[dependabot]

Bumps the github-actions-dependencies group with 2 updates: github/codeql-action and EnricoMi/publish-unit-test-result-action.

Updates github/codeql-action from 4.39.1 to 4.39.3

Release notes

Sourced from github/codeql-action's releases.

v4.39.3

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action's changelog.

4.39.3 - 04 Nov 2026

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Commits

• 33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
• 24393f8 Update changelog for v4.39.3
• 064910b Merge pull request #4297 from github/mbg/update-glob
• f532ac5 Update glob to 14.0.3
• 8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
• cea289b Return different exit code when a language is not recognised
• 7287bb3 Remove exclude entry that's no longer needed
• 8eb7cdf Use normal .editorconfig pattern
• 160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
• 913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
• Additional commits viewable in compare view

Updates EnricoMi/publish-unit-test-result-action from 2.25.0 to 2.26.0

Release notes

Sourced from EnricoMi/publish-unit-test-result-action's releases.

v2.26.0

Adds the following improvements:

• Add powershell variant for Windows (EnricoMi/publish-unit-test-result-action#636)
• Releases pin Docker image with digest (EnricoMi/publish-unit-test-result-action#820, EnricoMi/publish-unit-test-result-action#824)
• Allow action failure on fork PRs with job summaries disabled (EnricoMi/publish-unit-test-result-action#813)
• Upgrade Python dependencies (EnricoMi/publish-unit-test-result-action#804, EnricoMi/publish-unit-test-result-action#806)
• CI improvements (EnricoMi/publish-unit-test-result-action#808, EnricoMi/publish-unit-test-result-action#809, EnricoMi/publish-unit-test-result-action#821, EnricoMi/publish-unit-test-result-action#823)

Full Changelog: EnricoMi/publish-unit-test-result-action@v2.25.0...v2.26.0

Commits

• da5b7be Releasing v2.26.0 (#825)
• df6b708 Building v2.26.0 Docker image
• 270ebdb Upgrade GitHub actions (#823)
• 9d381f4 Pin current Docker image (#824)
• d550e52 Pin Docker image with digest (#820)
• 800620c CI: Remove macOS 14, add Python 3.15 for ubuntu-26.04 and ubuntu-26.04-arm (#...
• c3032be Add powershell variant for Windows (#636)
• 3ff51cb Enforce action failure on fork PRs with job summaries disabled (#813)
• a977c20 Add Python 3.15 support (#809)
• 0ad6be0 Upgrade python dependencies (#806)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/EnricoMi/publish-unit-test-result-action	2.26.0	🟢 6	Details Check Score Reason Code-Review ⚠️ 2 Found 6/24 approved changesets -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 21 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST 🟢 9 SAST tool detected but not run on all commits

Scanned Files

• .github/workflows/pr-validation.yml

[github-actions]

Test Results

    12 files      12 suites   12m 53s ⏱️
 4 197 tests  4 197 ✅ 0 💤 0 ❌
13 043 runs  13 043 ✅ 0 💤 0 ❌

Results for commit c96705c.

[github-actions]

🔍 PR Validation Results

Version: ``

✅ Validation Steps

• Build solution
• Run tests
• Build documentation
• Dry-run NuGet packaging

📊 Artifacts

Dry-run artifacts have been uploaded and will be available for 7 days.

---

This comment was automatically generated by the PR validation workflow.

[github-actions]

Code Coverage

Summary
  Generated on: 11/09/2026 - 12:19:47
  Coverage date: 11/09/2026 - 12:17:53 - 11/09/2026 - 12:19:35
  Parser: MultiReport (8x Cobertura)
  Assemblies: 5
  Classes: 1817
  Files: 611
  Line coverage: 97.4%
  Covered lines: 48648
  Uncovered lines: 1278
  Coverable lines: 49926
  Total lines: 105800
  Branch coverage: 84.3% (15263 of 18095)
  Covered branches: 15263
  Total branches: 18095
  Method coverage: 97.3% (9510 of 9772)
  Full method coverage: 91.7% (8961 of 9772)
  Covered methods: 9510
  Fully covered methods: 8961
  Total methods: 9772

PatternKit.Core                                                                                                     96.2%
  PatternKit.Application.ActivityTracking.ActivityGateState                                                          100%
  PatternKit.Application.ActivityTracking.ActivityLease                                                              100%
  PatternKit.Application.ActivityTracking.ActivityRecord                                                             100%
  PatternKit.Application.ActivityTracking.ActivityTracker                                                            100%
  PatternKit.Application.Aggregates.AggregateCommandHandler<T1, T2, T3>                                              100%
  PatternKit.Application.Aggregates.AggregateCommandResult<T>                                                        100%
  PatternKit.Application.Aggregates.AggregateRoot<T1, T2>                                                            100%
  PatternKit.Application.AntiCorruption.AntiCorruptionLayer<T1, T2>                                                 90.4%
  PatternKit.Application.AntiCorruption.AntiCorruptionResult<T>                                                      100%
  PatternKit.Application.AuditLog.AuditLogAppendResult<T>                                                           85.7%
  PatternKit.Application.AuditLog.InMemoryAuditLog<T1, T2>                                                          95.4%
  PatternKit.Application.BoundedContexts.BoundedContextAdapter                                                       100%
  PatternKit.Application.BoundedContexts.BoundedContextCapability                                                   83.3%
  PatternKit.Application.BoundedContexts.BoundedContextDescriptor                                                   95.4%
  PatternKit.Application.CompensatingTransactions.CompensatingTransaction<T>                                        96.9%
  PatternKit.Application.CompensatingTransactions.CompensatingTransactionExecution<T>                                100%
  PatternKit.Application.CompensatingTransactions.CompensatingTransactionRecord                                      100%
  PatternKit.Application.CompensatingTransactions.CompensatingTransactionStep<T>                                     100%
  PatternKit.Application.CompensatingTransactions.CompensatingTransactionStepBuilder<T>                              100%
  PatternKit.Application.ContextMaps.ContextMapDescriptor                                                           96.8%
  PatternKit.Application.ContextMaps.ContextMapRelationship                                                          100%
  PatternKit.Application.DataMapping.DataMapper<T1, T2>                                                             94.6%
  PatternKit.Application.DataMapping.DataMapperError                                                                  90%
  PatternKit.Application.DataMapping.DataMapperResult<T>                                                            84.6%
  PatternKit.Application.DomainEvents.DomainEventDispatcher<T>                                                      95.4%
  PatternKit.Application.DomainEvents.DomainEventDispatchResult                                                      100%
  PatternKit.Application.DomainServices.DomainServiceOperation<T1, T2>                                               100%
  PatternKit.Application.DomainServices.DomainServiceRegistry<T1, T2>                                                100%
  PatternKit.Application.EventSourcing.EventStoreAppendResult                                                        100%
  PatternKit.Application.EventSourcing.InMemoryEventStore<T1, T2>                                                   97.9%
  PatternKit.Application.EventSourcing.StoredEvent<T1, T2>                                                            80%
  PatternKit.Application.EventualConsistency.EventualConsistencyEvaluation<T>                                       92.3%
  PatternKit.Application.EventualConsistency.EventualConsistencyMonitor<T>                                          97.2%
  PatternKit.Application.EventualConsistency.EventualConsistencyMonitorState<T>                                      100%
  PatternKit.Application.EventualConsistency.EventualConsistencyWatermarks<T>                                       96.7%
  PatternKit.Application.FeatureToggles.FeatureToggleDecision                                                       87.5%
  PatternKit.Application.FeatureToggles.FeatureToggleRule<T>                                                         100%
  PatternKit.Application.FeatureToggles.FeatureToggleSet<T>                                                         96.9%

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.44%. Comparing base (0e46d38) to head (c96705c).

Additional details and impacted files

@@            Coverage Diff            @@
##             main     #548     +/-   ##
=========================================
  Coverage   97.44%   97.44%             
=========================================
  Files         611      611             
  Lines       49926    49926             
  Branches     3114       34   -3080     
=========================================
  Hits        48649    48649             
  Misses       1277     1277             

Flag	Coverage Δ
unittests	97.44% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.