build(deps): bump NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 to 1e32920e80393d07318c611273ffba0fa7859a35

[dependabot]

Bumps NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 to 1e32920e80393d07318c611273ffba0fa7859a35.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Bump urllib3 to 2.8.0 in requirements-qt.txt (recompiled via uv pip compile --upgrade-package urllib3): the osv-scan runtime fixture flagged PYSEC-2026-4176 and PYSEC-2026-4177 on the pinned 2.7.0.
• Fix the dependabot-catalog-convergence update-branch guard. A bound pull request already current with the base made the API answer no new commits, which matched neither the success pattern nor a real error — the job exited before converging the catalog and left dependabot bumps red on tool-registry/catalog.

[0.1.29] - 2026-09-28

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

[0.1.28] - 2026-09-28

• Seven product facts re-verified after the 0.1.27 preflight stop. The product-facts-calendar release gate correctly refused tag 0.1.27: appveyor-public, semaphore-cloud-free, semaphore-community, azure-pipelines-private, bitbucket-free, buildkite-personal and ubicloud-free had all passed their expires_after. Each was re-read against its source_urls on 2026-09-28 and carries a staggered new expires_after. Three records needed correction, not just a date bump: Buildkite's plan is now named Free with 2,000 Linux vCPU minutes/month (was Personal/500), up to 10 concurrent jobs (was 3), up to 5 users (was 1) and 30-day retention (was 90); Semaphore's community edition moved from /community (404) to /open-source and is branded Semaphore Open Source; Ubicloud's credit statement was reconfirmed. No GitHub release exists for tag 0.1.27 — publication was stopped before the publish job.

[0.1.27] - 2026-09-28

• rust-supply-chain tool defaults refreshed. cargo_audit_version now defaults to 0.22.2 and cargo_machete_version to 0.9.2, the current upstream releases. Both remain caller-overridable inputs; only the default moved.

... (truncated)

Commits

• 1e32920 Merge pull request #157 from NDDev-OpenNetwork/fix/product-facts-calendar
• cb1c282 fix(catalog): re-verify five expired vendor free-tier facts
• b02e939 Merge pull request #152 from NDDev-OpenNetwork/fix/urllib3-qt-cve
• 0d3295f fix(ci): refresh qt lock sha256 for the regenerated lockfile
• 6b35da3 fix(deps): bump urllib3 to 2.8.0 in requirements-qt
• d075fa8 Merge pull request #150 from NDDev-OpenNetwork/fix/validate-module-venv-realpath
• 81a2b63 fix(scripts): resolve the interpreter before building .venv
• 69a9779 Merge pull request #149 from NDDev-OpenNetwork/fix/convergence-update-branch-...
• 3df8966 Merge pull request #145 from NDDev-OpenNetwork/dependabot/github_actions/gith...
• 37f1cfd fix(ci): treat an up-to-date dependabot branch as update success
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.