From d5b4e3bb703ca99f8e655460d5afc795d6fd6d4b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 20 Sep 2026 08:15:11 +0000
Subject: [PATCH] Bump the github-actions group with 2 updates

Bumps the github-actions group with 2 updates: [codecov/codecov-action](https://github.com/codecov/codecov-action) and [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action).


Updates `codecov/codecov-action` from 7.0.0 to 7.1.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/fb8b3582c8e4def4969c97caa2f19720cb33a72f...303a32d7a59b442fa8d48b6a1cc6825c09c847a5)

Updates `SonarSource/sonarqube-scan-action` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/22918119ff8e1ca75a623e15c8296b6ea4fbe28f...ba9859eae8dd6bd29e412f25ddbbef3d032000f4)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: SonarSource/sonarqube-scan-action
  dependency-version: 8.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/fork-coverage.yml | 2 +-
 .github/workflows/fork-sonar.yml    | 2 +-
 .github/workflows/maven.yml         | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/fork-coverage.yml b/.github/workflows/fork-coverage.yml
index f2c5c1cc..4c80988a 100644
--- a/.github/workflows/fork-coverage.yml
+++ b/.github/workflows/fork-coverage.yml
@@ -69,7 +69,7 @@ jobs:
 
       - name: Publish fork PR test coverage to Codecov
         if: env.CODECOV_TOKEN != '' && github.event.workflow_run.conclusion == 'success'
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: codecov-payload/jacoco.xml,codecov-payload/jacoco-aggregate.xml
diff --git a/.github/workflows/fork-sonar.yml b/.github/workflows/fork-sonar.yml
index 1ef29ae3..f6b5b7cf 100644
--- a/.github/workflows/fork-sonar.yml
+++ b/.github/workflows/fork-sonar.yml
@@ -164,7 +164,7 @@ jobs:
 
       - name: Publish fork PR analysis to SonarCloud
         if: env.SONAR_TOKEN != ''
-        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
+        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
         env:
           SONAR_HOST_URL: https://sonarcloud.io
         with:
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 4a9aa5cb..1bc5415b 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -197,7 +197,7 @@ jobs:
     - name: Upload coverage to Codecov (processor + core via aggregate)
       # Skip when CODECOV_TOKEN is unavailable (fork PRs) and for any bot-authored PR.
       if: always() && env.CODECOV_TOKEN != '' && github.event.pull_request.user.type != 'Bot'
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
       with:
         fail_ci_if_error: true
         files: |