build(deps): bump the minor-and-patch group across 1 directory with 7 updates - #98
Open
dependabot[bot] wants to merge 1 commit into
Open
build(deps): bump the minor-and-patch group across 1 directory with 7 updates#98dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
… updates Bumps the minor-and-patch group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.1.0` | `7.3.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.35.2` | `4.37.4` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.35.2` | `4.37.4` | | [oxsecurity/megalinter/flavors/security](https://github.com/oxsecurity/megalinter) | `9.4.0` | `9.6.0` | | [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) | `7.1.0` | `7.2.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.35.2` | `4.37.4` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | Updates `docker/build-push-action` from 7.1.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@bcafcac...53b7df9) Updates `github/codeql-action/init` from 4.35.2 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...f205ea1) Updates `github/codeql-action/analyze` from 4.35.2 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...f205ea1) Updates `oxsecurity/megalinter/flavors/security` from 9.4.0 to 9.6.0 - [Release notes](https://github.com/oxsecurity/megalinter/releases) - [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md) - [Commits](oxsecurity/megalinter@8fbdead...ef3e84b) Updates `stefanzweifel/git-auto-commit-action` from 7.1.0 to 7.2.0 - [Release notes](https://github.com/stefanzweifel/git-auto-commit-action/releases) - [Changelog](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md) - [Commits](stefanzweifel/git-auto-commit-action@04702ed...4a55954) Updates `github/codeql-action/upload-sarif` from 4.35.2 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...f205ea1) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github/codeql-action/init dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github/codeql-action/analyze dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: oxsecurity/megalinter/flavors/security dependency-version: 9.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: stefanzweifel/git-auto-commit-action dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ REPOSITORY | betterleaks | yes | no | no | 1.67s | |
| ✅ REPOSITORY | checkov | yes | no | no | 25.34s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.24s | |
| ✅ REPOSITORY | grype | yes | no | no | 68.73s | |
| ✅ REPOSITORY | kingfisher | yes | no | no | 9.49s | |
| ✅ REPOSITORY | osv-scanner | yes | no | no | 0.22s | |
| ✅ REPOSITORY | secretlint | yes | no | no | 1.47s | |
| semgrep | yes | 1 | 3 | 31.11s | ||
| ✅ REPOSITORY | syft | yes | no | no | 2.23s | |
| ✅ REPOSITORY | trivy | yes | no | no | 13.91s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.15s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.91s |
Detailed Issues
⚠️ REPOSITORY / semgrep - 1 error
warning: This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
┌─ .github/dependabot.yml:8:5
│
8 │ - package-ecosystem: "github-actions" # See documentation for possible values
│ ╭─────^
9 │ │ directory: "/" # Location of package manifests
10 │ │ schedule:
11 │ │ interval: "weekly"
· │
16 │ │ - "minor"
17 │ │ - "patch"
│ ╰───────────────────^
warning: A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level `env:` so the secret is only available where it is actually needed.
┌─ .github/workflows/megalinter.yml:21:20
│
21 │ GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
│ ^^^^^^^^^^^^
warning: A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level `env:` so the secret is only available where it is actually needed.
┌─ .github/workflows/megalinter.yml:22:31
│
22 │ GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}
│ ^^^^^^^^^^^^
warning: 3 warnings emitted
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff
Show us your support by starring ⭐ the repository
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the minor-and-patch group with 7 updates in the / directory:
7.1.07.3.04.35.24.37.44.35.24.37.49.4.09.6.07.1.07.2.04.35.24.37.42.4.32.4.4Updates
docker/build-push-actionfrom 7.1.0 to 7.3.0Release notes
Sourced from docker/build-push-action's releases.
Commits
53b7df9Merge pull request #1572 from docker/dependabot/npm_and_yarn/docker/actions-t...154298c[dependabot skip] chore: update generated contentcb1238bchore(deps): Bump@docker/actions-toolkitfrom 0.91.0 to 0.92.024f845dMerge pull request #1566 from docker/dependabot/npm_and_yarn/js-yaml-4.2.09c69730[dependabot skip] chore: update generated contentbc3a3a5Merge pull request #1574 from docker/dependabot/github_actions/aws-actions/co...a82c504chore(deps): Bump js-yaml from 4.1.1 to 4.3.00285a75Merge pull request #1573 from docker/dependabot/github_actions/actions/cache-...c6ad2a3Merge pull request #1575 from docker/dependabot/github_actions/actions/checko...d37484fMerge pull request #1564 from docker/dependabot/npm_and_yarn/undici-6.27.0Updates
github/codeql-action/initfrom 4.35.2 to 4.37.4Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
f205ea1Merge pull request #4053 from github/update-v4.37.4-9130ce0f7e40d079Update changelog for v4.37.49130ce0Merge pull request #4051 from github/update-bundle/codeql-bundle-v2.26.2c62d824Add changelog noteda0c190Update default bundle to codeql-bundle-v2.26.218420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kindsUpdates
github/codeql-action/analyzefrom 4.35.2 to 4.37.4Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
f205ea1Merge pull request #4053 from github/update-v4.37.4-9130ce0f7e40d079Update changelog for v4.37.49130ce0Merge pull request #4051 from github/update-bundle/codeql-bundle-v2.26.2c62d824Add changelog noteda0c190Update default bundle to codeql-bundle-v2.26.218420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kindsUpdates
oxsecurity/megalinter/flavors/securityfrom 9.4.0 to 9.6.0Release notes
Sourced from oxsecurity/megalinter/flavors/security's releases.
... (truncated)
Changelog
Sourced from oxsecurity/megalinter/flavors/security's changelog.
... (truncated)
Commits
ef3e84bRelease MegaLinter v9.6.08b9259bSkill prepare-release (#8245)5810155chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 in /.config/python/...aca415cchore(deps): update dependency semver to v7.8.5 (#8198)2d8b274Remove max-parallel for linterse9ab3e9chore(ci): manual run of deploy linters beta job (#8242)a8a6368Changelog (#8241)7f363c6[automation] Auto-update linters version, help and documentation (#8215)bce5232chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.25 (#8232)9d98266chore(deps): update dependency realm/swiftlint to v0.65.0 (#8240)Updates
stefanzweifel/git-auto-commit-actionfrom 7.1.0 to 7.2.0Release notes
Sourced from stefanzweifel/git-auto-commit-action's releases.
Changelog
Sourced from stefanzweifel/git-auto-commit-action's changelog.