Release 2026-08-10 (#3970)

Author: dnechay

.github/dependabot.yml .github/_dependabot.yml.github/dependabot.yml renamed to .github/_dependabot.yml

@@ -0,0 +1,4 @@
+show-openssf-scorecard: false
+fail-on-severity: 'high'
+allow-ghsas:
+  - GHSA-qwww-vcr4-c8h2 # we don't use vulnerable functionality

.github/dependency-review-config.yml

@@ -39,7 +39,7 @@ jobs:
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: yarn

.github/workflows/cd-packages.yaml

@@ -30,12 +30,12 @@ jobs:
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: yarn
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.x"
       - name: Read package version

.github/workflows/cd-python-sdk.yaml

@@ -30,7 +30,7 @@ jobs:
       max-parallel: 3
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: yarn

.github/workflows/cd-subgraph-hmt.yaml

@@ -30,7 +30,7 @@ jobs:
       max-parallel: 3
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: yarn

.github/workflows/cd-subgraph-human.yaml

@@ -16,4 +16,5 @@ jobs:
       - name: Dependency Review
         uses: actions/dependency-review-action@v5.0.0
         with:
-          show-openssf-scorecard: false
+          config-file: './.github/dependency-review-config.yml'
+          

.github/workflows/ci-dependency-review.yaml

@@ -24,7 +24,7 @@ jobs:
         uses: snok/install-poetry@v1
         with:
           version: 1.8.4
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.10'
           cache: 'poetry'

.github/workflows/ci-lint-cvat-exchange-oracle.yaml

@@ -24,10 +24,10 @@ jobs:
         uses: snok/install-poetry@v1
         with:
           version: 1.8.4
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.10'
           cache: 'poetry'
           cache-dependency-path: ${{ env.WORKING_DIR }}/poetry.lock
-      - run: poetry install --no-root --only lint
+      - run: poetry install --no-root --only dev
       - run: poetry run pre-commit run --all-files

.github/workflows/ci-lint-cvat-recording-oracle.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: yarn