From c08420e38d0989c9dfb49014c71ccc5602df6ce1 Mon Sep 17 00:00:00 2001
From: GitHub Security Bot
 <88103841+github-security-bot@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:31:32 -0400
Subject: [PATCH 1/2] Pin GitHub Actions to commit SHAs

---
 .github/dependabot.yml               | 2 ++
 .github/workflows/build.yml          | 2 +-
 .github/workflows/github-release.yml | 6 +++---
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5ace4600..6cc00712 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c1609014..52833ac6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,7 +13,7 @@ jobs:
         ruby: [ '2.7', '3.0', '3.1', '3.2', '3.4', '4.0' ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Ruby ${{ matrix.ruby }}
       uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b #v1.269.0 tag
       with:
diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
index facfde44..8dcdd6c5 100644
--- a/.github/workflows/github-release.yml
+++ b/.github/workflows/github-release.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Ruby
@@ -26,7 +26,7 @@ jobs:
           RELEASE_NAME=${GITHUB_REF#"refs/tags/"}
           echo "RELEASE_NAME=${RELEASE_NAME}" >> $GITHUB_ENV
       - name: Publish release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -34,4 +34,4 @@ jobs:
           release_name: ${{ env.RELEASE_NAME }}
           draft: false
           prerelease: false
-      - uses: rubygems/release-gem@v1
+      - uses: rubygems/release-gem@7f9650160c1a4e7989fdc9855807bdbd421d8b6b # v1.4.1

From 84d9619c7c82699012a843472b4ce312e04189cf Mon Sep 17 00:00:00 2001
From: Matt Langlois <fletchto99@github.com>
Date: Thu, 10 Sep 2026 15:44:21 -0600
Subject: [PATCH 2/2] Fix configuration spec linting on Ruby 2.7

Use RSpec's attribute matcher instead of dynamic public_send calls so the copy assertion no longer needs a suppression for a cop missing from older rubocop-github versions. Keep coverage of every copied attribute without relaxing lint enforcement.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 spec/lib/secure_headers/configuration_spec.rb | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/spec/lib/secure_headers/configuration_spec.rb b/spec/lib/secure_headers/configuration_spec.rb
index 420e4f26..fe1216f7 100644
--- a/spec/lib/secure_headers/configuration_spec.rb
+++ b/spec/lib/secure_headers/configuration_spec.rb
@@ -22,9 +22,8 @@ module SecureHeaders
       configuration = Configuration.dup
       expect(original_configuration).not_to be(configuration)
       Configuration::CONFIG_ATTRIBUTES.each do |attr|
-        # rubocop:disable GitHub/AvoidObjectSendWithDynamicMethod
-        expect(original_configuration.public_send(attr)).to eq(configuration.public_send(attr))
-        # rubocop:enable GitHub/AvoidObjectSendWithDynamicMethod
+        expected_value = original_configuration.instance_variable_get("@#{attr}")
+        expect(configuration).to have_attributes(attr => expected_value)
       end
     end