: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 10: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 11: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 12: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 13: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 14: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 15: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 16: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 17: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 18: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 19: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 16, 2026

v1.28.0

Deprecations

What's Changed

New Contributors

v1.27.2

What's Changed

v1.27.1

What's Changed

v1.27.0

What's Changed

Uh oh!

github-actions Bot commented Jul 16, 2026

Security Scan Results

ASH Security Scan Report

Scan Metadata

Summary

Scanner Results

Top 7 Hotspots

Detailed Findings

Finding 1: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 2: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 3: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 4: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 5: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 6: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 7: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 8: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 9: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 10: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 11: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 12: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 13: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 14: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 15: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 16: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 17: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 18: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Finding 19: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants