v1.6.0 update

[FlorentinD]

Thank you for your contribution to the Graph Visualization for Python project by Neo4j.

Before submitting this PR, please read Contributing to the Neo4j Ecosystem.

Make sure:

• You signed the Neo4j CLA (Contributor License Agreement) so that we are allowed to ship your code in our library
• Your contribution is covered by tests

[semgrep-code-neo4j]

Semgrep identified an issue in your code:

extractions/setup-just@v2 uses a movable third-party tag, so a retagged or compromised action could run attacker-controlled code in CI and access Aura credentials.

More details about this

Install just pulls extractions/setup-just@v2, which is a moving tag from a third-party GitHub repository rather than a specific commit. If the extractions/setup-just repo is compromised or its v2 tag is retargeted, this workflow will run the attacker’s code on the runner before just py-ci-test-gds starts, with access to the job environment including AURA_API_CLIENT_ID, ${{ secrets.AURA_API_CLIENT_SECRET }}, and AURA_API_PROJECT_ID.

A plausible attack looks like this:

1. An attacker gains control of the extractions/setup-just repository or its release/tag management.
2. They move the v2 tag to a new commit that adds a malicious step inside the action.
3. When this workflow runs uses: extractions/setup-just@v2, GitHub Actions fetches that new code automatically because the reference is not immutable.
4. The malicious action reads the job’s environment or workspace and exfiltrates values such as AURA_API_CLIENT_SECRET, for example by sending them to an attacker-controlled server.
5. The attacker can then use the stolen Aura credentials and project ID to access or manipulate the same Aura resources this test job uses.

Because the reference is @v2 instead of a full 40-character commit SHA, anyone who can change what v2 points to can change what code your CI executes.

To resolve this comment:

✨ Commit fix suggestion

1. Replace the tag-based action reference with a full 40-character commit SHA in the uses line.
   Change uses: extractions/setup-just@v2 to uses: extractions/setup-just@<full-commit-sha> # v2.

2. Resolve the SHA from the current v2 release in the extractions/setup-just repository, and use that exact commit hash instead of the tag.
   This keeps the workflow on the intended version while making the action immutable.

3. Keep the version comment after the SHA so future updates are easier to review.
   Use the same format as uses: extractions/setup-just@<full-commit-sha> # v2.

4. Alternatively, if you need to stay aligned with a newer upstream release instead of the current v2 target, pin to the full commit SHA for that newer release and update the trailing comment to match, for example # v3.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.

To get more information about secure coding and some most popular vulnerabilities, check our secure coding guidelines

_{You can view more details about this finding in the Semgrep AppSec Platform.}