chore(deps): update all non-major dependencies #187

renovate-bot · 2024-02-01T01:18:01Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	`v4.1.1` -> `v4.1.7`
actions/setup-go	action	patch	`v5.0.0` -> `v5.0.2`
github/codeql-action	action	minor	`v2.23.0` -> `v2.26.7`
ossf/scorecard-action	action	minor	`v2.3.1` -> `v2.4.0`
step-security/harden-runner	action	minor	`v2.6.1` -> `v2.10.1`

Release Notes

actions/checkout (actions/checkout)

Fix: Disable sparse checkout whenever sparse-checkout option is not present @dscho in https://github.com/actions/checkout/pull/1598

actions/setup-go (actions/setup-go)

`v5.0.2`

Compare Source

`v5.0.1`

Compare Source

What's Changed

Bump undici from 5.28.2 to 5.28.3 and dependencies upgrade by @dependabot , @HarithaVattikuti in https://github.com/actions/setup-go/pull/465
Update documentation with latest V5 release notes by @ab in https://github.com/actions/setup-go/pull/459
Update version documentation by @178inaba in https://github.com/actions/setup-go/pull/458
Documentation update of actions/setup-go to v5 by @chenrui333 in https://github.com/actions/setup-go/pull/449

New Contributors

@ab made their first contribution in https://github.com/actions/setup-go/pull/459

Full Changelog: actions/setup-go@v5.0.0...v5.0.1

github/codeql-action (github/codeql-action)

`v2.26.7`

Compare Source

`v2.26.6`

Compare Source

`v2.26.5`

Compare Source

`v2.26.4`

Compare Source

`v2.26.3`

Compare Source

`v2.26.2`

Compare Source

`v2.26.1`

Compare Source

`v2.26.0`

Compare Source

`v2.25.15`

Compare Source

`v2.25.14`

Compare Source

`v2.25.13`

Compare Source

`v2.25.12`

Compare Source

`v2.25.11`

Compare Source

`v2.25.10`

Compare Source

`v2.25.9`

Compare Source

`v2.25.8`

Compare Source

`v2.25.7`

Compare Source

`v2.25.6`

Compare Source

`v2.25.5`

Compare Source

`v2.25.4`

Compare Source

`v2.25.3`

Compare Source

`v2.25.2`

Compare Source

`v2.25.1`

Compare Source

`v2.25.0`

Compare Source

`v2.24.11`

Compare Source

`v2.24.10`

Compare Source

`v2.24.9`

Compare Source

`v2.24.8`

Compare Source

`v2.24.7`

Compare Source

`v2.24.6`

Compare Source

`v2.24.5`

Compare Source

`v2.24.4`

Compare Source

`v2.24.3`

Compare Source

`v2.24.2`

Compare Source

`v2.24.1`

Compare Source

`v2.24.0`

Compare Source

`v2.23.2`

Compare Source

`v2.23.1`

Compare Source

ossf/scorecard-action (ossf/scorecard-action)

`v2.4.0`

Compare Source

What's Changed

This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.

🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1410
🐛 lower license sarif alert threshold to 9 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1411

Documentation

docs: dogfooding badge by @jkowalleck in https://github.com/ossf/scorecard-action/pull/1399

New Contributors

@jkowalleck made their first contribution in https://github.com/ossf/scorecard-action/pull/1399

Full Changelog: ossf/scorecard-action@v2.3.3...v2.4.0

`v2.3.3`

Compare Source

[!NOTE]
There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1366
🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1374
🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1377

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

📖 Move token discussion out of main README. by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1279
📖 link to ossf/scorecard workflow instead of maintaining an example by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1352
📖 update api links to new scorecard.dev site by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1376

Full Changelog: ossf/scorecard-action@v2.3.1...v2.3.3

`v2.3.2`

Compare Source

step-security/harden-runner (step-security/harden-runner)

`v2.10.1`

Compare Source

What's Changed

Release v2.10.1 by @varunsh-coder in https://github.com/step-security/harden-runner/pull/463
Bug fix: Resolves an issue where DNS resolution of .local domains was failing when using a Kind cluster in a GitHub Actions workflow.

Full Changelog: step-security/harden-runner@v2...v2.10.1

`v2.10.0`

Compare Source

What's Changed

Release v2.10.0 by @h0x0er and @varunsh-coder in https://github.com/step-security/harden-runner/pull/455

ARM Support: Harden-Runner Enterprise tier now supports GitHub-hosted ARM runners. This includes all the features that apply to previously supported GitHub-hosted x64 Linux runners.

Full Changelog: step-security/harden-runner@v2...v2.10.0

`v2.9.1`

Compare Source

What's Changed

Release v2.9.1 by @h0x0er and @varunsh-coder in #440
This release includes two changes:

Updated markdown displayed in the job summary by the Harden-Runner Action.
Fixed a bug affecting Enterprise Tier customers where the agent attempted to upload telemetry for jobs with disable-telemetry set to true. No telemetry was uploaded as the endpoint was not in the allowed list.

Full Changelog: step-security/harden-runner@v2...v2.9.1

`v2.9.0`

Compare Source

What's Changed

Release v2.9.0 by @h0x0er and @varunsh-coder in https://github.com/step-security/harden-runner/pull/435
This release includes:

Enterprise Tier - Telemetry Upload Enhancement:
For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
Harden-Runner Agent Authentication:
The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
README Update:
A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
Dependency Update:
Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action

Full Changelog: step-security/harden-runner@v2...v2.9.0

`v2.8.1`

Compare Source

What's Changed

Bug fix: Update isGitHubHosted implementation by @varunsh-coder in https://github.com/step-security/harden-runner/pull/425
The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: step-security/harden-runner@v2...v2.8.1

`v2.8.0`

Compare Source

What's Changed

Release v2.8.0 by @h0x0er and @varunsh-coder in https://github.com/step-security/harden-runner/pull/416
This release includes:

File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.
Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.

These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.

Full Changelog: step-security/harden-runner@v2...v2.8.0

`v2.7.1`

Compare Source

What's Changed

Release v2.7.1 by @varunsh-coder, @h0x0er, @ashishkurmi in https://github.com/step-security/harden-runner/pull/397
This release:

Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
Addresses minor bugs

Full Changelog: step-security/harden-runner@v2.7.0...v2.7.1

`v2.7.0`

Compare Source

What's Changed

Release 2.7.0 by @varunsh-coder and @h0x0er in https://github.com/step-security/harden-runner/pull/376
This release:

Updates the node runtime to node20
Adds capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners

Full Changelog: step-security/harden-runner@v2...v2.7.0

Configuration

📅 Schedule: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate-bot force-pushed the renovate/all-minor-patch branch from 0b5d957 to 5254c60 Compare February 1, 2024 01:18

blunderbuss-gcf bot assigned HKWinterhalter Feb 1, 2024

renovate-bot force-pushed the renovate/all-minor-patch branch from 5254c60 to 3d3c4cf Compare February 2, 2024 22:58

renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 8a2fadb to 046982c Compare February 15, 2024 16:30

renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 2c6c170 to 24b298f Compare February 23, 2024 12:27

renovate-bot force-pushed the renovate/all-minor-patch branch from 24b298f to 68b0012 Compare March 1, 2024 14:34

renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from a78ed13 to 48c73c0 Compare March 18, 2024 16:45

renovate-bot force-pushed the renovate/all-minor-patch branch from 48c73c0 to b61333c Compare March 22, 2024 12:30

renovate-bot force-pushed the renovate/all-minor-patch branch from b61333c to 9658214 Compare April 5, 2024 17:35

renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 7138786 to 2d88133 Compare April 22, 2024 15:16

renovate-bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 9595595 to 4d6f387 Compare April 30, 2024 00:55

renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 8143dcb to d8e3ef1 Compare May 8, 2024 21:46

renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from fc3155a to 798bc30 Compare May 16, 2024 20:52

renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 80244d2 to 51fe751 Compare May 22, 2024 03:32

renovate-bot force-pushed the renovate/all-minor-patch branch from 51fe751 to edbd9f1 Compare May 31, 2024 13:10

HKWinterhalter removed their assignment Jun 3, 2024

renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from bcfbc41 to 4da3384 Compare June 13, 2024 15:42

renovate-bot force-pushed the renovate/all-minor-patch branch from 4da3384 to 9aee17b Compare June 28, 2024 18:02

renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 40c7da3 to d5cecbf Compare July 12, 2024 10:10

renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 1a35a0d to 9c93da1 Compare July 25, 2024 10:58

renovate-bot force-pushed the renovate/all-minor-patch branch from 9c93da1 to acf752b Compare July 26, 2024 17:05

renovate-bot force-pushed the renovate/all-minor-patch branch from acf752b to 119651a Compare August 6, 2024 00:47

renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 9bd69e0 to ce6776e Compare August 19, 2024 18:47

renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 5c39020 to 5be91ee Compare August 24, 2024 01:33

renovate-bot force-pushed the renovate/all-minor-patch branch from 5be91ee to 1312834 Compare August 29, 2024 12:13

chore(deps): update all non-major dependencies

e4118cc

renovate-bot force-pushed the renovate/all-minor-patch branch from 1312834 to e4118cc Compare September 18, 2024 01:35

blunderbuss-gcf bot assigned akerekes Sep 18, 2024

akerekes approved these changes Sep 18, 2024

View reviewed changes

jrmfg added the automerge Summon MOG for automerging label Sep 18, 2024

jrmfg assigned jrmfg and akerekes and unassigned akerekes and jrmfg Sep 18, 2024

jrmfg merged commit 1dc699f into GoogleCloudPlatform:main Sep 18, 2024
15 checks passed

gcf-merge-on-green bot removed the automerge Summon MOG for automerging label Sep 18, 2024

release-please bot mentioned this pull request Sep 18, 2024

chore(main): release 1.4.0 #166

Merged

renovate-bot deleted the renovate/all-minor-patch branch September 18, 2024 22:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update all non-major dependencies #187

chore(deps): update all non-major dependencies #187

renovate-bot commented Feb 1, 2024 •

edited

Loading

chore(deps): update all non-major dependencies #187

chore(deps): update all non-major dependencies #187

Conversation

renovate-bot commented Feb 1, 2024 • edited Loading

Release Notes

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

Documentation

New Contributors

What's Changed

Documentation

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

renovate-bot commented Feb 1, 2024 •

edited

Loading