chore(deps): bump oracle/macaron from 0.24.0 to 0.25.0

[dependabot]

Bumps oracle/macaron from 0.24.0 to 0.25.0.

Release notes

Sourced from oracle/macaron's releases.

v0.25.0 (2026-07-26)

Feat

• add inference for rebuilding Python wheels that bundle Rust binaries. (#1408)
• new malware sourcecode detection for anti-analysis behaviour (#1388)

Fix

• action: replace string-built GitHub Action commands with a bash argv array and direct execution (#1424)
• cleanup PyPI package temp directory and prevent leaks (#1404)
• prefer tag commits over attestation commits (#1401)

Changelog

Sourced from oracle/macaron's changelog.

v0.25.0 (2026-07-26)

Feat

• add inference for rebuilding Python wheels that bundle Rust binaries. (#1408)
• new malware sourcecode detection for anti-analysis behaviour (#1388)

Fix

• action: replace string-built GitHub Action commands with a bash argv array and direct execution (#1424)
• cleanup PyPI package temp directory and prevent leaks (#1404)
• prefer tag commits over attestation commits (#1401)

v0.24.0 (2026-04-24)

Feat

• improve Macaron's GitHub Actions reports (#1376)
• add license filtering with compliance check (#1379)
• add support for uv build tool (#1350)
• improve source code detection using malware insights on obfuscation (#1378)
• extend build command information in buildspec (#1308)

v0.23.0 (2026-03-31)

Feat

• add more inputs to Macaron Action and improve GitHub Action analysis (#1339)
• change dockerfile generation for Python rebuild to always default to standard build command (#1336)
• adjusted max_download_size to 30MB (#1337)

Fix

• improve URL validation to avoid unexpected redirects (#1344)
• allow parsing of github expressions containing non-breaking-space characters, and allow dataflow analysis to fail (#1340)
• improve has_binary flag condition for Python buildspec generation (#1333)

v0.22.0 (2026-02-25)

Feat

• prepare metadata for Macaron Action to publish on Marketplace (#1315)
• add the JSON schema for the default Macaron buildspec (#1314)

v0.21.0 (2026-02-23)

Feat

• validate buildspec dockerfile (#1280)
• improve buildspec and dockerfile generation (#1279)

... (truncated)

Commits

• 794eec3 bump: release 0.24.0 → 0.25.0
• fc3429c chore(deps): update semgrep to the latest (#1438)
• 7175c36 chore(deps): update the ol base image (#1436)
• 5ebfcf8 chore(deps): upgrade go dependencies (#1435)
• c0df90b chore(deps): address advisories for the mcp transitive dependency (#1434)
• dbe410d feat: add inference for rebuilding Python wheels that bundle Rust binaries. (...
• 56f35b1 chore: temporarily ignore PYSEC-2026-2132 till Semgrep allows Click >=8.3.3 (...
• d4c9c9a chore: introduce the Ruff pre-commit hook to replace a bunch of other code fo...
• cae2c5c fix(action): replace string-built GitHub Action commands with a bash argv arr...
• 59bfc67 chore(deps): update go dependencies (#1414)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)