From 579e1e8f7ab348807618ed65df2097c438d244be Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 2 May 2023 19:29:46 -0400
Subject: [PATCH 01/13] Typo fix.

---
 doc/customizing.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/customizing.txt b/doc/customizing.txt
index 7700bbc7f..9ceaa2f02 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -1072,7 +1072,7 @@ placeholder. E.G. replace a password with the text::
 
 If you need to delete an entire file, replace the file contents with::
 
-    [file contents deleted due to spam 202-10-21 --myname]
+    [file contents deleted due to spam 2020-10-21 --myname]
 
 rather than deleting the file. If you actually delete the file Roundup
 will report an error to the user and email the administrator. If you

From 011008b15fd0d79946c3eb01ac8727a3a7740494 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 2 May 2023 20:03:14 -0400
Subject: [PATCH 02/13] Make examples scrollable if they overflow.

---
 website/www/_static/style.css | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/website/www/_static/style.css b/website/www/_static/style.css
index 7984e8729..70e7eb73e 100644
--- a/website/www/_static/style.css
+++ b/website/www/_static/style.css
@@ -318,6 +318,9 @@ dd p.first { margin-block-start: 0; }
 /* assume desktop reader for local html files, also no contact
    page for local doc files */
 
+/* make examples with long lines scrollable */
+div.highlight { overflow: auto;}
+
 @media only screen and (max-width:960px) {
     /* setup for layout/page frame */
     body { padding-inline-start: unset; /* remove space for float menu */}
@@ -337,8 +340,6 @@ dd p.first { margin-block-start: 0; }
     div.contents ul.simple li { padding-block: .5em; }
     ul.simple li a { min-height: 48px;
 		     display: block;}
-    /* make examples with long lines scrollable */
-    div.highlight pre { overflow: auto;}
 }
 
 /* Contact page */

From 65b3384f7bc7d8081011351d49eaa16fd5262dc3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 3 May 2023 11:11:45 -0400
Subject: [PATCH 03/13] Minor tweaks to upgrading general directions.

Recommended using virtual env for install in step 4.

Make explicit that you use the new roundup-admin for migration in step 6.

Cleaned up some wording.

Replaced python 3.4 with python 3.6 in supported version paragraph.

Added section on running different trackers with diferent versions of
Roundup via virtual envirnments.
---
 doc/upgrading.txt | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index e079402ab..468b6acd1 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -10,13 +10,13 @@
 Upgrading to newer versions of Roundup
 ======================================
 
-Please read each section carefully and edit your tracker home files
+Please read each section carefully and edit the files in your tracker home
 accordingly. Note that there is information about upgrade procedures in the
 `administration guide`_ in the `Software Upgrade`_ section.
 
-If a specific version transition isn't mentioned here (eg. 0.6.7 to 0.6.8)
+If a specific version transition isn't mentioned here (e.g. 0.6.7 to 0.6.8)
 then you don't need to do anything. If you're upgrading from 0.5.6 to
-0.6.8 though, you'll need to check the "0.5 to 0.6" and "0.6.x to 0.6.3"
+0.6.8 though, you'll need to apply the "0.5 to 0.6" and "0.6.x to 0.6.3"
 steps.
 
 General steps:
@@ -25,16 +25,17 @@ General steps:
    2. Take your Roundup installation offline (web, email,
       cron scripts, roundup-admin etc.)
    3. Backup your Roundup instance
-   4. Install a new version of Roundup
+   4. Install the new version of Roundup (preferably in a new virtual
+      environment)
    5. Make version specific changes as described below for
       each version transition. If you are starting at 1.5.0
-      and installing to 2.3, you need to make the changes for **all**
+      and installing to 2.3.0, you need to make the changes for **all**
       versions starting at 1.5 and ending at 2.3. E.G.
       1.5.0 -> 1.5.1, 1.5.1 -> 1.6.0, ..., 2.1.0 -> 2.2.0,
       2.2.0 -> 2.3.0.
-   6. Run ``roundup-admin -i <tracker_home> migrate`` for
-      **all** your trackers. This will update the database if
-      it is required.
+   6. Run ``roundup-admin -i <tracker_home> migrate`` using the newer
+      version of Roundup for **all** the trackers you have
+      upgraded. This will update the database if it is required.
    7. Bring your Roundup instance back online
    8. Test
 
@@ -42,7 +43,7 @@ General steps:
 Python v2.5 and v2.6.  Starting with the v1.6 releases of Roundup
 Python version 2.7 that is newer than 2.7.2 is required to run
 Roundup.  Starting with Roundup version 2.0.0 we also support Python 3
-versions newer than 3.4.
+versions newer than 3.6.
 
 Recent release notes have the following labels:
 
@@ -53,6 +54,12 @@ Recent release notes have the following labels:
      want to use
    * info - important possibly visible changes in how things operate
 
+If you use virtual environments for your installation, you can run
+trackers with different versions of Roundup. So you can have one tracker
+using version 2.2.0 and another tracker using version 1.6.1. This
+allows you to upgrade trackers one at a time rather than having to
+upgrade all your trackers at once.
+
 Contents:
 
 .. contents::

From bd6f456493072f85deecc5ed9bf093e659543134 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 4 May 2023 18:18:18 -0400
Subject: [PATCH 04/13] Prevent examples from blowing outside the viewport.

Overflow wasn't being triggered in multiple cases. Force break on
whitespace and overflow-wrap anywhere.

This seems to work from 350px mobile to desktop sizes.
---
 doc/_static/style.css         | 6 ++++++
 website/www/_static/style.css | 9 ++++++---
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/doc/_static/style.css b/doc/_static/style.css
index 0f2a49d89..0ef00b131 100644
--- a/doc/_static/style.css
+++ b/doc/_static/style.css
@@ -313,3 +313,9 @@ dd p.first { margin-block-start: 0; }
 /* remove solid black border when focus is around the main section
    due to activation of skip-link. Page jumps there, that's enough. */
 #main:focus-visible {outline: none;}
+
+/* Prevent examples from extending outside the viewport */
+div.highlight > pre {
+    overflow-wrap: anywhere;
+    white-space: break-spaces;
+}
diff --git a/website/www/_static/style.css b/website/www/_static/style.css
index 70e7eb73e..70b0d7570 100644
--- a/website/www/_static/style.css
+++ b/website/www/_static/style.css
@@ -314,13 +314,16 @@ dd p.first { margin-block-start: 0; }
    due to activation of skip-link. Page jumps there, that's enough. */
 #main:focus-visible {outline: none;}
 
+/* Prevent examples from extending outside the viewport */
+div.highlight > pre {
+    overflow-wrap: anywhere;
+    white-space: break-spaces;
+}
+
 /* website only */
 /* assume desktop reader for local html files, also no contact
    page for local doc files */
 
-/* make examples with long lines scrollable */
-div.highlight { overflow: auto;}
-
 @media only screen and (max-width:960px) {
     /* setup for layout/page frame */
     body { padding-inline-start: unset; /* remove space for float menu */}

From 8cde913b4eff9c7875cad81c777fe64aa17a9072 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 4 May 2023 20:52:09 -0400
Subject: [PATCH 05/13] fix xmlrpc endpoint, mke blockquote into pre block.

---
 doc/customizing.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/customizing.txt b/doc/customizing.txt
index 9ceaa2f02..ade6c1946 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -2227,7 +2227,7 @@ The `REST api`_ is accessed via:
 
 and the `XMLRPC api`_ is available at:
 
-6. ``/rest/``
+6. ``/xmlrpc``
 
 .. _`XMLRPC api`: xmlrpc.html
 
@@ -3476,7 +3476,7 @@ sorted      only on Multilink properties - produce a list of the linked
             
                 python:context.files.sorted('creation')
 
-            Will list the files by upload date. While
+            Will list the files by upload date. While::
 
                python:context.files.sorted('creation', reverse=True)
 

From 6706eb27885296fa9ac6dd9d976b6303ebfc4fcc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 4 May 2023 20:57:38 -0400
Subject: [PATCH 06/13] Change ordered list to use numbers.

Orderd list was using letters, but sphynx was numbering it. The block
after the list was using letters to refer to items in the list.

Make everything use numbers.
---
 doc/customizing.txt | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/customizing.txt b/doc/customizing.txt
index ade6c1946..4422f19e2 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -2266,27 +2266,27 @@ where tracker root is ``/tracker/`` or ``/cgi-bin/roundup.cgi/tracker/``
 We're looking at "issue", "issue1", "@@file/style.css", "file1" and
 "file1/kitten.png" in the cases above.
 
-a. with is no path we are in the "home" context. See `the "home"
+1. with is no path we are in the "home" context. See `the "home"
    context`_ below for details. "index" or "home" paths may also be used
    to switch into "home" context.
-b. for paths starting with "@@file" the additional path entry ("style.css"
+2. for paths starting with "@@file" the additional path entry ("style.css"
    in the example above) specifies the static file to be served
    from the tracker TEMPLATES directory (or STATIC_FILES, if configured).
    This is usually the tracker's "html" directory. Internally this works
    by raising SendStaticFile exception.
-c. if there is something in the path (as in example 1, "issue"), it
+3. if there is something in the path (as in example 1, "issue"), it
    identifies the tracker class to display.
-d. if the path is an item designator (as in examples 2 and 4, "issue1"
+4. if the path is an item designator (as in examples 2 and 4, "issue1"
    and "file1"), then we're to display a specific item.
    :ref:`Note. <strip_zeros>`
-e. if the path starts with an item designator and is longer than one
+5. if the path starts with an item designator and is longer than one
    entry (as in example 5, "file1/kitten.png"), then we're assumed to be
    handling an item of a ``FileClass``, and the extra path information
    gives the filename that the client is going to label the download
    with (i.e. "file1/kitten.png" is nicer to download than "file1").
    This raises a ``SendFile`` exception.
 
-Neither b. or e. use templates and stop before the template is
+Neither 2. or 5. use templates and stop before the template is
 determined. For other contexts the template used is specified by the
 ``@template`` variable, which defaults to:
 

From ca992077913cec5a7cc677135fdf76c2f49dac84 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 May 2023 09:10:10 -0400
Subject: [PATCH 07/13] flake8 fixes

move import to top, indentation, remove trailing whitespace ...
---
 roundup/admin.py     | 2 +-
 roundup/cgi/cgitb.py | 2 +-
 roundup/i18n.py      | 4 ++--
 roundup/mailgw.py    | 2 +-
 roundup/password.py  | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/roundup/admin.py b/roundup/admin.py
index f66a40194..803844bb8 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -116,7 +116,7 @@ def __init__(self):
             'display_protected':
             _("Have 'display designator' show protected fields: creator. NYI"),
 
-            'indexer_backend': 
+            'indexer_backend':
             _("Set indexer to use when running 'reindex' NYI"),
 
             '_reopen_tracker':
diff --git a/roundup/cgi/cgitb.py b/roundup/cgi/cgitb.py
index 6d25f32e4..ce32588fc 100644
--- a/roundup/cgi/cgitb.py
+++ b/roundup/cgi/cgitb.py
@@ -67,7 +67,7 @@ def pt_html(context=5, i18n=None):
     from roundup.cgi.PageTemplates.Expressions import TraversalError
     t = inspect.trace(context)
     t.reverse()
-    for frame, file, lnum, func, lines, index in t:
+    for frame, _file, _lnum, _func, _lines, _index in t:
         args, varargs, varkw, locals = inspect.getargvalues(frame)
         if '__traceback_info__' in locals:
             ti = locals['__traceback_info__']
diff --git a/roundup/i18n.py b/roundup/i18n.py
index 1b4886bba..4ada7310e 100644
--- a/roundup/i18n.py
+++ b/roundup/i18n.py
@@ -37,6 +37,7 @@
 
 import gettext as gettext_module
 import os
+import sys
 
 from roundup import msgfmt
 from roundup.anypy.strings import is_us
@@ -58,7 +59,6 @@
     LOCALE_DIRS.append(_mo_path)
 del _mo_path
 
-import sys
 # __file__ should be something like:
 #    /usr/local/lib/python3.10/site-packages/roundup/i18n.py
 # os.prefix should be /usr, /usr/local or root of virtualenv
@@ -82,7 +82,7 @@
     if os.path.isdir(_ldir):
         LOCALE_DIRS.append(_ldir)
 except AttributeError:
-    pass # no base_prefix on 2.7
+    pass  # no base_prefix on 2.7
 del _ldir
 
 # Roundup text domain
diff --git a/roundup/mailgw.py b/roundup/mailgw.py
index 23d8c2096..c12d43137 100644
--- a/roundup/mailgw.py
+++ b/roundup/mailgw.py
@@ -637,7 +637,7 @@ def parse_subject(self):
 
         # Check if the subject includes a prefix
         self.has_prefix = re.search(r'^%s\s*(\w+)\s*%s' % (delim_open,
-                                                     delim_close),
+                                                           delim_close),
                                     tmpsubject.strip())
 
         # Match the classname if specified
diff --git a/roundup/password.py b/roundup/password.py
index 03b31cf9b..e0d857fa3 100644
--- a/roundup/password.py
+++ b/roundup/password.py
@@ -398,7 +398,7 @@ class Password(JournalPassword):
     deprecated_schemes = ["SSHA", "SHA", "MD5", "crypt", "plaintext"]
     experimental_schemes = ["PBKDF2S5"]
     known_schemes = ["PBKDF2"] + experimental_schemes + \
-                    deprecated_schemes
+                deprecated_schemes
 
     def __init__(self, plaintext=None, scheme=None, encrypted=None,
                  strict=False, config=None):

From 910f6fd1b549f7d7e38a0575dc74e074ad7da53b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 May 2023 09:24:14 -0400
Subject: [PATCH 08/13] update doc on check for pre-installed roundup

---
 doc/installation.txt | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/doc/installation.txt b/doc/installation.txt
index bce5a4456..798eede67 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -200,11 +200,12 @@ Getting Roundup
 
 .. note::
     Some systems, such as Gentoo and NetBSD, already have Roundup
-    installed. Try running the command "roundup-admin" with no arguments,
-    and if it runs you may skip the `Basic Installation Steps`_
-    below and go straight to `configuring your first tracker`_.
-    However they may install an old version, so you are probably
-    beter off installing it from the roundup web site or pypi.
+    installed. Try running the command "roundup-admin -v".
+    If it runs and reports a current version, you may skip the
+    `Basic Installation Steps`_ below and go straight to
+    `configuring your first tracker`_. However it may be an old
+    version. If so you should probably install it in a virtual
+    environment from the Roundup web site or pypi.
 
 Download the latest version from https://www.roundup-tracker.org/.
 

From 31853cfa313f1cb3e3a574c7a0d6f0b3c7459912 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 May 2023 09:25:19 -0400
Subject: [PATCH 09/13] update doc on supplied templates

---
 doc/installation.txt | 44 ++++++++++++++++++++++++++++++++++++++------
 1 file changed, 38 insertions(+), 6 deletions(-)

diff --git a/doc/installation.txt b/doc/installation.txt
index 798eede67..6a3adf962 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -532,17 +532,49 @@ Choosing Your Template
 Classic Template
 ~~~~~~~~~~~~~~~~
 
-The classic template is the one defined in the `Roundup Specification`_. It
-holds issues which have priorities and statuses. Each issue may also have a
-set of messages which are disseminated to the issue's list of nosy users.
+The classic template is the one defined in the `Roundup
+Specification`_. It holds issues which have priorities and
+statuses. Each issue may also have a set of messages which are
+disseminated to the issue's list of nosy users.
 
 Minimal Template
 ~~~~~~~~~~~~~~~~
 
 The minimal template has the minimum setup required for a tracker
-installation. That is, it has the configuration files, defines a user database
-and the basic HTML interface to that. It's a completely clean slate for you to
-create your tracker on.
+installation. That is, it has the configuration files, defines a user
+database and the basic HTML interface to that. It's a completely clean
+slate for you to create your tracker on.
+
+Other Templates
+~~~~~~~~~~~~~~~
+
+There are three other templates distributed with Roundup:
+
+responsive
+   This issue tracker uses the same schema as devel.  The difference
+   between devel and responsive templates is the use of Twitter
+   bootstrap (https://github.com/twbs/bootstrap) in templates and
+   HTML5 markup.  Make sure the "static_files" setting in your
+   config.ini of your instance is set to the directory where the
+   static files live (the subdirectory "static" in the default of the
+   template).
+
+devel
+   This is a generic issue tracker that may be used to track bugs,
+   feature requests, project issues or any number of other types of
+   issues. Most users of Roundup will find that this template suits
+   them, with perhaps a few customisations.
+
+
+jinja2
+   This is a generic issue tracker based on classic schema.  It uses
+   Jinja2 for templating and Twitter bootstrap for responsive markup.
+   You will need jinja and gettext for this to work.  See the wiki
+   page https://wiki.roundup-tracker.org/Jinja2 for updates
+   between releases.
+
+Also other people have listed their trackers for different needs at:
+https://wiki.roundup-tracker.org/TrackerTemplates.
 
 .. index:: database; choosing your backend
 

From b1c1baa493e20d320a05f1b97f61aaf5594ee8b2 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 May 2023 09:28:53 -0400
Subject: [PATCH 10/13] Misc doc fixes.

---
 doc/installation.txt | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/doc/installation.txt b/doc/installation.txt
index 6a3adf962..0d76b669c 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -103,9 +103,8 @@ Timezone Definitions
 An RDBMS
   Sqlite, MySQL and Postgresql are all supported by Roundup and will be
   used if available. One of these is recommended if you are anticipating a
-  large user base (see `choosing your backend`_ below).
-
-.. index:: roundup-admin:: reindex subcommand
+  large user base (see `choosing your backend`_ below). Sqlite should
+  always be available.
 
 Xapian full-text indexer
   The Xapian_ full-text indexer is also supported and will be used by
@@ -220,7 +219,7 @@ installation:
 3. then optionally `configure a web interface`_
 4. and optionally `configure an email interface`_
 5. `UNIX environment steps`_ to take if you're installing on a shared
-   UNIX machine and want to restrict local access to roundup
+   UNIX machine and want to restrict local access to Roundup
 
 For information about how Roundup installs, see the `administration
 guide`_.
@@ -231,7 +230,7 @@ Basic Installation Steps
 ------------------------
 
 Installation of Roundup using Python3 in a virtual environment is
-probably the path of least resistance. Use::
+recommended. Use::
 
    python3 -m venv /path/to/environment/roundup
 
@@ -240,7 +239,7 @@ the Python environment using::
 
    . /path/to/environment/roundup/bin/activate
 
-then use the alias ``deactivate`` to return to the normal Python
+You can use the alias ``deactivate`` to return to the normal Python
 environment. If you create the virtual envirnment as a non-root user,
 you can install below using the same user.
 
@@ -461,15 +460,14 @@ Configuring your first tracker
       third-party database modules.  Standard python distribution
       includes anydbm and sqlite module only.
 
-      The "support" part of the tracker name can be anything you want - it
-      is going to be used as the directory that the tracker information
-      will be stored in.
+      The "support" part of the tracker home can be anything you want - it
+      is the directory where the tracker information will be stored.
 
       You will now be directed to edit the tracker configuration and
-      initial schema.  At a minimum, you must set "tracker :: web",
+      initial schema.  At a minimum, you must set "tracker :: web"
+      (that's the "web" option in the "tracker" section),
       "mail :: host", and "mail :: domain". You should also
-      set "main :: admin_email" (that's the "admin_email" option in
-      the "main" section) to your local admin address to get email
+      set "main :: admin_email" to your local admin address to get email
       on unusual occurances. If you get stuck,
       and get configuration file errors, then see the `tracker
       configuration`_ section of the `customisation documentation`_.
@@ -519,12 +517,12 @@ Configuring your first tracker
    and you should see the tracker interface.
 
    To run your tracker on some interface other than 127.0.0.1 and port
-   8080 (make sure you change the "tracker :: web" changes to match) use::
+   8080 (make sure you change the "tracker :: web" option to match) use::
 
      roundup-server -p 1080 -n 0.0.0.0 support=/opt/roundup/trackers/support
 
    to run the server at port 1080 and bind to all ip addresses on your system.
-   Then direct your web browser to ``http://your_host_name:1080/support``.
+   Then direct your web browser to ``http://your_host_name:1080/support/``.
 
 Choosing Your Template
 ----------------------

From 68fad8a7dd1fe1642526506cabe7d28565a1b4d7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 May 2023 22:12:54 -0400
Subject: [PATCH 11/13] Bump github/codeql-action from 2.3.2 to 2.3.3 -
 https://github.com/roundup-tracker/roundup/pull/28

---
 .github/workflows/anchore.yml         | 4 ++--
 .github/workflows/codeql-analysis.yml | 6 +++---
 .github/workflows/ossf-scorecard.yml  | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index aea6be273..be4a2f767 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -50,8 +50,8 @@ jobs:
         fail-build: true
     - name: Upload Anchore Scan Report
       if: always()
-      uses: github/codeql-action/upload-sarif@f3feb00acb00f31a6f60280e6ace9ca31d91c76a
-  # v2.3.2
+      uses: github/codeql-action/upload-sarif@29b1f65c5e92e24fe6b6647da1eaabe529cec70f
+  # v2.3.3
       with:
         sarif_file: ${{ steps.scan.outputs.sarif }}
     - name: Inspect action SARIF report
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 352796688..c1399b9af 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -53,7 +53,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f3feb00acb00f31a6f60280e6ace9ca31d91c76a # v2.3.2
+      uses: github/codeql-action/init@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -64,7 +64,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@f3feb00acb00f31a6f60280e6ace9ca31d91c76a # v2.3.2
+      uses: github/codeql-action/autobuild@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -78,4 +78,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f3feb00acb00f31a6f60280e6ace9ca31d91c76a # v2.3.2
+      uses: github/codeql-action/analyze@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index e8572b55f..c472a0ac1 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -70,6 +70,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f3feb00acb00f31a6f60280e6ace9ca31d91c76a # v2.1.27
+        uses: github/codeql-action/upload-sarif@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.1.27
         with:
           sarif_file: results.sarif

From e28ed195492da56def7b87dc9f0a7a9bf53b96f1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 May 2023 22:21:19 -0400
Subject: [PATCH 12/13] bump python version in docker

---
 scripts/Docker/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 9de7a3494..4bc4c1436 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -24,7 +24,7 @@ ARG source=local
 ARG pythonversion=3.11
 
 #FROM python:3-alpine
-FROM python@sha256:507818d46649f8543e58d19a00e3a1a428bb7e87c0bf7f7d1ffe7b076cda11be as build
+FROM python@sha256:50d75c092a5b58e9e62249ad02a0cbc66360c48e6f653f66d24d6d229f5fba1a as build
 
 # Inherit global values https://github.com/moby/moby/issues/37345
 ARG appdir
@@ -133,7 +133,7 @@ RUN if [ -n "$pip_mod" ]; then pip install --no-cache-dir ${pip_mod}; fi
 # build a new smaller docker image for execution. Build image above
 # is 1G in size.
 # FROM python:3-alpine
-FROM python@sha256:507818d46649f8543e58d19a00e3a1a428bb7e87c0bf7f7d1ffe7b076cda11be
+FROM python@sha256:50d75c092a5b58e9e62249ad02a0cbc66360c48e6f653f66d24d6d229f5fba1a
 
 # import from global
 ARG appdir

From 350e48195975cceff8b533a25d5c3635142455e7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 8 May 2023 02:23:15 +0000
Subject: [PATCH 13/13] Bump python from `507818d` to `30f9c5b` in
 /scripts/Docker

Bumps python from `507818d` to `30f9c5b`.

---
updated-dependencies:
- dependency-name: python
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 scripts/Docker/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 4bc4c1436..3b0283278 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -24,7 +24,7 @@ ARG source=local
 ARG pythonversion=3.11
 
 #FROM python:3-alpine
-FROM python@sha256:50d75c092a5b58e9e62249ad02a0cbc66360c48e6f653f66d24d6d229f5fba1a as build
+FROM python@sha256:30f9c5b85d6a9866dd6307d24f4688174f7237bc3293b9293d590b1e59c68fc7 as build
 
 # Inherit global values https://github.com/moby/moby/issues/37345
 ARG appdir
@@ -133,7 +133,7 @@ RUN if [ -n "$pip_mod" ]; then pip install --no-cache-dir ${pip_mod}; fi
 # build a new smaller docker image for execution. Build image above
 # is 1G in size.
 # FROM python:3-alpine
-FROM python@sha256:50d75c092a5b58e9e62249ad02a0cbc66360c48e6f653f66d24d6d229f5fba1a
+FROM python@sha256:30f9c5b85d6a9866dd6307d24f4688174f7237bc3293b9293d590b1e59c68fc7
 
 # import from global
 ARG appdir