[dependabot]

Bumps https://github.com/jdx/jactionlint from v2.3.0 to 2.4.0.

Release notes

Sourced from https://github.com/jdx/jactionlint's releases.

v2.4.0: Private Use Area detection and fixes for artipacked, Dependabot groups and SARIF uploads

jactionlint 2.4.0 extends invisible-characters to report Private Use Area characters. It also fixes false positives in artipacked and dependabot-syntax, and stops the "inconsistent fingerprint" warnings when you upload SARIF to code scanning.

Added

• invisible-characters reports Private Use Area characters (U+E000–U+F8FF and the two supplementary private-use planes). Most fonts have no glyph for these characters, so they can hide a payload that a script decodes at run time, the same way variation selectors can. The message calls them PRIVATE USE CHARACTER. The rule ID, profile, level and the fix that removes the character have not changed. If you use Nerd Font or Powerline icons on purpose, write them as escape sequences before you apply the fix. Otherwise the fix removes them. (#311, @​jdx)

Fixed

• artipacked no longer reports actions/checkout v6 and later. Starting with v6, checkout stores the credential in a file under $RUNNER_TEMP instead of the workspace, so uploading the workspace doesn't publish it. The rule skips v6+ tag refs, and also commit pins whose version comment says v6 or later. v5 and earlier are still reported. (#308, @​jdx)
• dependabot-syntax no longer reports an update with multi-ecosystem-group as a duplicate of the regular update for the same ecosystem and directory. Two updates are now duplicates only when they match on ecosystem, directory, target branch and group. Two ungrouped updates, or two updates in the same group, are still reported. (#314, @​jdx)
• SARIF output no longer writes primaryLocationLineHash. github/codeql-action/upload-sarif computes this value itself and logs an "inconsistent fingerprint" warning when a file supplies a different one. The fingerprint value is unchanged and is now stored under jactionlint/contextHash/v1 in partialFingerprints. If your tools read jactionlint's fingerprint from primaryLocationLineHash, switch them to the new key. (#307, @​jdx)

Full Changelog: jdx/jactionlint@v2.3.0...v2.4.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.

Changelog

Sourced from https://github.com/jdx/jactionlint's changelog.

2.4.0 (2026-10-28)

Features

• invisible-characters: report Private Use Area characters (#311) (b4a8d08)

Bug Fixes

• artipacked: skip actions/checkout v6 and later (#308) (7a5eb59)
• dependabot-syntax: don't report a multi-ecosystem group update as a duplicate (#314) (1950126)
• sarif: stop writing primaryLocationLineHash (#307) (beecbca)

Commits

• baa8d68 chore(main): release 2.4.0 (#309)
• 1950126 fix(dependabot-syntax): don't report a multi-ecosystem group update as a dupl...
• b4a8d08 feat(invisible-characters): report Private Use Area characters (#311)
• beecbca fix(sarif): stop writing primaryLocationLineHash (#307)
• 7a5eb59 fix(artipacked): skip actions/checkout v6 and later (#308)
• 09478a8 test(schema): pin the latest actions/runner schemas (#306)
• 556be51 update version to 2.3.0 in download-jactionlint.bash and the action examples
• 426f1a2 Brew cask update for jactionlint version v2.3.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

🟢 Approval recommended

No active review issues are reported for the jactionlint revision update.

No open issues 🎉

What changed in this PR

Updates the repository’s GitHub Actions linting dependency used by pre-commit.

Changes:

• Bumps jactionlint from v2.3.0 to v2.4.0, bringing expanded invisible-character detection and upstream fixes without changing hook configuration.

File	Description
.pre-commit-config.yaml	Updates the jactionlint revision to v2.4.0.

_{Review effort: Balanced}