Merge pull request #3186 from XhmikosR/xmr/ci

Update GitHub Actions workflows

Issue #3185: fix — add several domains related to athwartwhoafat.com.

Update GitHub Actions workflows

- CodeQL: scan Actions workflows too, switch to build-mode none matrix, drop autobuild
- container: attach build provenance and SBOM to the image
- add timeout-minutes to all jobs

Release 3.16.95

Updates from BigDargon, URLHaus, someonewhocares.org, KADhosts, and hostsVN.

Merge pull request #3183 from StevenBlack/dependabot/github_actions/github-actions-e164a1557c

Bump the github-actions group with 5 updates

Bump the github-actions group with 5 updates

Bumps the github-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` |

Updates `actions/checkout` from 6.0.2 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1)

Updates `github/codeql-action/init` from 4.36.0 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

Updates `github/codeql-action/autobuild` from 4.36.0 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

Updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <redacted>

Release 3.16.94

Update graphs.

Updates from BigDargon, URLHaus, someonewhocares.org, KADhosts, and hostsVN.

Adding domain block-apple.com

Release 3.16.93

Updates from URLHaus, someonewhocares.org, and KADhosts.

Issue #3182: fix — remove domain assets-secure.applicaster.com.

Release 3.16.92

Update graph.

Updates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Issue #3176: adding apcoa-park.com.

Adding domains related to ledger-lives-desktop.io.

Release 3.16.91

Updates from BigDargon, URLhaus, someonewhocares.org, and KADhosts.

Issue #3168: adding domain karedeutschland.com.

Issue #3169: adding domain ecoprintworks.vercel.app.

Release 3.16.90

Updates from BigDargon, URLhaus, someonewhocares.org, and KADhosts.

Release 3.16.89

Updates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Issue #3166: add domains listed in this issue.

Issue #3165: remove domain toteme.com from the dormant clefspeare13 list.

Release 3.16.88

Updates from URLHaus, someonewhocares.org, and KADhosts.

Release 3.16.87

Uodates from BigDargon, URLHaus, someonewhocares.org, KADhosts, and hostsVN.

Issue #3105: yank customer.cludo.com.

Release 3.16.86

Updates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Phish me, phish you.

Merge pull request #3158 from StevenBlack/dependabot/github_actions/github-actions-9245964beb

Bump the github-actions group with 6 updates

Bump the github-actions group with 6 updates

Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.2` | `4.36.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |
| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `6.0.0` | `6.1.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.1.0` | `7.2.0` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |

Updates `github/codeql-action` from 4.35.2 to 4.36.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...7211b7c8077ea37d8641b6271f6a365a22a5fbfa)

Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5)

Updates `docker/login-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee)

Updates `docker/metadata-action` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/030e881283bb7a6894de51c315a6bfe6a94e05cf...80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9)

Updates `docker/build-push-action` from 7.1.0 to 7.2.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/bcafcacb16a39f128d818304e6c9c0c18556b85f...f9f3042f7e2789586610d6e8b85c8f03e5195baf)

Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/metadata-action
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/dependency-review-action
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <redacted>

Release 3.16.85

Updates from URLHaus, someonewhocares.org, and KADhosts.

Release 3.16.84

Uodates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Issue #3154: adding flipboxstudio.info.

Release 3.16.83

Updates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Release 3.16.82

Updates fron BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Update the list from yoyo.org.

Release 3.16.81

Updates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Issue #3126: add 5 domains.

Update the release-it dependency.

Release 3.16.80

Updates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Issue #3123: remove waterfordwhispersnews.com.

Release 3.16.79

Updates from URLHaus, someonewhocares.org, and KADhosts.

Merge pull request #3120 from glensc/patch-1

Doc: Add docker build instructions without git clone

Doc: Add docker build instructions without git clone

Add instructions for building Docker image directly from GitHub.

Issue #3119: add stats-collector.cxense.com.

Release 3.16.78

Updates from URLHaus, someonewhocares.org, and KADhosts.

Merge pull request #3118 from StevenBlack/dependabot/github_actions/github-actions-40e65644f9

Bump the github-actions group with 3 updates

Bump the github-actions group with 3 updates

Bumps the github-actions group with 3 updates: [github/codeql-action](https://github.com/github/codeql-action), [docker/login-action](https://github.com/docker/login-action) and [docker/build-push-action](https://github.com/docker/build-push-action).

Updates `github/codeql-action` from 4.35.1 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

Updates `docker/login-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/b45d80f862d83dbcd57f89517bcf500b2ab88fb2...4907a6ddec9925e35a0a9e82d7399ccc52663121)

Updates `docker/build-push-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/d08e5c354a6adb9ed34480a06d141179aa583294...bcafcacb16a39f128d818304e6c9c0c18556b85f)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <redacted>

Merge pull request #3076 from 30350n/flake-nixfmt

Add nixfmt to nix devShell, reformat flake.nix, Ignore flake.lock

Add nixfmt to nix devShell, reformat flake.nix, Ignore flake.lock

Release 3.16.77

Updates from URLHaus, someonewhocares.org, and KADhosts.

Merge pull request #3077 from 30350n/unbound-confs-rework

Rework "Generate unbound configuration files from blocklist files (#2833)"

Add documentation for unbound configs

Use lib.sourceByRegex to filter source files

Fix building unbound configs for alternates

Use runCommandLocal instead of mkDerivation, pipe instead of cat

Add unbound config nix package

Release 3.16.76

Updates from Sinfonietta, Bigdargon, URLHaus, someonewhocares.org, and KADhosts.

Release 3.16.75

Updates from URLHaus, someonewhocares.org, minecraft-hosts, and KADhosts.

Release 3.16.74

Updates from URLHaus, someonewhocares.org, and KADhosts.

Phishing me is not a great idea.

Release 3.16.73

Updates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.

Merge pull request #3100 from StevenBlack/dependabot/github_actions/github-actions-27e5dbfb8b

Bump the github-actions group with 6 updates

Merge pull request #3099 from HomeLabineer/add-axios-c2-domains

Add axios supply chain attack C2 domains

Bump the github-actions group with 6 updates

Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.32.4` | `4.35.1` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.0.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.0.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.10.0` | `6.0.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.0.0` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.8.3` | `4.9.0` |

Updates `github/codeql-action` from 4.32.4 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...c10b8064de6f491fea524254123dbe5e09572f13)

Updates `docker/setup-buildx-action` from 3.12.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd)

Updates `docker/login-action` from 3.7.0 to 4.0.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2)

Updates `docker/metadata-action` from 5.10.0 to 6.0.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/c299e40c65443455700f0fdfc63efafe5b349051...030e881283bb7a6894de51c315a6bfe6a94e05cf)

Updates `docker/build-push-action` from 6.19.2 to 7.0.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/10e90e3645eae34f1e60eeb005ba3a3d33f178e8...d08e5c354a6adb9ed34480a06d141179aa583294)

Updates `actions/dependency-review-action` from 4.8.3 to 4.9.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](https://github.com/actions/dependency-review-action/compare/05fe4576374b728f0c523d6a13d64c25081e0803...2031cfc080254a8a887f58cffee85186f0e49e48)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/metadata-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/dependency-review-action
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <redacted>

Add axios supply chain attack C2 domains (sfrclak.com, callnrwise.com)

Closes #3098

These domains were used as C2 infrastructure in the axios npm supply
chain attack on March 31, 2026 (GHSA-fw8c-xr5c-95f9). Malicious
versions axios@1.14.1 and axios@0.30.4 were published via a hijacked
maintainer account, injecting a RAT that beacons to these domains.

References:
- https://github.com/advisories/GHSA-fw8c-xr5c-95f9
- https://socket.dev/blog/axios-npm-package-compromised

Release 3.16.72

Updates from URLHaus, someonewhocares.org, and KADhosts.

Issue #3097 — adding kra18.com.

Release 3.16.71

Updates from Sinfonietta, URLHaus, someonewhocares.org, and KADhosts.

Issue #3093: adding domain porewin.net.

Adding cstasa.ca because attempting to phish me is a bad idea.

Release 3.16.70

Updates from URLHaus, someonewhocares.org, and KADhosts.

Issue #3092: add two optoutadvertising.com domains.

Release 3.16.69

Updates from BigDargon, URLHaus, someonewhocares.org, and KADhosts.