chore(deps): update all non-major dependencies

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
GoogleCloudPlatform/functions-framework-conformance	action	minor	v1.2.1 -> v1.8.6
GoogleCloudPlatform/functions-framework-conformance	action	patch	v1.8.3 -> v1.8.6
actions/checkout	action	minor	v3.1.0 -> v3.6.0
actions/checkout	action	minor	v3.5.0 -> v3.6.0
github/codeql-action	action	minor	v2.1.27 -> v2.22.5
ossf/scorecard-action	action	minor	v2.0.6 -> v2.3.1
step-security/harden-runner	action	minor	v2.5.1 -> v2.6.0

---

Release Notes

GoogleCloudPlatform/functions-framework-conformance (GoogleCloudPlatform/functions-framework-conformance)

v1.8.6

Compare Source

Client

Fix: Set the FUNCTION_SIGNATURE_TYPE env var as event when legacyevent is passed as function type flag

v1.8.5

Compare Source

Client

• Add support for the specification of a custom builder image to use via new -builder-url flag.

v1.8.4

Compare Source

Client

• Adds support for specifying runtime version using the builder-runtime-version flag.

v1.8.3

Compare Source

Client

• Added FUNCTION_SIGNATURE_TYPE to the set of env vars populated at runtime.

v1.8.2

Compare Source

Client

• Added conformance tests for new typed declarative function signature that interoperates with http triggers.

v1.8.1

Compare Source

Client

• Change builder image used to the language specific unified builder used in prod.

v1.8.0

Compare Source

Client

• Update builder image path

v1.7.0

Compare Source

Actions

• Add cache-path parameter to actions/client/install Action

v1.6.0

Compare Source

Client

• Add -envs flag to add runtime env vars to the function run

v1.5.5

Compare Source

Workflows

• Add default value of function_output.json for buildpack integration test workflow so it doesn't need to be explicitly specified by callers

v1.5.4

Compare Source

Client

• respect -output-file flag in buildpacks mode
• ensure conformance test server logs are printed when validation fails

v1.5.3

Compare Source

Workflows

• Add output-file parameter for buildpack integration test workflow

v1.5.2

Compare Source

Workflows

• Add start-delay parameter to buildpack integration test workflow

v1.5.1

Compare Source

Client

• Make buildpack conformance test mode closer to GCF builds

v1.5.0

Compare Source

v1.4.1

Compare Source

Workflows

• Add prerun script hook to buildpack-integration-test.yml Workflow

v1.4.0

Compare Source

Client

• Update to use the latest version of pack library

Workflows

• New buildpack-integration-test.yml reusable Workflow and helper Actions for testing Functions Frameworks with GCF builders

v1.3.1

Compare Source

Action

• Update action to support validateConcurrency parameter which maps to the client's -validate-concurrency flag

v1.3.0

Compare Source

Client

• Add ability to send concurrent requests to test concurrency support

actions/checkout (actions/checkout)

v3.6.0

Compare Source

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

v3.5.3

Compare Source

• Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in
• Fix typos found by codespell
• Add support for sparse checkouts

v3.5.2

Compare Source

• Fix api endpoint for GHES

v3.5.1

Compare Source

• Fix slow checkout on Windows

v3.5.0

Compare Source

• Add new public key for known_hosts

v3.4.0

Compare Source

• Upgrade codeql actions to v2
• Upgrade dependencies
• Upgrade @​actions/io

v3.3.0

Compare Source

• Implement branch list using callbacks from exec function
• Add in explicit reference to private checkout options
• Fix comment typos (that got added in #​770)

v3.2.0

Compare Source

• Add GitHub Action to perform release
• Fix status badge
• Replace datadog/squid with ubuntu/squid Docker image
• Wrap pipeline commands for submoduleForeach in quotes
• Update @​actions/io to 1.1.2
• Upgrading version to 3.2.0

github/codeql-action (github/codeql-action)

v2.22.5

Compare Source

v2.22.4

Compare Source

v2.22.3

Compare Source

v2.22.2

Compare Source

v2.22.1

Compare Source

v2.22.0

Compare Source

v2.21.9

Compare Source

v2.21.8

Compare Source

v2.21.7

Compare Source

v2.21.6

Compare Source

v2.21.5

Compare Source

v2.21.4

Compare Source

v2.21.3

Compare Source

v2.21.2

Compare Source

v2.21.1

Compare Source

v2.21.0

Compare Source

v2.20.4

Compare Source

v2.20.3

Compare Source

v2.20.2

Compare Source

v2.20.1

Compare Source

v2.20.0

Compare Source

v2.3.6

Compare Source

v2.3.5

Compare Source

v2.3.4

Compare Source

v2.3.3

Compare Source

v2.3.2

Compare Source

v2.3.1

Compare Source

v2.3.0

Compare Source

v2.2.12

Compare Source

v2.2.11

Compare Source

v2.2.10

Compare Source

v2.2.9

Compare Source

v2.2.8

Compare Source

v2.2.7

Compare Source

v2.2.6

Compare Source

v2.2.5

Compare Source

v2.2.4

Compare Source

v2.2.3

Compare Source

v2.2.2

Compare Source

v2.2.1

Compare Source

v2.2.0

Compare Source

v2.1.39

Compare Source

v2.1.38

Compare Source

v2.1.37

Compare Source

v2.1.36

Compare Source

v2.1.35

Compare Source

v2.1.34

Compare Source

v2.1.33

Compare Source

v2.1.32

Compare Source

v2.1.31

Compare Source

v2.1.30

Compare Source

v2.1.29

Compare Source

v2.1.28

Compare Source

ossf/scorecard-action (ossf/scorecard-action)

v2.3.1

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1282
  • Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes

Full Changelog: ossf/scorecard-action@v2.3.0...v2.3.1

v2.3.0

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1270
  • For a full changelist of what this includes, see the v4.12.0 and v4.13.0 release notes
• ✨ Send rekor tlog index to webapp when publishing results by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1169
• 🐛 Prevent url clipping for GHES instances by @​rajbos in https://github.com/ossf/scorecard-action/pull/1225

Documentation

• 📖 Update access rights needed to see the results in code scanning by @​rajbos in https://github.com/ossf/scorecard-action/pull/1229
• 📖 Add package comments. by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1221
• 📖 Add SECURITY.md file by @​david-a-wheeler in https://github.com/ossf/scorecard-action/pull/1250
• 📖 Fix typo in token input docs by @​aabouzaid in https://github.com/ossf/scorecard-action/pull/1258

New Contributors

• @​david-a-wheeler made their first contribution in https://github.com/ossf/scorecard-action/pull/1250
• @​aabouzaid made their first contribution in https://github.com/ossf/scorecard-action/pull/1258

Full Changelog: ossf/scorecard-action@v2.2.0...v2.3.0

v2.2.0

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.10.5 to v4.11.0 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1192

Scorecard Result Viewer

Thanks to contributions from @​cynthia-sg and @​tegioz at CLOMonitor, there is a new Scorecard Result visualization page at https://securityscorecards.dev/viewer/?uri=<project-url>.

• https://github.com/ossf/scorecard-webapp/pull/406
• https://github.com/ossf/scorecard-webapp/pull/422

As an example, you can see our own score visualized here
Checkout our README to learn how to link your README badge to the new visualization page.

Publishing Results

This release contains two fixes which will improve the user experience when publish_results is true

• Runs that fail our workflow restrictions will fail with a 400 response indicating the problem, instead of a vague 500 status. (https://github.com/ossf/scorecard-action/pull/1156, resolved https://github.com/ossf/scorecard-action/issues/1150)
• Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. (https://github.com/ossf/scorecard-action/pull/1191)

Docs

• 📖 Update README to accept fine-grained tokens by @​pnacht in https://github.com/ossf/scorecard-action/pull/1175
• 📖 Update installation instructions to match current GitHub UI by @​joycebrum in https://github.com/ossf/scorecard-action/pull/1153
• 📖 Document the GitHub action workflow restrictions when publishing results. by @​spencerschrock in

New Contributors

• @​bobcallaway made their first contribution in https://github.com/ossf/scorecard-action/pull/1140
• @​pnacht made their first contribution in https://github.com/ossf/scorecard-action/pull/1175

Full Changelog: ossf/scorecard-action@v2.1.3...v2.2.0

v2.1.3

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from 4.10.2 to 4.10.5 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1111

Bug Fixes

• Invalid SARIF files from a bug in scorecard
  • #​1076, #​1094
• Vulnerabilities check crashes if a vulnerable dependency is found via OSVScanner
  • #​1092
• Scorecard action not reporting binary artifacts in the repo
  • #​1116

Full Scorecard Changelog: ossf/scorecard@v4.10.2...v4.10.5

Full Changelog: ossf/scorecard-action@v2.1.2...v2.1.3

v2.1.2

Compare Source

What's Changed

Fixes

• 🌱 Bump scorecard dependency to v4.10.2 to remove a CODEOWNERS printf statement. by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1054

Full Changelog: ossf/scorecard-action@v2.1.1...v2.1.2

v2.1.1

Compare Source

Scorecard version

This release use Scorecard's v4.10.1

Full Changelog: ossf/scorecard-action@v2.1.0...v2.1.1

v2.1.0

Compare Source

What's Changed

Scorecard version

This release uses scorecard v4.10.0.

Improvements

• Docker build workflow by @​naveensrinivasan in https://github.com/ossf/scorecard-action/pull/981
• Use root user in distroless to support GitHub Actions by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/994
• Disable pull_request_target by @​laurentsimon in https://github.com/ossf/scorecard-action/pull/1031

Documentation

• Add PAT section explaining risks by @​olivekl in https://github.com/ossf/scorecard-action/pull/1024
• Make the badge text easier to copy by @​rajbos in https://github.com/ossf/scorecard-action/pull/1026

New Contributors

• @​joycebrum made their first contribution in https://github.com/ossf/scorecard-action/pull/984
• @​rajbos made their first contribution in https://github.com/ossf/scorecard-action/pull/1026

Full Changelog: ossf/scorecard-action@v2.0.6...v2.1.0

step-security/harden-runner (step-security/harden-runner)

v2.6.0

Compare Source

What's Changed

Release v2.6.0 by @​varunsh-coder in https://github.com/step-security/harden-runner/pull/346

This release adds support for self-hosted Virtual Machine runners (e.g. on EC2).

• Both ephemeral and persistent self-hosted VM runners are supported
• Documentation: https://docs.stepsecurity.io/harden-runner/how-tos/enable-runtime-security-vm

Full Changelog: step-security/harden-runner@v2...v2.6.0

---

Configuration

📅 Schedule: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.