Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the all group across 1 directory with 11 updates #212

Closed
wants to merge 1 commit into from
Closed

Bump the all group across 1 directory with 11 updates #212

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github May 20, 2024 •
edited
Loading

Bumps the all group with 11 updates in the / directory:

Package From To
actions/checkout 4.1.2 4.1.6
actions/setup-go 5.0.0 5.0.1
actions/upload-artifact 4.3.1 4.3.3
actions/download-artifact 4.1.4 4.1.7
actions/dependency-review-action 4.2.5 4.3.2
dorny/test-reporter 1.9.0 1.9.1
goreleaser/goreleaser-action 5.0.0 5.1.0
actions/add-to-project 1.0.0 1.0.1
ossf/scorecard-action 2.3.1 2.3.3
github/codeql-action 3.24.10 3.25.6
aquasecurity/trivy-action 0.19.0 0.20.0

Updates actions/checkout from 4.1.2 to 4.1.6

Release notes

Sourced from actions/checkout's releases.

v4.1.6

What's Changed

Full Changelog: actions/checkout@v4.1.5...v4.1.6

v4.1.5

What's Changed

Full Changelog: actions/checkout@v4.1.4...v4.1.5

v4.1.4

What's Changed

Full Changelog: actions/checkout@v4.1.3...v4.1.4

v4.1.3

What's Changed

Full Changelog: actions/checkout@v4.1.2...v4.1.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v4.1.6

v4.1.5

v4.1.4

v4.1.3

v4.1.2

v4.1.1

v4.1.0

v4.0.0

v3.6.0

v3.5.3

v3.5.2

v3.5.1

... (truncated)

Commits

Updates actions/setup-go from 5.0.0 to 5.0.1

Release notes

Sourced from actions/setup-go's releases.

v5.0.1

What's Changed

New Contributors

Full Changelog: actions/setup-go@v5.0.0...v5.0.1

Commits

Updates actions/upload-artifact from 4.3.1 to 4.3.3

Release notes

Sourced from actions/upload-artifact's releases.

v4.3.3

What's Changed

Full Changelog: actions/upload-artifact@v4.3.2...v4.3.3

v4.3.2

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4.3.1...v4.3.2

Commits
  • 6546280 updating package version
  • c004fb4 Merge branch 'main' into eggyhead/use-artifact-v2.1.6
  • 90aba49 updating toolkit artifact dependency to 2.1.6
  • b06cde3 Merge pull request #563 from actions/eggyhead/release-4.3.2
  • 1746f4a Revert "updating to release 4.3.2"
  • 31685d0 updating to release 4.3.2
  • 18bf333 Merge pull request #562 from actions/eggyhead/update-artifact-v215
  • dac413b update package lock version
  • bb3b4a3 updating package version
  • 3e3da83 updating artifact and core dependencies
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.1.4 to 4.1.7

Release notes

Sourced from actions/download-artifact's releases.

v4.1.7

What's Changed

Full Changelog: actions/download-artifact@v4.1.6...v4.1.7

v4.1.6

What's Changed

Full Changelog: actions/download-artifact@v4.1.5...v4.1.6

v4.1.5

What's Changed

Full Changelog: actions/download-artifact@v4.1.4...v4.1.5

Commits
  • 65a9edc Merge pull request #325 from bethanyj28/main
  • fdd1595 licensed
  • c13dba1 update @​actions/artifact dependency
  • 0daa75e Merge pull request #324 from actions/eggyhead/use-artifact-v2.1.6
  • 9c19ed7 Merge branch 'main' into eggyhead/use-artifact-v2.1.6
  • 3d3ea87 updating license
  • 89af5db updating artifact package v2.1.6
  • b4aefff Merge pull request #323 from actions/eggyhead/update-artifact-v215
  • 8caf195 package lock update
  • d7a2ec4 updating package version
  • Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.2.5 to 4.3.2

Release notes

Sourced from actions/dependency-review-action's releases.

v4.3.2

What's Changed

Full Changelog: actions/dependency-review-action@v4.3.1...v4.3.2

v4.3.1

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See actions/dependency-review-action#753.

Full Changelog: actions/dependency-review-action@V4.3.0...v4.3.1

v4.3.0

New Features

  • The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4.2.5...V4.3.0

Commits
  • 0c155c5 Merge pull request #762 from actions/juxtin/prepare-4.3.2
  • f3dac32 Merge pull request #761 from actions/juxtin/fix-allow-dependencies-licenses
  • d0d5cc3 Update version number to 4.3.2
  • 49fbbe0 Fix package-url parsing for allow-dependencies-licenses
  • e58c696 Merge pull request #758 from actions/juxtin/prepare-4.3.1
  • 9b7c72d Change version to 4.3.1
  • 7dcfabf Merge pull request #753 from actions/juxtin/debug-purl
  • 5f0808f Validate that deny-packages purls are complete
  • fcc66c2 Refine purl parsing and tests
  • 1dd418b Basic tests for PURL validation in config
  • Additional commits viewable in compare view

Updates dorny/test-reporter from 1.9.0 to 1.9.1

Release notes

Sourced from dorny/test-reporter's releases.

v1.9.1

What's Changed

New Contributors

Full Changelog: dorny/test-reporter@v1.9.0...v1.9.1

Commits
  • 31a54ee Merge pull request #443 from dorny/release/v1.9.1
  • 2c14ff7 test-reporter release v1.9.1
  • ed4d3e6 Merge pull request #442 from dorny/feature/update_packages
  • ed2a32e Merge pull request #438 from JojOatXGME/fix-artifact-download-alternative
  • 32faf3e Update typescript-eslint dependencies
  • 6e78727 Update Typescript and NodeJS dependencies
  • 477942d Merge pull request #426 from dominicmh/main
  • f763877 Fix problematic retransmission of authentication token
  • 9d4bb43 build & package
  • cacdfc5 exclude hidden "tests" from test result
  • Additional commits viewable in compare view

Updates goreleaser/goreleaser-action from 5.0.0 to 5.1.0

Release notes

Sourced from goreleaser/goreleaser-action's releases.

v5.1.0

Important

This version changes the default behavior of latest to ~> v1.

The next major of this action (v6), will change this to ~> v2, and will be launched together with GoReleaser v2.

What's Changed

New Contributors

Full Changelog: goreleaser/goreleaser-action@v5.0.0...v5.1.0

Commits
  • 5742e2a chore: re-generate
  • 70ccc5d chore(deps): bump @​actions/http-client from 2.2.0 to 2.2.1 (#451)
  • d55bec7 chore(deps): bump semver from 7.6.0 to 7.6.2 (#462)
  • f1dbd53 feat: lock this major version of the action to use '~> v1' as 'latest' (#461)
  • 2953d07 chore(deps): update http-client
  • 62d4b8a chore: use corepack to install yarn (#458)
  • f09f1a7 chore(deps): bump tar from 6.1.14 to 6.2.1 (#456)
  • 9937f9b Revert "docs: Upgrade setup-go action version in README (#455)"
  • b7f6f16 docs: Upgrade setup-go action version in README (#455)
  • c21f56a docs: update readme
  • Additional commits viewable in compare view

Updates actions/add-to-project from 1.0.0 to 1.0.1

Release notes

Sourced from actions/add-to-project's releases.

v1.0.1

Summary

This release includes dependency updates, including security fix to undici.

What's Changed

Full Changelog: actions/add-to-project@v1.0.0...v1.0.1

Commits
  • 9bfe908 Merge pull request #542 from actions/dependabot/npm_and_yarn/undici-5.28.4
  • aa4be74 Merge branch 'main' into dependabot/npm_and_yarn/undici-5.28.4
  • 2fbfb36 Merge pull request #548 from actions/dependabot/npm_and_yarn/types/node-16.18.96
  • 5bc7439 Merge pull request #549 from actions/dependabot/npm_and_yarn/typescript-5.4.5
  • 19e0b72 build(deps-dev): bump @​types/node from 16.18.91 to 16.18.96
  • 98a7c08 build(deps-dev): bump typescript from 5.4.3 to 5.4.5
  • 00c590e Merge pull request #547 from actions/dependabot/npm_and_yarn/typescript-eslin...
  • 52491a9 build(deps-dev): bump @​typescript-eslint/eslint-plugin
  • 4f1a839 Merge pull request #546 from actions/dependabot/npm_and_yarn/typescript-eslin...
  • 8c9ffb2 Merge pull request #550 from actions/dependabot/npm_and_yarn/undici-5.28.4-fixes
  • Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.3.1 to 2.3.3

Release notes

Sourced from ossf/scorecard-action's releases.

v2.3.3

[!NOTE]
There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

Full Changelog: ossf/scorecard-action@v2.3.1...v2.3.3

Commits
  • dc50aa9 🌱 Bump docker tag for v2.3.3 release (#1368)
  • 8ff5700 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0....
  • 8ba5e73 update api links to new scorecard.dev site (#1376)
  • 92ddde3 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 (#1374)
  • 6c55905 🌱 Bump golang.org/x/net from 0.24.0 to 0.25.0 (#1373)
  • 09bb953 🌱 Bump distroless/base in the docker-images group (#1372)
  • 1511e13 🌱 Bump the github-actions group across 1 directory with 6 updates (#...
  • df66cd8 🌱 Bump the docker-images group with 2 updates (#1370)
  • fad9a3c 🌱 Bump distroless/base in the docker-images group (#1364)
  • 1e01a30 🌱 Bump the github-actions group with 3 updates (#1365)
  • Additional commits viewable in compare view

Updates github/codeql-action from 3.24.10 to 3.25.6

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.25.6 - 20 May 2024

  • Update default CodeQL bundle version to 2.17.3. #2295

3.25.5 - 13 May 2024

  • Add a compatibility matrix of supported CodeQL Action, CodeQL CLI, and GitHub Enterprise Server versions to the https://github.com/github/codeql-action/blob/main/README.md. #2273
  • Avoid printing out a warning for a missing on.push trigger when the CodeQL Action is triggered via a workflow_call event. #2274
  • The tools: latest input to the init Action has been renamed to tools: linked. This option specifies that the Action should use the tools shipped at the same time as the Action. The old name will continue to work for backwards compatibility, but we recommend that new workflows use the new name. #2281

3.25.4 - 08 May 2024

  • Update default CodeQL bundle version to 2.17.2. #2270

3.25.3 - 25 Apr 2024

  • Update default CodeQL bundle version to 2.17.1. #2247
  • Workflows running on macos-latest using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as macos-12. ARM machines with SIP disabled, including the newest macos-latest image, are unsupported for CLI versions before 2.15.1. #2261

3.25.2 - 22 Apr 2024

No user facing changes.

3.25.1 - 17 Apr 2024

  • We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuild build mode. #2235
  • Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. #2245

3.25.0 - 15 Apr 2024

  • The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224

    As a result, the following inputs and environment variables are now ignored:

    • The setup-python-dependencies input to the init Action
    • The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable

    We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.

  • Automatically overwrite an existing database if found on the filesystem. #2229

  • Bump the minimum CodeQL bundle version to 2.12.6. #2232

... (truncated)

Commits
  • 9fdb3e4 Merge pull request #2300 from github/update-v3.25.6-63d519c0a
  • 00792ab Update changelog for v3.25.6
  • 63d519c Merge pull request #2295 from github/update-bundle/codeql-bundle-v2.17.3
  • 0d9161c Merge pull request #2293 from github/henrymercer/update-build-mode-autobuild-...
  • e9e2729 Add changelog note
  • de1ac31 Update default bundle to codeql-bundle-v2.17.3
  • a57c67b Merge pull request #2286 from github/koesie10/ghec-dr-db-upload
  • b7ef64e Merge pull request #2294 from github/dependabot/npm_and_yarn/npm-d3285d5234
  • e54dea2 Update checked-in dependencies
  • 3b42294 Bump the npm group across 1 directory with 4 updates
  • Additional commits viewable in compare view

Updates aquasecurity/trivy-action from 0.19.0 to 0.20.0

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.20.0

What's Changed

New Contributors

Full Changelog: aquasecurity/trivy-action@0.19.0...0.20.0

Commits
  • b2933f5 bump trivy version to v0.51.1 (#353)
  • b2cd5ff Update bump-trivy.yaml
  • 6f8c237 update tests (#334)
  • 7088d18 Revert "fix: 🐛 allow trivy-config and other options to be used together (#338)"
  • ee6a4f5 fix: 🐛 allow trivy-config and other options to be used together (#338)
  • b5f4977 Bump trivy version to v0.50.2 (#341)
  • 207cd40 Fix docker host bug (#329)
  • 840deb4 Browse scan reports without GitHub Advanced Security license (#328)
  • 0f287db feat(image): add --docker-host option for GH Action users (#267)
  • <...

    Description has been truncated

@dependabot
---
1cb47e8 
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: dorny/test-reporter
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: actions/add-to-project
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot Dependabot
Copy link
Author

dependabot bot commented on behalf of github May 20, 2024

The following labels could not be found: area/dependency, release-note-none, ok-to-test.

@dependabot dependabot bot mentioned this pull request May 20, 2024
Closed
@dependabot Dependabot
Copy link
Author

dependabot bot commented on behalf of github May 27, 2024

Superseded by #213.

@dependabot dependabot bot closed this May 27, 2024
@dependabot dependabot bot deleted the dependabot/github_actions/all-c16d109277 branch May 27, 2024 21:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants