From b8b2ae23785a720a87c8fa4a43f090fbdfcf7120 Mon Sep 17 00:00:00 2001 From: Nat Dean-Lewis Date: Tue, 28 Jul 2026 17:33:01 +0100 Subject: [PATCH 1/3] feat: extract audit deps to isolated file to remove dependency --- .github/workflows/audit_dependencies.yml | 34 ++++++++++++++++++++++++ .github/workflows/run_tests.yml | 17 ------------ 2 files changed, 34 insertions(+), 17 deletions(-) create mode 100644 .github/workflows/audit_dependencies.yml diff --git a/.github/workflows/audit_dependencies.yml b/.github/workflows/audit_dependencies.yml new file mode 100644 index 000000000..9d5234603 --- /dev/null +++ b/.github/workflows/audit_dependencies.yml @@ -0,0 +1,34 @@ +name: Audit dependencies + +on: + pull_request: + types: + - opened + - synchronize + push: + branches: + - main + merge_group: + workflow_dispatch: + +defaults: + run: + shell: bash + +jobs: + audit: + name: Audit dependencies + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + + - name: Audit + run: | + bundle exec bundler-audit diff --git a/.github/workflows/run_tests.yml b/.github/workflows/run_tests.yml index b4d4f697d..a794a02c9 100644 --- a/.github/workflows/run_tests.yml +++ b/.github/workflows/run_tests.yml @@ -399,20 +399,3 @@ jobs: - name: Lint run: | bundle exec rake lint - - audit: - name: Audit dependencies - runs-on: ubuntu-latest - - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Set up Ruby - uses: ruby/setup-ruby@v1 - with: - bundler-cache: true - - - name: Audit - run: | - bundle exec bundler-audit From 6ef4c1ac9fc537af724d8da4913acc93e6974247 Mon Sep 17 00:00:00 2001 From: Nat Dean-Lewis <94526761+natdeanlewissoftwire@users.noreply.github.com> Date: Tue, 28 Jul 2026 17:34:52 +0100 Subject: [PATCH 2/3] Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .github/workflows/audit_dependencies.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/audit_dependencies.yml b/.github/workflows/audit_dependencies.yml index 9d5234603..799015719 100644 --- a/.github/workflows/audit_dependencies.yml +++ b/.github/workflows/audit_dependencies.yml @@ -11,6 +11,9 @@ on: merge_group: workflow_dispatch: +permissions: + contents: read + defaults: run: shell: bash From 9e33ec1a53f59a16889dcd982ea5ae57b31856db Mon Sep 17 00:00:00 2001 From: Nat Dean-Lewis Date: Thu, 30 Jul 2026 17:27:46 +0100 Subject: [PATCH 3/3] feat: update activestorage --- Gemfile.lock | 112 +++++++++++++++++++++++++-------------------------- 1 file changed, 56 insertions(+), 56 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 4759f6ec7..4c3b075e2 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,29 +1,29 @@ GEM remote: https://rubygems.org/ specs: - actioncable (7.2.3.1) - actionpack (= 7.2.3.1) - activesupport (= 7.2.3.1) + actioncable (7.2.3.2) + actionpack (= 7.2.3.2) + activesupport (= 7.2.3.2) nio4r (~> 2.0) websocket-driver (>= 0.6.1) zeitwerk (~> 2.6) - actionmailbox (7.2.3.1) - actionpack (= 7.2.3.1) - activejob (= 7.2.3.1) - activerecord (= 7.2.3.1) - activestorage (= 7.2.3.1) - activesupport (= 7.2.3.1) + actionmailbox (7.2.3.2) + actionpack (= 7.2.3.2) + activejob (= 7.2.3.2) + activerecord (= 7.2.3.2) + activestorage (= 7.2.3.2) + activesupport (= 7.2.3.2) mail (>= 2.8.0) - actionmailer (7.2.3.1) - actionpack (= 7.2.3.1) - actionview (= 7.2.3.1) - activejob (= 7.2.3.1) - activesupport (= 7.2.3.1) + actionmailer (7.2.3.2) + actionpack (= 7.2.3.2) + actionview (= 7.2.3.2) + activejob (= 7.2.3.2) + activesupport (= 7.2.3.2) mail (>= 2.8.0) rails-dom-testing (~> 2.2) - actionpack (7.2.3.1) - actionview (= 7.2.3.1) - activesupport (= 7.2.3.1) + actionpack (7.2.3.2) + actionview (= 7.2.3.2) + activesupport (= 7.2.3.2) cgi nokogiri (>= 1.8.5) racc @@ -33,40 +33,40 @@ GEM rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) useragent (~> 0.16) - actiontext (7.2.3.1) - actionpack (= 7.2.3.1) - activerecord (= 7.2.3.1) - activestorage (= 7.2.3.1) - activesupport (= 7.2.3.1) + actiontext (7.2.3.2) + actionpack (= 7.2.3.2) + activerecord (= 7.2.3.2) + activestorage (= 7.2.3.2) + activesupport (= 7.2.3.2) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.2.3.1) - activesupport (= 7.2.3.1) + actionview (7.2.3.2) + activesupport (= 7.2.3.2) builder (~> 3.1) cgi erubi (~> 1.11) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - activejob (7.2.3.1) - activesupport (= 7.2.3.1) + activejob (7.2.3.2) + activesupport (= 7.2.3.2) globalid (>= 0.3.6) - activemodel (7.2.3.1) - activesupport (= 7.2.3.1) + activemodel (7.2.3.2) + activesupport (= 7.2.3.2) activemodel-serializers-xml (1.0.3) activemodel (>= 5.0.0.a) activesupport (>= 5.0.0.a) builder (~> 3.1) - activerecord (7.2.3.1) - activemodel (= 7.2.3.1) - activesupport (= 7.2.3.1) + activerecord (7.2.3.2) + activemodel (= 7.2.3.2) + activesupport (= 7.2.3.2) timeout (>= 0.4.0) - activestorage (7.2.3.1) - actionpack (= 7.2.3.1) - activejob (= 7.2.3.1) - activerecord (= 7.2.3.1) - activesupport (= 7.2.3.1) + activestorage (7.2.3.2) + actionpack (= 7.2.3.2) + activejob (= 7.2.3.2) + activerecord (= 7.2.3.2) + activesupport (= 7.2.3.2) marcel (~> 1.0) - activesupport (7.2.3.1) + activesupport (7.2.3.2) base64 benchmark (>= 0.3) bigdecimal @@ -154,7 +154,7 @@ GEM coderay (1.1.3) coercible (1.0.0) descendants_tracker (~> 0.0.1) - concurrent-ruby (1.3.7) + concurrent-ruby (1.3.8) connection_pool (2.5.5) crack (1.0.0) bigdecimal @@ -223,7 +223,7 @@ GEM fugit (1.12.2) et-orbi (~> 1.4) raabro (~> 1.4) - globalid (1.3.0) + globalid (1.4.0) activesupport (>= 6.1) govuk-components (6.4.0) html-attributes-utils (~> 1.0.0, >= 1.0.0) @@ -286,7 +286,7 @@ GEM net-imap net-pop net-smtp - marcel (1.0.4) + marcel (1.2.1) matrix (0.4.2) method_source (1.1.0) mini_mime (1.1.5) @@ -373,20 +373,20 @@ GEM rack (>= 1.3) rackup (2.3.1) rack (>= 3) - rails (7.2.3.1) - actioncable (= 7.2.3.1) - actionmailbox (= 7.2.3.1) - actionmailer (= 7.2.3.1) - actionpack (= 7.2.3.1) - actiontext (= 7.2.3.1) - actionview (= 7.2.3.1) - activejob (= 7.2.3.1) - activemodel (= 7.2.3.1) - activerecord (= 7.2.3.1) - activestorage (= 7.2.3.1) - activesupport (= 7.2.3.1) + rails (7.2.3.2) + actioncable (= 7.2.3.2) + actionmailbox (= 7.2.3.2) + actionmailer (= 7.2.3.2) + actionpack (= 7.2.3.2) + actiontext (= 7.2.3.2) + actionview (= 7.2.3.2) + activejob (= 7.2.3.2) + activemodel (= 7.2.3.2) + activerecord (= 7.2.3.2) + activestorage (= 7.2.3.2) + activesupport (= 7.2.3.2) bundler (>= 1.15.0) - railties (= 7.2.3.1) + railties (= 7.2.3.2) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest @@ -401,9 +401,9 @@ GEM nested_form (~> 0.3) rails (>= 6.0, < 9) turbo-rails (>= 1.0, < 3) - railties (7.2.3.1) - actionpack (= 7.2.3.1) - activesupport (= 7.2.3.1) + railties (7.2.3.2) + actionpack (= 7.2.3.2) + activesupport (= 7.2.3.2) cgi irb (~> 1.13) rackup (>= 1.0.0)