[sgtoj]

Summary

This replaces the open Dependabot PRs and brings every pinned dependency up to date. It holds back releases younger than 5 days, unless the release fixes a known vulnerability, and makes Dependabot follow the same rule from now on.

Open Dependabot PRs

#12 already moved main past every open Dependabot PR, so nothing in them is left to apply. They can be closed.

PR	Proposed	On main
#4	ncipollo/release-action 1.21.0	1.21.0
#8	actions/checkout 7.0.0	7.0.1
#9	github.com/cockroachdb/errors 1.14.0	removed
#10	actions/setup-go 6.5.0	7.0.0
#11	github.com/go-chi/chi/v5 5.3.1	5.5.0

Updates

Dependency	From	To	Released
amannn/action-semantic-pull-request	6.1.1	6.1.2	2026-11-05
curlimages/curl, in the compose demo	8.12.1	8.23.0	2026-10-28
mcr.microsoft.com/devcontainers/base	bookworm (Debian 12)	trixie (Debian 13)	Debian 13 is the current stable release

The dev container's docker-outside-of-docker feature now sets "moby": false. Its default installs Moby, which fails on trixie because Debian 13 doesn't package moby-cli. With the option off, it installs Docker CE's CLI and Compose plugin instead.

action-semantic-pull-request 6.1.2 is 4 days old. It qualifies for the exception because it fixes known vulnerabilities in the code the action bundles. 6.1.1 bundles @fastify/busboy 2.1.1, with a CRLF injection (GHSA-gxm5-99cw-xjw9) and a high-severity DoS (GHSA-x8mw-p69m-v3mx), which 6.1.2 drops. It also bundles undici 5.29.0, which 6.1.2 updates to 6.24.1; that fixes request smuggling (GHSA-2mjp-6q6p-2qxm), CRLF injection (GHSA-4992-7rv2-5pvq), and three DoS advisories. undici 6.24.1 still has open advisories, and no release of the action bundles a newer undici yet. The action only calls the GitHub API with the workflow's read-only token, so neither version is practically exploitable here. The release turns 5 days old on November 10, so this commit can be dropped if you'd rather wait.

Already current

• Go 1.27.3, chi v5.5.0, golangci-lint v2.15.0, and govulncheck v1.9.0.
• actions/checkout 7.0.1, actions/setup-go 7.0.0, docker/setup-buildx-action 4.4.1, mathieudutour/github-tag-action 7.0.0, and ncipollo/release-action 1.21.0.
• The Dockerfile's golang:1.27.3-alpine and alpine:3.24 tags float, and already resolve to Alpine 3.24.4. It's 4 days old but a security release (apk-tools 3.0.9 fixes a crash on malformed data, among other fixes), so it also meets the exception and needs no change.

Dependabot

• Every ecosystem gets cooldown: default-days: 5, so version updates wait until a release is 5 days old. Security updates aren't subject to cooldown, so vulnerability fixes still arrive right away. Without the setting, Dependabot proposed releases within hours (build(deps): bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.1 #11 opened 11 hours after chi 5.3.1 was released).
• A docker-compose ecosystem now watches docker-compose.yml. Dependabot only read the Dockerfile before, which is how the curl image stayed on a release from February 2025.
• CONTRIBUTING describes the rule, so manual updates follow it too.

Testing

• dependabot.yaml validates against the SchemaStore schema, and actionlint v1.7.12 is clean.
• make demo sends both example payloads through curl 8.23.0, and all 7 reports are accepted. The built image runs Alpine 3.24.4 with apk-tools 3.0.9.
• The dev container's features install on devcontainers/base:trixie (installed by hand, since the devcontainer CLI isn't set up here). The result has Go 1.27.3, golangci-lint 2.15.0, gopls 0.24.0, and Docker CLI 29.9.3 with Compose 5.7.0, which reaches the host daemon.
• No Go code or module changes, so CI's lint, test, and vuln jobs run against the same code as v2.0.0.

The commits are ci and chore, so merging releases v2.0.1.

🤖 Generated with Claude Code