From 1ccc8f09a5beeab173e20f5ef01028f3b1ac5cc2 Mon Sep 17 00:00:00 2001
From: lijunlong <lijunlong@openresty.com>
Date: Mon, 24 Aug 2026 13:01:18 +0800
Subject: [PATCH 1/2] tests: update nginx to 1.31.4

---
 .github/workflows/build_and_test.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index f3ce2cbac9..4be07c54a3 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -15,22 +15,22 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - name: "nginx 1.31.3 + OpenSSL"
-            NGINX_VERSION: "1.31.3"
+          - name: "nginx 1.31.4 + OpenSSL"
+            NGINX_VERSION: "1.31.4"
             TEST_NGINX_TIMEOUT: "5"
 
-          - name: "nginx 1.31.3 + OpenSSL + HTTP/2"
-            NGINX_VERSION: "1.31.3"
+          - name: "nginx 1.31.4 + OpenSSL + HTTP/2"
+            NGINX_VERSION: "1.31.4"
             TEST_NGINX_TIMEOUT: "5"
             TEST_NGINX_USE_HTTP2: "1"
 
-          - name: "nginx 1.31.3 + OpenSSL + HTTP/3"
-            NGINX_VERSION: "1.31.3"
+          - name: "nginx 1.31.4 + OpenSSL + HTTP/3"
+            NGINX_VERSION: "1.31.4"
             TEST_NGINX_USE_HTTP3: "1"
             TEST_NGINX_QUIC_IDLE_TIMEOUT: "3"
 
-          - name: "nginx 1.31.3 + BoringSSL + HTTP/3"
-            NGINX_VERSION: "1.31.3"
+          - name: "nginx 1.31.4 + BoringSSL + HTTP/3"
+            NGINX_VERSION: "1.31.4"
             BORINGSSL: "1"
             TEST_NGINX_USE_HTTP3: "1"
             TEST_NGINX_QUIC_IDLE_TIMEOUT: "3"

From 3250e1bbaf21cbc7a102d74870e7168e2084e7e9 Mon Sep 17 00:00:00 2001
From: lijunlong <lijunlong@openresty.com>
Date: Mon, 24 Aug 2026 15:14:13 +0800
Subject: [PATCH 2/2] ci: update actions for Node.js 24

---
 .github/workflows/build_and_test.yml        | 4 ++--
 .github/workflows/semantic-pull-request.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index 4be07c54a3..aee5fd8c11 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -75,7 +75,7 @@ jobs:
       MALLOC_PERTURB_: "9"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Install system packages
         run: |
@@ -102,7 +102,7 @@ jobs:
             openresty-pcre2 openresty-openssl3 openresty-pcre2-dev openresty-openssl3-dev
 
       - name: Cache download directory
-        uses: actions/cache@v4
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: download-cache
           key: download-cache-${{ runner.os }}-drizzle-${{ env.DRIZZLE_VER }}
diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml
index 12b87cb3c1..f7a470c4ad 100644
--- a/.github/workflows/semantic-pull-request.yml
+++ b/.github/workflows/semantic-pull-request.yml
@@ -12,7 +12,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v4
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: