Skip to content

chore: harden GitHub Actions workflows against Zizmor findings - #1971

Merged
kevmoo merged 2 commits into
masterfrom
zizmor-fixes
Aug 18, 2026
Merged

chore: harden GitHub Actions workflows against Zizmor findings#1971
kevmoo merged 2 commits into
masterfrom
zizmor-fixes

Conversation

@kevmoo

@kevmoo kevmoo commented Aug 11, 2026

Copy link
Copy Markdown
Member
  • Pin dart-lang/ecosystem workflows to full commit SHA
  • Add top-level permissions: contents: read where missing
  • Set persist-credentials: false on actions/checkout steps
  • Add cooldown to dependabot configuration
  • Ignore dangerous-triggers for post_summaries workflow_run

@kevmoo
chore: harden GitHub Actions workflows against Zizmor findings
1e1faa8 
- Pin dart-lang/ecosystem workflows to full commit SHA
- Add top-level permissions: contents: read where missing
- Set persist-credentials: false on actions/checkout steps
- Add cooldown to dependabot configuration
- Ignore dangerous-triggers for post_summaries workflow_run
@github-actions github-actions Bot added the type-infra A repository infrastructure change or enhancement label Aug 11, 2026
@kevmoo
kevmoo requested a review from natebosch August 11, 2026 00:21
@github-actions

github-actions Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Health

License Headers ⚠️ 
// Copyright (c) 2026, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.
Files
pkgs/cupertino_http/example/example.dart
pkgs/http/example/main.dart
pkgs/http_multi_server/test/cert.dart

All source files should start with a license header.

This check can be disabled by tagging the PR with skip-license-check.

Unused Dependencies ⚠️
Package Status
cronet_http
❗ Show Issues
These packages are used outside lib/ but are not dev_dependencies:
  * flutter_test
  * http_client_conformance_tests
  * http_image_provider
  * integration_test
  * provider
  * test
These packages are only used outside lib/ and should be downgraded to dev_dependencies:
  * flutter
These packages may be unused, or you may be using assets from these packages:
  * dart_flutter_team_lints
  * yaml_edit
Failed to update packages.
cupertino_http
❗ Show Issues
These packages are used outside lib/ but are not dev_dependencies:
  * flutter
  * integration_test
These packages are only used outside lib/ and should be downgraded to dev_dependencies:
  * code_assets
  * hooks
  * logging
  * native_toolchain_c
These packages may be unused, or you may be using assets from these packages:
  * dart_flutter_team_lints
Failed to update packages.
http
❗ Show Issues
These packages may be unused, or you may be using assets from these packages:
  * dart_flutter_team_lints
  * shelf
http2 ✔️ All dependencies utilized correctly.
http_multi_server ✔️ All dependencies utilized correctly.
http_parser ✔️ All dependencies utilized correctly.
http_profile
❗ Show Issues
These packages may be unused, or you may be using assets from these packages:
  * dart_flutter_team_lints
ok_http
❗ Show Issues
These packages are used outside lib/ but are not dev_dependencies:
  * flutter_test
  * http_client_conformance_tests
  * http_image_provider
  * integration_test
  * provider
  * test
  * web_socket_conformance_tests
These packages may be unused, or you may be using assets from these packages:
  * dart_flutter_team_lints
  * plugin_platform_interface
Failed to update packages.
web_socket
❗ Show Issues
These packages may be unused, or you may be using assets from these packages:
  * dart_flutter_team_lints
web_socket_channel ✔️ All dependencies utilized correctly.

For details on how to fix these, see dependency_validator.

This check can be disabled by tagging the PR with skip-unused-dependencies-check.

Coverage ⚠️
File Coverage
pkgs/cronet_http/example/integration_test/client_profile_test.dart 💔 Not covered
pkgs/cronet_http/example/integration_test/client_test.dart 💔 Not covered
pkgs/cronet_http/example/integration_test/cronet_engine_test.dart 💔 Not covered
pkgs/cronet_http/example/lib/book.dart 💔 Not covered
pkgs/cronet_http/example/lib/main.dart 💔 Not covered
pkgs/cronet_http/lib/cronet_http.dart 💔 Not covered
pkgs/cronet_http/lib/src/cronet_client.dart 💔 Not covered
pkgs/cronet_http/lib/src/jni/jni_bindings.dart 💔 Not covered
pkgs/cupertino_http/example/example.dart 💔 Not covered
pkgs/cupertino_http/hook/build.dart 💔 Not covered
pkgs/cupertino_http/ios_test/integration_test/combined_test.dart 💔 Not covered
pkgs/cupertino_http/ios_test/lib/main.dart 💔 Not covered
pkgs/cupertino_http/lib/cupertino_http.dart 💔 Not covered
pkgs/cupertino_http/lib/src/cupertino_api.dart 💚 4 %
pkgs/cupertino_http/lib/src/cupertino_client.dart 💚 1 %
pkgs/cupertino_http/lib/src/cupertino_web_socket.dart 💔 0 % ⬇️ NaN %
pkgs/cupertino_http/lib/src/native_cupertino_bindings.dart 💚 0 %
pkgs/http/example/main.dart 💔 Not covered
pkgs/http/example/retry.dart 💔 Not covered
pkgs/http/lib/browser_client.dart 💔 Not covered
pkgs/http/lib/http.dart 💚 100 %
pkgs/http/lib/io_client.dart 💔 Not covered
pkgs/http/lib/retry.dart 💚 93 %
pkgs/http/lib/src/abortable.dart 💚 100 %
pkgs/http/lib/src/base_client.dart 💚 97 %
pkgs/http/lib/src/base_request.dart 💚 88 %
pkgs/http/lib/src/base_response.dart 💚 87 %
pkgs/http/lib/src/boundary_characters.dart 💔 Not covered
pkgs/http/lib/src/browser_client.dart 💔 Not covered
pkgs/http/lib/src/byte_stream.dart 💚 87 %
pkgs/http/lib/src/client.dart 💚 100 %
pkgs/http/lib/src/client_stub.dart 💔 Not covered
pkgs/http/lib/src/exception.dart 💚 20 %
pkgs/http/lib/src/io_client.dart 💚 89 %
pkgs/http/lib/src/io_streamed_response.dart 💚 100 %
pkgs/http/lib/src/mock_client.dart 💚 100 %
pkgs/http/lib/src/multipart_file.dart 💚 95 %
pkgs/http/lib/src/multipart_file_io.dart 💚 100 %
pkgs/http/lib/src/multipart_file_stub.dart 💔 Not covered
pkgs/http/lib/src/multipart_request.dart 💚 93 %
pkgs/http/lib/src/request.dart 💚 98 %
pkgs/http/lib/src/response.dart 💚 100 %
pkgs/http/lib/src/streamed_request.dart 💚 100 %
pkgs/http/lib/src/streamed_response.dart 💚 100 %
pkgs/http/lib/src/utils.dart 💚 96 %
pkgs/http/lib/testing.dart 💔 Not covered
pkgs/http2/example/display_headers.dart 💔 Not covered
pkgs/http2/lib/http2.dart 💔 Not covered
pkgs/http2/lib/multiprotocol_server.dart 💚 90 %
pkgs/http2/lib/src/artificial_server_socket.dart 💚 50 %
pkgs/http2/lib/src/async_utils/async_utils.dart 💚 100 %
pkgs/http2/lib/src/byte_utils.dart 💚 100 %
pkgs/http2/lib/src/connection.dart 💚 83 %
pkgs/http2/lib/src/connection_preface.dart 💚 100 %
pkgs/http2/lib/src/error_handler.dart 💚 98 %
pkgs/http2/lib/src/flowcontrol/connection_queues.dart 💚 93 %
pkgs/http2/lib/src/flowcontrol/queue_messages.dart 💚 42 %
pkgs/http2/lib/src/flowcontrol/stream_queues.dart 💚 88 %
pkgs/http2/lib/src/flowcontrol/window.dart 💚 100 %
pkgs/http2/lib/src/flowcontrol/window_handler.dart 💚 100 %
pkgs/http2/lib/src/frames/frame_defragmenter.dart 💚 100 %
pkgs/http2/lib/src/frames/frame_reader.dart 💚 90 %
pkgs/http2/lib/src/frames/frame_types.dart 💚 57 %
pkgs/http2/lib/src/frames/frame_utils.dart 💚 100 %
pkgs/http2/lib/src/frames/frame_writer.dart 💚 86 %
pkgs/http2/lib/src/frames/frames.dart 💔 Not covered
pkgs/http2/lib/src/hpack/hpack.dart 💚 95 %
pkgs/http2/lib/src/hpack/huffman.dart 💚 95 %
pkgs/http2/lib/src/hpack/huffman_table.dart 💚 100 %
pkgs/http2/lib/src/ping/ping_handler.dart 💚 100 %
pkgs/http2/lib/src/settings/settings.dart 💚 94 %
pkgs/http2/lib/src/streams/stream_handler.dart 💚 91 %
pkgs/http2/lib/src/sync_errors.dart 💚 81 %
pkgs/http2/lib/transport.dart 💚 82 %
pkgs/http2/manual_test/out_of_stream_ids_test.dart 💔 Not covered
pkgs/http_multi_server/example/main.dart 💔 Not covered
pkgs/http_multi_server/lib/http_multi_server.dart 💚 65 %
pkgs/http_multi_server/lib/src/multi_headers.dart 💚 6 %
pkgs/http_multi_server/lib/src/utils.dart 💚 80 %
pkgs/http_parser/example/example.dart 💔 Not covered
pkgs/http_parser/lib/http_parser.dart 💔 Not covered
pkgs/http_parser/lib/src/authentication_challenge.dart 💚 100 %
pkgs/http_parser/lib/src/case_insensitive_map.dart 💚 100 %
pkgs/http_parser/lib/src/chunked_coding.dart 💚 100 %
pkgs/http_parser/lib/src/chunked_coding/charcodes.dart 💔 Not covered
pkgs/http_parser/lib/src/chunked_coding/decoder.dart 💚 94 %
pkgs/http_parser/lib/src/chunked_coding/encoder.dart 💚 100 %
pkgs/http_parser/lib/src/http_date.dart 💚 100 %
pkgs/http_parser/lib/src/media_type.dart 💚 98 %
pkgs/http_parser/lib/src/scan.dart 💚 100 %
pkgs/http_parser/lib/src/utils.dart 💚 100 %
pkgs/http_profile/lib/http_profile.dart 💔 Not covered
pkgs/http_profile/lib/src/http_client_request_profile.dart 💚 98 %
pkgs/http_profile/lib/src/http_profile.dart 💔 Not covered
pkgs/http_profile/lib/src/http_profile_request_data.dart 💚 100 %
pkgs/http_profile/lib/src/http_profile_response_data.dart 💚 96 %
pkgs/http_profile/lib/src/utils.dart 💚 100 %
pkgs/ok_http/example/integration_test/certificate_test.dart 💔 Not covered
pkgs/ok_http/example/integration_test/client_configuration_test.dart 💔 Not covered
pkgs/ok_http/example/integration_test/client_profile_test.dart 💔 Not covered
pkgs/ok_http/example/integration_test/client_test.dart 💔 Not covered
pkgs/ok_http/example/integration_test/web_socket_test.dart 💔 Not covered
pkgs/ok_http/example/lib/book.dart 💔 Not covered
pkgs/ok_http/example/lib/main.dart 💔 Not covered
pkgs/ok_http/lib/ok_http.dart 💔 Not covered
pkgs/ok_http/lib/src/jni/bindings.dart 💔 Not covered
pkgs/ok_http/lib/src/ok_http_client.dart 💔 Not covered
pkgs/ok_http/lib/src/ok_http_web_socket.dart 💔 Not covered
pkgs/web_socket/example/web_socket_example.dart 💔 Not covered
pkgs/web_socket/lib/browser_web_socket.dart 💔 Not covered
pkgs/web_socket/lib/io_web_socket.dart 💔 Not covered
pkgs/web_socket/lib/src/browser_web_socket.dart 💔 Not covered
pkgs/web_socket/lib/src/connect_stub.dart 💔 Not covered
pkgs/web_socket/lib/src/fake_web_socket.dart 💚 100 %
pkgs/web_socket/lib/src/io_web_socket.dart 💚 85 %
pkgs/web_socket/lib/src/utils.dart 💚 100 %
pkgs/web_socket/lib/src/web_socket.dart 💚 68 %
pkgs/web_socket/lib/testing.dart 💔 Not covered
pkgs/web_socket/lib/web_socket.dart 💔 Not covered
pkgs/web_socket_channel/example/example.dart 💔 Not covered
pkgs/web_socket_channel/lib/adapter_web_socket_channel.dart 💚 96 %
pkgs/web_socket_channel/lib/html.dart 💔 Not covered
pkgs/web_socket_channel/lib/io.dart 💚 100 %
pkgs/web_socket_channel/lib/src/channel.dart 💚 50 %
pkgs/web_socket_channel/lib/src/exception.dart 💚 20 %
pkgs/web_socket_channel/lib/src/sink_completer.dart 💔 Not covered
pkgs/web_socket_channel/lib/status.dart 💔 Not covered
pkgs/web_socket_channel/lib/web_socket_channel.dart 💔 Not covered

This check for test coverage is informational (issues shown here will not fail the PR).

This check can be disabled by tagging the PR with skip-coverage-check.

Changelog Entry ✔️
Package Changed Files

Changes to files need to be accounted for in their respective changelogs.

This check can be disabled by tagging the PR with skip-changelog-check.

API leaks ⚠️

The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.

Package Leaked API symbol Leaking sources
http RequestCredentials browser_client.dart::BrowserClient::new::requestCredentials
browser_client.dart::RequestCredentials::omit
browser_client.dart::RequestCredentials::sameOrigin
browser_client.dart::RequestCredentials::include
browser_client.dart::RequestCredentials::values
ok_http $Call$Factory jni/bindings.dart::Call$Factory::implementIn::$impl
jni/bindings.dart::Call$Factory::implement::$impl
ok_http $Call jni/bindings.dart::Call::implementIn::$impl
jni/bindings.dart::Call::implement::$impl
ok_http $Callback jni/bindings.dart::Callback::implementIn::$impl
jni/bindings.dart::Callback::implement::$impl
ok_http $ExecutorService jni/bindings.dart::ExecutorService::implementIn::$impl
jni/bindings.dart::ExecutorService::implement::$impl
ok_http $RedirectReceivedCallback jni/bindings.dart::RedirectReceivedCallback::implementIn::$impl
jni/bindings.dart::RedirectReceivedCallback::implement::$impl
ok_http $DataCallback jni/bindings.dart::DataCallback::implementIn::$impl
jni/bindings.dart::DataCallback::implement::$impl
ok_http $WebSocket$Factory jni/bindings.dart::WebSocket$Factory::implementIn::$impl
jni/bindings.dart::WebSocket$Factory::implement::$impl
ok_http $WebSocket jni/bindings.dart::WebSocket::implementIn::$impl
jni/bindings.dart::WebSocket::implement::$impl
ok_http $WebSocketListenerProxy$WebSocketListener jni/bindings.dart::WebSocketListenerProxy$WebSocketListener::implementIn::$impl
jni/bindings.dart::WebSocketListenerProxy$WebSocketListener::implement::$impl
ok_http $PrivateKey jni/bindings.dart::PrivateKey::implementIn::$impl
jni/bindings.dart::PrivateKey::implement::$impl
ok_http $X509TrustManager jni/bindings.dart::X509TrustManager::implementIn::$impl
jni/bindings.dart::X509TrustManager::implement::$impl
ok_http $TrustManager jni/bindings.dart::TrustManager::implementIn::$impl
jni/bindings.dart::TrustManager::implement::$impl
ok_http $KeyStore$ProtectionParameter jni/bindings.dart::KeyStore$ProtectionParameter::implementIn::$impl
jni/bindings.dart::KeyStore$ProtectionParameter::implement::$impl
ok_http $KeyStore$LoadStoreParameter jni/bindings.dart::KeyStore$LoadStoreParameter::implementIn::$impl
jni/bindings.dart::KeyStore$LoadStoreParameter::implement::$impl
ok_http $KeyStore$Entry$Attribute jni/bindings.dart::KeyStore$Entry$Attribute::implementIn::$impl
jni/bindings.dart::KeyStore$Entry$Attribute::implement::$impl
ok_http $KeyStore$Entry jni/bindings.dart::KeyStore$Entry::implementIn::$impl
jni/bindings.dart::KeyStore$Entry::implement::$impl
ok_http $KeyManager jni/bindings.dart::KeyManager::implementIn::$impl
jni/bindings.dart::KeyManager::implement::$impl
ok_http $X509KeyManager jni/bindings.dart::X509KeyManager::implementIn::$impl
jni/bindings.dart::X509KeyManager::implement::$impl
ok_http $HostnameVerifier jni/bindings.dart::HostnameVerifier::implementIn::$impl
jni/bindings.dart::HostnameVerifier::implement::$impl
ok_http $KeyChainAliasCallback jni/bindings.dart::KeyChainAliasCallback::implementIn::$impl
jni/bindings.dart::KeyChainAliasCallback::implement::$impl
ok_http $Key jni/bindings.dart::Key::implementIn::$impl
jni/bindings.dart::Key::implement::$impl
ok_http $PublicKey jni/bindings.dart::PublicKey::implementIn::$impl
jni/bindings.dart::PublicKey::implement::$impl
ok_http $Enumeration jni/bindings.dart::Enumeration::implementIn::$impl
jni/bindings.dart::Enumeration::implement::$impl

This check can be disabled by tagging the PR with skip-leaking-check.

Breaking changes ✔️
Package Change Current Version New Version Needed Version Looking good?
web_socket None 1.0.1 1.0.1 1.0.1 ✔️
http_multi_server None 3.2.2 3.2.2 3.2.2 ✔️
http_profile None 0.1.0 0.1.1-wip 0.1.1-wip ✔️
web_socket_channel None 3.0.3 3.0.4-wip 3.0.4-wip ✔️
http2 Non-Breaking 2.3.1 3.0.1-wip 3.0.1-wip ✔️
http_parser None 4.1.2 4.1.3-wip 4.1.3-wip ✔️
http Non-Breaking 1.6.0 1.7.0-wip 1.7.0-wip ✔️
cronet_http Non-Breaking 1.9.0 1.10.0-wip 1.10.0-wip ✔️
cupertino_http None 3.0.2 3.0.2 3.0.2 ✔️
ok_http Non-Breaking 0.1.0 0.1.1-wip 0.1.1-wip ✔️

This check can be disabled by tagging the PR with skip-breaking-check.

@kevmoo
kevmoo requested a review from brianquinlan August 11, 2026 03:27
@kevmoo

kevmoo commented Aug 11, 2026

Copy link
Copy Markdown
Member Author

@brianquinlan - what do you think?

@brianquinlan

brianquinlan commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

I think that these failures are unrelated and you can merge.

@kevmoo
kevmoo merged commit 9fa7266 into master Aug 18, 2026
66 of 69 checks passed
@kevmoo
kevmoo deleted the zizmor-fixes branch August 18, 2026 23:35
copybara-service Bot pushed a commit to dart-lang/sdk that referenced this pull request Sep 11, 2026
@natebosch dart-scoped@luci-project-accounts.iam.gserviceaccount.com
[deps] rev core, dartdoc, ecosystem, http, i18n, native, shelf, tools…
5e99c28 
…, web, webdriver

Revisions updated by `dart tools/rev_sdk_deps.dart`.

core (https://github.com/dart-lang/core/compare/773de9d..7e8caaf):
  7e8caafa  Thu Sep 10 12:51:06 2026 +0200  Jonas Finnemann Jensen  Fix doc comment in FixedDateTimeFormatter (dart-lang/core#998)
  0fbe0cc3  Thu Sep 3 16:26:19 2026 -0700  Nate Bosch  Mark Context and Style as final (dart-lang/core#995)
  1f563bb2  Tue Sep 1 21:54:29 2026 +0000  dependabot[bot]  Bump the github-actions group with 5 updates (dart-lang/core#996)
  b80e4885  Fri Aug 28 12:18:12 2026 +0200  Lasse R.H. Nielsen  Release package:platform 3.2 (dart-lang/core#994)
  9727aadc  Wed Aug 26 09:34:02 2026 -0700  Nate Bosch  Add new lints (dart-lang/core#989)

dartdoc (https://github.com/dart-lang/dartdoc/compare/2737669..df2f2cd):
  df2f2cde  Tue Sep 8 11:09:41 2026 +0200  dependabot[bot]  Bump analyzer_testing from 0.3.4 to 0.4.1 (dart-lang/dartdoc#4282)
  b028f551  Tue Sep 1 18:56:04 2026 +0000  dependabot[bot]  Bump the github-actions group with 2 updates (dart-lang/dartdoc#4281)

ecosystem (https://github.com/dart-lang/ecosystem/compare/cda8bd5..1bdafd8):
  1bdafd8  Wed Sep 2 16:31:27 2026 -0700  Nate Bosch  Tighten workflow for posting PR comments (dart-lang/ecosystem#451)
  fc3dd9a  Mon Aug 31 11:38:33 2026 -0700  Kevin Moore  fix(firehose): update existing publishing PR comments when no packages are ready to publish (dart-lang/ecosystem#449)
  e0a78b4  Mon Aug 31 11:12:56 2026 -0700  Kevin Moore  fix(firehose): bump dependency_validator pinned hash to 5.0.6 (dart-lang/ecosystem#450)
  60fca9f  Tue Aug 25 16:31:57 2026 -0700  Kevin Moore  Condense firehose package publishing table in PR validation (dart-lang/ecosystem#445)
  b79f68c  Mon Aug 24 05:47:23 2026 -0700  Kevin Moore  chore(health): remove 3rd-party coveralls action dependency (dart-lang/ecosystem#446)

http (https://github.com/dart-lang/http/compare/a9176ac..066e158):
  066e158  Wed Sep 9 17:15:24 2026 +0200  Eve Chen  Skip chunked framing when contentLength is null (dart-lang/http#1970)
  a6145c3  Wed Sep 9 09:26:05 2026 +1000  Liam Appelbe  [cupertino_http] Migrate to FFIgen 22 (dart-lang/http#1986)
  92b20d1  Fri Sep 4 10:29:18 2026 -0700  Brian Quinlan  test(conformance): HEAD with content-length set (dart-lang/http#1979)
  bb553a6  Fri Sep 4 11:40:41 2026 +1000  Liam Appelbe  [cronet_http] Migrate to JNIgen v1 and use the Dart config API (dart-lang/http#1980)
  deacd15  Thu Sep 3 16:09:07 2026 -0700  Brian Quinlan  chore(cupertino_http): ready to release 3.1.0 (dart-lang/http#1985)
  ace65bc  Wed Sep 2 17:01:14 2026 -0700  Brian Quinlan  ci(cupertino_http): only run iOS tests when run-ios-tests label is present (dart-lang/http#1984)
  7a79b45  Wed Sep 2 17:00:49 2026 -0700  Brian Quinlan  ci(cupertino_http): enable caching for Flutter SDK and pub dependencies (dart-lang/http#1982)
  8dbb44c  Wed Sep 2 17:00:19 2026 -0700  Brian Quinlan  chore(cupertino_http): migrate ios_test from CocoaPods to Swift Package Manager (dart-lang/http#1983)
  b815a06  Wed Sep 2 23:55:13 2026 +0200  stwime  [cupertino_http] Regenerate bindings with ffigen 21 (dart-lang/http#1975)
  0d5bee4  Wed Sep 2 10:50:41 2026 -0700  dependabot[bot]  chore(deps): bump the github-actions group across 1 directory with 10 updates (dart-lang/http#1976)
  6543145  Mon Aug 24 16:32:07 2026 +0100  Ademola Fadumo  feat(http2): add a pooled, multiplexed HTTP/2 http.Client (dart-lang/http#1956)
  a0d49cb  Wed Aug 19 18:22:11 2026 -0700  Brian Quinlan  fix(http2): reject server push when disabled (dart-lang/http#1966)
  8007c92  Wed Aug 19 17:57:46 2026 -0700  Brian Quinlan  fix(http2): reject requests that exceed `SETTINGS_MAX_CONCURRENT_STREAMS` (dart-lang/http#1965)
  1827980  Wed Aug 19 17:06:20 2026 -0700  dart-ecosystem-bot[bot]  Tidy: package:cupertino_http (dart-lang/http#1968)
  a24ab46  Wed Aug 19 17:03:03 2026 -0700  Brian Quinlan  chore: upgrade to jnigen 0.17.0 (dart-lang/http#1964)
  9fa7266  Tue Aug 18 16:35:25 2026 -0700  Kevin Moore  chore: harden GitHub Actions workflows against Zizmor findings (dart-lang/http#1971)

i18n (https://github.com/dart-lang/i18n/compare/2fd9412..1f5ea2f):
  1f5ea2fb  Tue Sep 8 13:12:25 2026 +0200  Moritz  [intl4x] Add intl4x.brittle_i18n_testing environment define (dart-lang/i18n#1093)

native (https://github.com/dart-lang/native/compare/38fe179..84d7eda):
  84d7edac0  Wed Sep 9 07:38:19 2026 +0200  Jakob Kordež  [ffigen] Resolve unexposed C++ types through their canonical type (dart-lang/native#3608)
  7b77c03a9  Wed Sep 9 10:31:06 2026 +0530  Sivapriya  [jnigen] Add javadoc.io fallback for missing Javadoc (dart-lang/native#3586)
  520d280d1  Wed Sep 9 06:57:16 2026 +0200  Jakob Kordež  [ffigen] Treat class declarations like structs, decide C++ class binding by POD-ness (dart-lang/native#3607)
  350ed4541  Tue Sep 8 09:55:21 2026 +1000  Liam Appelbe  [ffigen] Prepare to publish (dart-lang/native#3620)
  2cb086a2f  Mon Sep 7 12:15:34 2026 +1000  Liam Appelbe  [ffigen] Migrate remaining FFIgen YAML configs (dart-lang/native#3614)
  dc2937e7c  Mon Sep 7 11:07:46 2026 +1000  Liam Appelbe  [ffigen] Symbol file imports (dart-lang/native#3617)
  c69575ce5  Fri Sep 4 04:05:59 2026 +0200  Jakob Kordež  [ffigen] Skip C++ methods with unbindable return types (dart-lang/native#3591)
  5d6f82d9d  Fri Sep 4 08:41:35 2026 +1000  Liam Appelbe  [objective_c] Migrate ffigen yaml configs (dart-lang/native#3615)
  ef6db8652  Fri Sep 4 08:41:20 2026 +1000  Liam Appelbe  [ffigen] Migrate test YAML configs (dart-lang/native#3613)
  9f3dae7e6  Fri Sep 4 08:38:55 2026 +1000  Liam Appelbe  [ffigen] Migrate FFIgen configs across the repo (dart-lang/native#3616)
  895977bca  Fri Sep 4 08:37:25 2026 +1000  Liam Appelbe  [jnigen] Prepare to publish v1.0.0 (dart-lang/native#3612)
  03f1d8e29  Thu Sep 3 09:13:56 2026 +1000  Liam Appelbe  [ffigen] Config cleanup (dart-lang/native#3606)
  9560e6c8a  Wed Sep 2 09:58:51 2026 +1000  Liam Appelbe  [jnigen] Migrate YAMLs to Dart (dart-lang/native#3600)
  8836b56ed  Tue Sep 1 05:35:52 2026 +0000  dependabot[bot]  [infra] Bump the github-actions group with 7 updates (dart-lang/native#3604)
  3041c6e88  Tue Sep 1 09:06:17 2026 +1000  Liam Appelbe  [jnigen] Little bits of cleanup (dart-lang/native#3599)
  c4af7b839  Tue Sep 1 09:01:03 2026 +1000  Liam Appelbe  [jni_flutter] Bump kotlin version (dart-lang/native#3598)
  ff508aeb2  Thu Aug 27 12:30:15 2026 +0200  Daco Harkes  [code_assets] [native_toolchain_c] Add arm64e (dart-lang/native#3589)
  f914da89c  Thu Aug 27 05:37:06 2026 +0200  Jakob Kordež  [ffigen] Fix infinite recursion when parsing cyclic C++ class references (dart-lang/native#3584)
  0f05f8895  Thu Aug 27 11:36:48 2026 +1000  Liam Appelbe  [ffigen][jnigen] Clean up dartdoc categories (dart-lang/native#3587)
  ae80f0dfa  Wed Aug 26 18:23:47 2026 +0200  Alexander Thomas  Merge pull request `#3588` from dart-lang/merge-cherry-pick-3581
  bcf1529b9  Wed Aug 26 07:51:49 2026 -0700  Brian Quinlan  Merge branch 'main' into merge-cherry-pick-3581
  bd5e0ff05  Wed Aug 26 14:24:50 2026 +1000  Liam Appelbe  [ffigen] Final config cleanup (dart-lang/native#3575)
  363e9ae91  Tue Aug 25 14:35:54 2026 -0700  Brian Quinlan  Merge remote-tracking branch 'origin/cherry-pick-3581' into merge-cherry-pick-3581
  d51c53334  Tue Aug 25 01:07:51 2026 -0700  Brian Quinlan  [hooks_runner] use target path separator (dart-lang/native#3581)
  7ee7629d6  Tue Aug 25 13:59:24 2026 +0530  Varad Raj Agrawal  [native_toolchain_c] Inject FileSystem for file system access (dart-lang/native#3555)

shelf (https://github.com/dart-lang/shelf/compare/fb3f931..f36dd68):
  f36dd68  Tue Sep 1 12:29:24 2026 +0000  dependabot[bot]  build(deps): bump dart-lang/setup-dart in the github-actions group (dart-lang/shelf#539)
  3dbf65b  Thu Aug 27 16:05:14 2026 -0700  Kevin Moore  fix(shelf_static): Handle int overflow during byte range parsing (dart-lang/shelf#538)

tools (https://github.com/dart-lang/tools/compare/441ff29..682f285):
  682f2854  Thu Sep 10 09:08:32 2026 -0700  Keerti Parthasarathy  [unified_analytics] Update code to mock `isExternal` in tests. (dart-lang/tools#2594)
  b09f9a33  Fri Sep 4 11:46:08 2026 -0700  Kevin Moore  [api_summary] Support dart:js_interop annotations (@js and @JSExport) (dart-lang/tools#2527)
  292130b6  Thu Sep 3 19:27:26 2026 -0700  Kevin Moore  [api_summary] Introduce ApiFacet model and migrate package:meta annotations (dart-lang/tools#2526)
  cacb5a56  Wed Sep 2 10:03:40 2026 +0700  herdiyanitdev  fix(markdown): avoid quadratic parse time on long unbroken words (dart-lang/tools#2536)
  10ea88d0  Tue Sep 1 10:08:46 2026 -0700  Nate Bosch  Remove @internal annotations for now (dart-lang/tools#2576)
  3306952a  Tue Sep 1 06:11:16 2026 +0000  dependabot[bot]  build(deps): bump the github-actions group with 4 updates (dart-lang/tools#2577)
  94ee86ed  Fri Aug 28 14:54:46 2026 -0700  Kevin Moore  feat: export ErrorListener and ErrorCollector from yaml.dart (dart-lang/tools#2551)
  c7f7a63f  Fri Aug 28 12:25:32 2026 -0700  Nate Bosch  Prepare to publish packages (dart-lang/tools#2562)
  3b3b22c2  Fri Aug 28 09:10:36 2026 +0200  Jonas Finnemann Jensen  [extension_discovery] Fixup review comments (dart-lang/tools#2557)

web (https://github.com/dart-lang/web/compare/6b84f81..e5c6c02):
  e5c6c02  Tue Sep 1 06:54:56 2026 +0000  dependabot[bot]  Bump the github-actions group with 2 updates (dart-lang/web#574)
  c4d8884  Thu Aug 20 21:31:53 2026 +0000  dependabot[bot]  Bump the github-actions group with 3 updates (dart-lang/web#569)
  6d96d9e  Thu Aug 20 14:08:47 2026 -0700  Kevin Moore  chore: harden GitHub Actions workflows against Zizmor findings (dart-lang/web#568)

webdriver (https://github.com/google/webdriver.dart/compare/3a711eb..9b2e87d):
  9b2e87d  Wed Sep 9 12:55:07 2026 -0700  Kevin Moore  ci: align publish workflow and enable direct PR comments (google/webdriver.dart#348)
  1da600f  Fri Sep 4 11:40:38 2026 -0700  dependabot[bot]  Bump the actions group across 1 directory with 3 updates (google/webdriver.dart#347)
  0046657  Fri Sep 4 13:10:07 2026 -0400  Nate Biggs  Publish version 3.2.0 (google/webdriver.dart#346)


[email protected]

Change-Id: Ib3be7bf3d3a0c91ebeb01002b7e63fcb86de1f92
TAG=agy
CONV=e6fd1c32-ded3-443f-83e5-2e15b4ffaccb
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/544260
Commit-Queue: Johnni Winther <[email protected]>
Reviewed-by: Samuel Rawlins <[email protected]>
Reviewed-by: Johnni Winther <[email protected]>
Auto-Submit: Nate Bosch <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@natebosch natebosch natebosch approved these changes
@brianquinlan brianquinlan brianquinlan approved these changes

Assignees

No one assigned

Labels

type-infra A repository infrastructure change or enhancement

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kevmoo @brianquinlan @natebosch