chore: bump dorny/paths-filter from 4.0.1 to 4.0.2

[dependabot]

Bumps dorny/paths-filter from 4.0.1 to 4.0.2.

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.2

What's Changed

• fix warning message by @​cgundy in dorny/paths-filter#282
• chore: fix GitHub spelling in logs by @​squat in dorny/paths-filter#278
• fix: use rev-parse instead of branch --show-current for older git compat by @​saschabratton in dorny/paths-filter#303
• fix: work around git dubious ownership errors in container jobs by @​saschabratton in dorny/paths-filter#317
• docs: update changelog for v4.0.2 by @​saschabratton in dorny/paths-filter#318

New Contributors

• @​cgundy made their first contribution in dorny/paths-filter#282
• @​squat made their first contribution in dorny/paths-filter#278

Full Changelog: dorny/paths-filter@v4.0.1...v4.0.2

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.2

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

v4.0.1

• Support merge queue

v4.0.0

• Update action runtime to node24

v3.0.3

• Add missing predicate-quantifier

v3.0.2

• Add config parameter for predicate quantifier

v3.0.1

• Compare base and ref when token is empty

v3.0.0

• Update to Node.js 20
• Update all dependencies

v2.11.1

• Update @​actions/core to v1.10.0 - Fixes warning about deprecated set-output
• Document need for pull-requests: read permission
• Updating to actions/checkout@v3

v2.11.0

• Set list-files input parameter as not required
• Update Node.js
• Fix incorrect handling of Unicode characters in exec()
• Use Octokit pagination
• Updates real world links

v2.10.2

• Fix getLocalRef() returns wrong ref

v2.10.1

• Improve robustness of change detection

v2.10.0

• Add ref input parameter
• Fix change detection in PR when pullRequest.changed_files is incorrect

v2.9.3

• Fix change detection when base is a tag

... (truncated)

Commits

• 7b450ff docs: update changelog for v4.0.2 (#318)
• 9280377 fix: work around git dubious ownership errors in container jobs (#317)
• f3ceefd fix: use rev-parse instead of branch --show-current for older git compat (#303)
• 61f87a1 chore: fix GitHub spelling in logs (#278)
• b82ff81 fix warning message (#282)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[kriscendobot]

Dependabotany verdict: MERGE-NOW

Reviewed head 5879e4634aa3f8d107e83beca2f0f2cd13e81e90: dorny/paths-filter 4.0.1 → 4.0.2.

• Pre-flight and full moved set. The PR changes only .github/workflows/ci.yml, at the repository's only dorny/paths-filter call site. Current llm still pins 4.0.1 there, so this is not superseded. GitHub Actions has no project lockfile to move; upstream package.json and package-lock.json are byte-identical between the two tags, so there are no introduced or moved bundled dependencies and no license change (MIT).
• Pin provenance and maturity. On 2026-08-05, tag v4.0.1 resolved to fbd0ab8f3e69293af611ebaee6363fc25e6d187d and tag v4.0.2 resolved to 7b450fff21473bca461d4b92ce414b9d0420d706, exactly matching the outgoing and incoming workflow pins. Both are lightweight tags. v4.0.2 was published 2026-07-02T17:46:08Z; its maturity floor was 2026-07-09T17:46:08Z, so nothing is 24-hour fresh.
• Source read. The five commits fix warning text, use git rev-parse for older Git compatibility, and add a container-job dubious-ownership workaround. The new code retries Git after creating a temporary HOME under RUNNER_TEMP, copying existing global Git configuration, adding only safe.directory entries through an argument-array invocation of git config, forcing LC_ALL=C, and deleting the temporary directory in finally. No new network endpoint, telemetry, dynamic require, install hook, or shell interpolation appears. The expected filesystem writes and Git child process are scoped to that temporary HOME. Rebuilding with ncc reproduced the committed dist/index.js byte-for-byte.
• Advisories. The GitHub Actions advisory feed and OSV return no record for either dorny/paths-filter@4.0.1 or @4.0.2. A scripts-disabled audit of the upstream source does expose an unchanged bundled backlog: picomatch (GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj), @octokit/plugin-paginate-rest (GHSA-h5c3-5r3r-rr8q), @octokit/request (GHSA-rmvr-2pp2-xj38), @octokit/request-error (GHSA-xx4v-prfh-6cgc), uuid (GHSA-w5hq-g745-h8pq), and undici (GHSA-c76h-2ccp-4975, GHSA-9qxr-qj54-h672, GHSA-m4v8-wqvr-p9f7, GHSA-g9mf-h72j-4rw9, GHSA-cxrh-j4jr-qwg3, GHSA-2mjp-6q6p-2qxm, GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-4992-7rv2-5pvq, GHSA-3787-6prv-h9w3, GHSA-p88m-4jfj-68fv, GHSA-vxpw-j846-p89q, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m, GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm). The outgoing and incoming bundles carry the identical versions. They are not attacker-reachable at this call site: picomatch receives the fixed base-workflow literal .github/workflows/**, not a PR-supplied pattern; uuid is called only as v4() without a caller buffer; Octokit receives the runner-provided GitHub token and GitHub API response headers; and undici is used only for the authenticated GitHub pulls.listFiles request, not WebSockets, proxy authorization, cookies, blob bodies, integrity, or caller-selected endpoints. Thus the upgrade does not increase exposure, and the residuals do not block under the directional rule.
• Verification. The PR's head has 23/23 completed-successful check runs, including zizmor and check-action-pins. Against upstream v4.0.2, a scripts-disabled npm ci --ignore-scripts completed; TypeScript build, Prettier check, ESLint, and all 64 Jest tests passed; ncc build reproduced the checked-in bundle. No change was declined.

Next step: conduct onto llm. The technical gate is clear; the deterministic merge spine will still require a current maintainer approval.

_{model gpt-5.6-sol · harness codex · garden c7d730c3}