Merge branch 'master' of https://ggregory@gitbox.apache.org/repos/asf/commons-io.git

Author: garydgregory

.github/workflows/codeql-analysis.yml

@@ -62,7 +62,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93    # 3.26.6
+      uses: github/codeql-action/init@294a9d92911152fe08befb9ec03e240add280cb3    # 3.26.8
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -73,7 +73,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@4dd16135b69a43b6c8efb853346f8437d92d3c93    # 3.26.6
+      uses: github/codeql-action/autobuild@294a9d92911152fe08befb9ec03e240add280cb3    # 3.26.8
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -87,4 +87,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93    # 3.26.6
+      uses: github/codeql-action/analyze@294a9d92911152fe08befb9ec03e240add280cb3    # 3.26.8

.github/workflows/dependency-review.yml

@@ -0,0 +1,34 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: 'Dependency Review'
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v4
+      - name: 'Dependency Review PR'
+        uses: actions/dependency-review-action@v4.3.4
+        with:
+          base-ref: ${{ github.event.before }}
+          head-ref: ${{ github.sha }}

.github/workflows/scorecards-analysis.yml

@@ -66,6 +66,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93    # 3.26.6
+        uses: github/codeql-action/upload-sarif@294a9d92911152fe08befb9ec03e240add280cb3    # 3.26.8
         with:
           sarif_file: results.sarif

pom.xml

@@ -19,7 +19,7 @@
   <parent>
     <groupId>org.apache.commons</groupId>
     <artifactId>commons-parent</artifactId>
-    <version>74</version>
+    <version>75</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
   <groupId>commons-io</groupId>

src/changes/changes.xml

@@ -50,6 +50,7 @@ The <action> type attribute can be add,update,fix,remove.
       <!-- FIX -->
       <!-- ADD -->
       <!-- UPDATE -->
+      <action dev="ggregory" type="update"                due-to="Gary Gregory">Bump org.apache.commons:commons-parent from 74 to 75 #670.</action> 
     </release>
     <release version="2.17.0" date="2024-09-15" description="Version 2.17.0: Java 8 is required.">
       <!-- ADD -->