Bump SquidSec/SquidGate from 1.0.0.pre.build.4 to 1

[dependabot]

Bumps SquidSec/SquidGate from 1.0.0.pre.build.4 to 1.

Release notes

Sourced from SquidSec/SquidGate's releases.

SquidGate v1.0.0 — GitHub Marketplace

SquidGate is an open source LLM-powered PR security gate by SquidSec.

It analyzes pull request diffs, posts annotated findings (secrets, injection, dangerous APIs, OWASP/CWE patterns), and fails the check so branch protection can block merge.

Marketplace categories (select when publishing)

Primary	Security
Secondary	Continuous integration

Install

name: SquidGate
on:
  pull_request:
    types: [opened, synchronize, reopened]
permissions:
contents: read
pull-requests: write
checks: write
jobs:
squidgate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: SquidSec/SquidGate@v1
with:
llm-api-key: ${{ secrets.LLM_API_KEY }}

Inputs

Input	Required	Description
llm-api-key	Yes	Your LLM API key (secret)
llm-provider	No	openai · anthropic · azure · google · custom
llm-model	No	e.g. gpt-4o, grok-build-0.1
llm-base-url	No	xAI / Azure / Ollama endpoint
block-on	No	Fail at high (default), critical, medium, low, or none

Highlights

... (truncated)

Changelog

Sourced from SquidSec/SquidGate's changelog.

Changelog

All notable changes to SquidGate (SquidSec) are documented here.

Release tags: v{semver}-build.{N}, with floating v1 / v1.0.

Unreleased

Fixed / Improved

• Diff acquisition: prefer GitHub API (fork/shallow-safe); git fallback uses merge-base and multiple base candidates; honor lines_before / lines_after via unified context
• LLM resilience: retries with exponential backoff on 429/5xx; Anthropic/Google re-prompt on JSON parse failure
• JSON extraction: balanced-brace parser (nested objects / braces in strings); surface parse_error on the check summary
• Category filtering: post-filter findings against policy.categories (plus CWE/text inference when category omitted)
• Prompts: few-shot secret/injection examples; disabled-category instructions; category field in schema
• Checks: single shouldBlock implementation; truncation warnings in check output
• block_on: none: correctly never blocks merge

[1.0.0] — 2026-07-28

Added

• Initial public release under MIT as SquidGate

• Diff-first LLM PR security gate (GitHub Action)

• Providers: OpenAI, Anthropic, Google, Azure, custom (xAI Grok, Ollama, …)

• Strict default policy (OWASP / CWE-oriented)

• Configurable block_on, confidence filter, custom rules

• GitHub Check Run (SquidGate) + line annotations + optional PR comment

• Unit tests for config, prompts, parsing, checks

• SquidSec branding (logo, About section)

• CI release pipeline: v1.0.0-build.N + floating v1 / v1.0

• Branch protection: SquidGate required to merge to main

• 20 language sample PRs

Commits

• ee0af7d ci: pin SquidGate action ref to v1.0.0-build.4 in release workflow
• 7a60658 ci: pin [email protected] and use self-hosted runners
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)