chore(deps): update dependency sixlabors.imagesharp to v4

act_runner laedt reusable workflows per git-clone ueber HTTPS. Dieser Pfad
ist auf der Forge seit 2026-08-12 defekt (git upload-pack --stateless-rpc
bricht mit BUG "packfile_uris requires sideband-all" ab). Die Scans liefen
bisher nur ueber eine im Juni gecachte Kopie im Runner.

Der Scan steht jetzt vollstaendig in dieser Datei, der Quellstand kommt als
tar-Archiv statt ueber actions/checkout. Zurueckbauen, sobald git fetch
ueber HTTPS wieder funktioniert.

.gitea/workflows/build.yml

@@ -35,7 +35,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
         with:
           dotnet-version: 10.0.x
 

.gitea/workflows/release.yml

@@ -54,7 +54,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
         with:
           dotnet-version: 10.0.x
 

.gitea/workflows/security.yml

@@ -1,4 +1,21 @@
 name: Security
+
+# Self-contained security scan: Semgrep SAST + Trivy filesystem scan.
+#
+# Deliberately NOT calling the reusable workflow in security-workflows:
+# act_runner fetches reusable workflows by cloning them over HTTPS, and git
+# fetch over HTTPS is broken on this Gitea instance since 2026-08-12
+# (`git upload-pack --stateless-rpc` aborts with
+# BUG("packfile_uris requires sideband-all") and dumps core). The runner only
+# kept working because it still had a June copy in its action cache. Inlining
+# removes that dependency entirely.
+#
+# For the same reason the sources are pulled as a tar archive instead of via
+# actions/checkout. Restore the reusable call once the fetch path is fixed.
+#
+# Why one job, not two parallel jobs: act_runner v0.6.1 has a race when two
+# jobs in the same task share a workspace and chown it in parallel.
+
 on:
   push:
     branches: [main, master]
@@ -7,14 +24,60 @@ on:
     - cron: '0 6 * * 1'
   workflow_dispatch:
 
+env:
+  TRIVY_SEVERITY: 'CRITICAL,HIGH'
+  # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind;
+  # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht.
+  SEMGREP_EXCLUDE_RULES: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'
+
 jobs:
   scan:
-    uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
+    name: Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        env:
+          TOKEN: ${{ github.token }}
+          # On pull_request the merge SHA may not be archivable, use the head.
+          REF: ${{ github.event.pull_request.head.sha || github.sha }}
+          SERVER: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -eu
+          echo "Fetching archive for $REPO @ $REF"
+          curl -sfL --retry 3 --retry-delay 5 \
+            -H "Authorization: token $TOKEN" \
+            "$SERVER/$REPO/archive/$REF.tar.gz" -o /tmp/source.tar.gz
+          tar xzf /tmp/source.tar.gz --strip-components=1
+          rm -f /tmp/source.tar.gz
+          echo "Extracted $(find . -type f | wc -l) files"
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
         with:
-      # MessageStore.cs uses string-interpolation in CommandText for table
+          python-version: '3.x'
-      # names and clause-joins that come from internal code constants, not
+
-      # user input. Values are bound via SqlParameter, the SQL surface is
+      - name: Install Semgrep
-      # local-only inside a Dalamud plugin. Semgrep matches the pattern
+        run: pip install --no-cache-dir semgrep
-      # without dataflow, so it flags those eight call sites; CodeQL
+
-      # would not. Suppressed for this repo only.
+      - name: Install Trivy
-      semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'
+        # Version pinned so the install script does not hit api.github.com to
+        # resolve "latest", which burns the runner's unauthenticated rate limit.
+        # renovate: datasource=github-releases depName=aquasecurity/trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.70.0
+
+      - name: Run Semgrep SAST
+        run: |
+          args="--config=auto --error --severity=ERROR"
+          if [ -n "$SEMGREP_EXCLUDE_RULES" ]; then
+            for rule in $(echo "$SEMGREP_EXCLUDE_RULES" | tr ',' ' '); do
+              args="$args --exclude-rule=$rule"
+            done
+          fi
+          echo "Running: semgrep scan $args"
+          semgrep scan $args
+
+      - name: Run Trivy filesystem scan
+        # if: always() — surface Trivy findings even when Semgrep fails first.
+        if: always()
+        run: trivy fs --severity "$TRIVY_SEVERITY" --exit-code 1 --ignore-unfixed .

HellionChat/HellionChat.csproj

@@ -14,7 +14,7 @@
     <ItemGroup>
         <!-- Closed ranges prevent surprise major bumps during lock file regeneration -->
         <PackageReference Include="MessagePack" Version="[3.1.4, 4.0.0)" />
-        <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.7" />
+        <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.8" />
         <!-- v1.5.0 DI-container foundation; matches Lightless pin (Hosting 10.0.7) -->
         <PackageReference
             Include="Microsoft.Extensions.DependencyInjection"
@@ -30,9 +30,9 @@
              Media-Foundation-based codecs do not). Using the sub-package avoids pulling in
              NAudio.WinForms (which requires WindowsDesktop and does not build on Linux hosts).
              WaveOutEvent and WaveFileReader both live in NAudio.WinMM + NAudio.Core. -->
-        <PackageReference Include="NAudio.WinMM" Version="2.2.1" />
+        <PackageReference Include="NAudio.WinMM" Version="2.3.0" />
         <PackageReference Include="Pidgin" Version="[3.5.1, 4.0.0)" />
-        <PackageReference Include="SixLabors.ImageSharp" Version="[3.1.12, 4.0.0)" />
+        <PackageReference Include="SixLabors.ImageSharp" Version="[3.1.12,4.1.0]" />
     </ItemGroup>
 
     <ItemGroup>

HellionChat/packages.lock.json

@@ -27,11 +27,11 @@
       },
       "Microsoft.Data.Sqlite": {
         "type": "Direct",
-        "requested": "[10.0.7, )",
+        "requested": "[10.0.8, )",
-        "resolved": "10.0.7",
+        "resolved": "10.0.8",
-        "contentHash": "DZ6G2QuyPrsh5VS+wfiZbNBtYT6p+CkxXjD0aZHF04xso7QsG/uk0JpG30hzYlK6u/wtTzta1Dqfgbc/Sl2sDA==",
+        "contentHash": "iyDWyD6r/SnqgoYYQIlLhxL1ZIGZr+SByMXrJKSA1w7sOt7bPMJmN3h2laqwKqyQkjh/lUPJ7LTXwpvqzhggOQ==",
         "dependencies": {
-          "Microsoft.Data.Sqlite.Core": "10.0.7",
+          "Microsoft.Data.Sqlite.Core": "10.0.8",
           "SQLitePCLRaw.bundle_e_sqlite3": "2.1.11",
           "SQLitePCLRaw.core": "2.1.11"
         }
@@ -104,11 +104,11 @@
       },
       "NAudio.WinMM": {
         "type": "Direct",
-        "requested": "[2.2.1, )",
+        "requested": "[2.3.0, )",
-        "resolved": "2.2.1",
+        "resolved": "2.3.0",
-        "contentHash": "xFHRFwH4x6aq3IxRbewvO33ugJRvZFEOfO62i7uQJRUNW2cnu6BeBTHUS0JD5KBucZbHZaYqxQG8dwZ47ezQuQ==",
+        "contentHash": "5G1dRjsZm50T3luyuqcmI2BSvj3K4ZJaD/x776/0Epj88qOsOryDZG40+MufwIk1UFJSFWhRobBqtJYFc8Ss4g==",
         "dependencies": {
-          "NAudio.Core": "2.2.1"
+          "NAudio.Core": "2.3.0"
         }
       },
       "Pidgin": {
@@ -119,7 +119,7 @@
       },
       "SixLabors.ImageSharp": {
         "type": "Direct",
-        "requested": "[3.1.12, 4.0.0)",
+        "requested": "[3.1.12, 4.1.0]",
         "resolved": "3.1.12",
         "contentHash": "iAg6zifihXEFS/t7fiHhZBGAdCp3FavsF4i2ZIDp0JfeYeDVzvmlbY1CNhhIKimaIzrzSi5M/NBFcWvZT2rB/A=="
       },
@@ -141,8 +141,8 @@
       },
       "Microsoft.Data.Sqlite.Core": {
         "type": "Transitive",
-        "resolved": "10.0.7",
+        "resolved": "10.0.8",
-        "contentHash": "xVrtBg3M1wJlBDkoT0dXEYB/wSc8bIHJPYtw/bu1AqpWgF79uPSs87DAhERR/Ilumre6TKZa1cjMg3VUUObVLA==",
+        "contentHash": "26t7WDiEjjAls/sFpWvVEFDxt+7Q5VPt6+blU2Lafuj9L8PzAv/GtGV4cqVPtrhWbfD2BX/z2v8hD1qXYtK6Aw==",
         "dependencies": {
           "SQLitePCLRaw.core": "2.1.11"
         }
@@ -377,8 +377,8 @@
       },
       "NAudio.Core": {
         "type": "Transitive",
-        "resolved": "2.2.1",
+        "resolved": "2.3.0",
-        "contentHash": "GgkdP6K/7FqXFo7uHvoqGZTJvW4z8g2IffhOO4JHaLzKCdDOUEzVKtveoZkCuUX8eV2HAINqi7VFqlFndrnz/g=="
+        "contentHash": "jMd7r6dB6tAtXhOYL58ntPqwERNm1/Rhw5MKOIYvsnXzuX+PTGsa2VMam6n0npZYSwlSidKa4GAm4bFcXFUlcg=="
       },
       "SQLitePCLRaw.bundle_e_sqlite3": {
         "type": "Transitive",