From 4fe3494cc8df475ae677eb6360222ab4b6f38e88 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:47:26 +0000
Subject: [PATCH] deps: bump docker/scout-action

Bumps the minor-and-patch group with 1 update: [docker/scout-action](https://github.com/docker/scout-action).


Updates `docker/scout-action` from 1.24.0 to 1.26.0
- [Release notes](https://github.com/docker/scout-action/releases)
- [Commits](https://github.com/docker/scout-action/compare/7c6b6c3f7844478ace1ffd4e7aef649053d1f87d...221e7f4860634eeb1579e3bd7ca232e577bd1864)

---
updated-dependencies:
- dependency-name: docker/scout-action
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/release.yml                 | 2 +-
 .github/workflows/scheduled-security-scan.yml | 4 ++--
 .github/workflows/tests.yml                   | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 88442af5..3f8d3088 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -347,7 +347,7 @@ jobs:
       - name: Docker Scout scan the release image
         id: scout
         if: ${{ !cancelled() }}
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: local://permitio/pdp-v2:release-scan
diff --git a/.github/workflows/scheduled-security-scan.yml b/.github/workflows/scheduled-security-scan.yml
index 4b381da9..e89d831b 100644
--- a/.github/workflows/scheduled-security-scan.yml
+++ b/.github/workflows/scheduled-security-scan.yml
@@ -269,7 +269,7 @@ jobs:
         # `if:` is skipped once anything earlier in the job has failed, and a skipped report
         # leaves code scanning showing yesterday's answer for this image.
         if: ${{ !cancelled() }}
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           # `registry://`, NOT the `local://` that tests.yml uses. There is no local image
@@ -292,7 +292,7 @@ jobs:
         # Load-bearing, not defensive. Without it a failed report step skips this one, and
         # the report job would have nothing from Scout to read.
         if: ${{ !cancelled() }}
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: registry://permitio/pdp-v2:latest
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 8c1326ec..efc10c3d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -447,7 +447,7 @@ jobs:
           username: ${{ vars.DOCKERHUB_ORGANIZATION }}
 
       - name: Docker Scout CVE report (all severities)
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: local://permitio/pdp-v2:next
@@ -473,7 +473,7 @@ jobs:
 
       - name: Docker Scout CVE gate (high and critical)
         id: scout-gate
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: local://permitio/pdp-v2:next