Skip to content

build(deps): bump gradle/actions/wrapper-validation from 6.4.0 to 6.4.1 - #620

Merged
sir-gon merged 1 commit into
mainfrom
dependabot/github_actions/gradle/actions/wrapper-validation-6.4.1
Nov 2, 2026
Merged

sir-gon merged 1 commit into
mainfrom
dependabot/github_actions/gradle/actions/wrapper-validation-6.4.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps gradle/actions/wrapper-validation from 6.4.0 to 6.4.1.

Release notes

Sourced from gradle/actions/wrapper-validation's releases.

v6.4.1

Security fix

This release fixes a security vulnerability in the dependency-submission action: GHSA-chpw-2mqm-95cc. All users should upgrade.

What's Changed

Full Changelog: gradle/actions@v6.4.0...v6.4.1

Commits
  • 8da46b5 [bot] Update dist directory
  • dcf6f72 Merge commit from fork
  • bf74269 Update to latest Dependency Graph plugin (#1106)
  • 65a6ba9 [bot] Update dist directory
  • 35eba4f Combined dependency updates (#1105)
  • 1cff18a Update known wrapper checksums (#1075)
  • 399f0d3 Update known wrapper checksums
  • ecf8cf2 Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0 (#1080)
  • d740e82 Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0
  • f9f39a9 Bump references to Develocity Gradle plugin from 4.5.0 to 4.5.1 (#1072)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [gradle/actions/wrapper-validation](https://github.com/gradle/actions) from 6.4.0 to 6.4.1.
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@3f5f9ad...8da46b5)

---
updated-dependencies:
- dependency-name: gradle/actions/wrapper-validation
  dependency-version: 6.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 2, 2026
@fossabot

fossabot Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

✓ Safe to upgrade

I recommend merging this upgrade because it is a routine patch release that remediates a High severity security vulnerability (in the dependency-submission action bundled within the same gradle/actions release), making it a security-positive change with no breaking modifications. The action is actively referenced in four CI workflow files, all of which validate the Gradle wrapper as part of standard Java build pipelines. The patch introduces no functional changes to the wrapper-validation step itself and carries no compatibility concerns.

What we checked

  • Workflow uses gradle/actions/wrapper-validation pinned to a commit SHA (v6.4.1) as a Gradle wrapper validation step, confirming active usage in the main test pipeline. [1]
  • Workflow uses gradle/actions/wrapper-validation pinned to a commit SHA (v6.4.1) as a Gradle wrapper validation step in the lint/checkstyle pipeline. [2]
  • Workflow uses gradle/actions/wrapper-validation pinned to a commit SHA (v6.4.1) in the coverage reporting pipeline. [3]
  • Workflow uses gradle/actions/wrapper-validation pinned to a commit SHA (v6.4.1) in the HTML coverage report generation pipeline. [4]
  • The v6.4.1 release remediates a High severity security vulnerability in the dependency-submission action (bundled in the same gradle/actions release package). The release also adds Gradle version support status reporting in job summaries, updated known wrapper checksums, and dependency graph plugin improvements — all non-breaking enhancements. [5]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

View 2 more usages

Changes

gradle/actions/wrapper-validation was updated to patch a security vulnerability in the dependency-submission action, which requires an upgrade. The update also includes combined dependency updates and a refresh of the Dependency Graph plugin.

References (5)

[1]: Workflow uses gradle/actions/wrapper-validation pinned to a commit SHA (v6.4.1) as a Gradle wrapper validation step, confirming active usage in the main test pipeline.

uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c

[2]: Workflow uses gradle/actions/wrapper-validation pinned to a commit SHA (v6.4.1) as a Gradle wrapper validation step in the lint/checkstyle pipeline.

uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c

[3]: Workflow uses gradle/actions/wrapper-validation pinned to a commit SHA (v6.4.1) in the coverage reporting pipeline.

uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c

[4]: Workflow uses gradle/actions/wrapper-validation pinned to a commit SHA (v6.4.1) in the HTML coverage report generation pipeline.

uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c

[5]: The v6.4.1 release remediates a High severity security vulnerability in the dependency-submission action (bundled in the same gradle/actions release package). The release also adds Gradle version support status reporting in job summaries, updated known wrapper checksums, and dependency graph plugin improvements — all non-breaking enhancements. (source link)


fossabot analyzed this PR using dependency research and AI. View this analysis on the web

@fossabot

fossabot Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

fossabot is Thinking

@fossabot

fossabot Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

fossabot is Thinking

@fossabot

fossabot Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

No Issues

No application code changes were detected to scan. The PR contains only configuration files, documentation, or other non-code files.


fossabot analyzed this PR using SAST security analysis and AI (changed files only).

@codecov

codecov Bot commented Nov 2, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3f947a6) to head (8e005d1).

Additional details and impacted files
@@             Coverage Diff             @@
##                main      #620   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       434       434           
===========================================
  Files             76        76           
  Lines           1383      1383           
  Branches         210       210           
===========================================
  Hits            1383      1383           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@sonarqubecloud

sonarqubecloud Bot commented Nov 2, 2026

Copy link
Copy Markdown

@sir-gon
sir-gon merged commit f9c07ca into main Nov 2, 2026
49 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/gradle/actions/wrapper-validation-6.4.1 branch November 2, 2026 01:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant