chore(deps): update all non-major dependencies#244
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
![renovate-approve-2[bot]](https://avatars.githubusercontent.com/in/62175?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| egress-policy: audit # change to 'egress-policy: block' after couple of runs | ||
|
|
||
| - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 | ||
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 |
✅MegaLinter analysis: Success
Notices📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining See detailed reports in MegaLinter artifacts Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
8d5613b to
d0a0d17
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
d0a0d17 to
77a8446
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
@copilot follow the tips here to use tip: use error[github-app]: dangerous use of GitHub App tokens error[github-app]: dangerous use of GitHub App tokens 3 findings (1 ignored): 0 informational, 0 low, 0 medium, 2 high |
Agent-Logs-Url: https://github.com/chgl/.github/sessions/3639cf87-a05e-431b-9905-afdcde32d5ff Co-authored-by: chgl <5307555+chgl@users.noreply.github.com>
Fixed in commit 8475af2. The issue was that |
|
@copilot the ci-inserted .zizmor-standard-lint-defaults.yaml file (standard-lint.yaml) fails with: re-format the inline string in the workflow |
…r config Agent-Logs-Url: https://github.com/chgl/.github/sessions/167d8081-7fc6-4ee1-aa66-25eb846d6323 Co-authored-by: chgl <5307555+chgl@users.noreply.github.com>
... Fixed in commit 75ec35f. Changed the block scalar from |
Trivy image scan report
|
Trivy image scan report
|
Trivy image scan report
|
|
🎉 This PR is included in version 1.11.34 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This PR contains the following updates:
v3.1.1→v3.2.03.14.4-slim→3.14.5-slimv7.1.0→v7.2.0v4.1.0→v4.2.0v6.0.0→v6.1.0v4.0.0→v4.1.0v4.35.4→v4.36.0v9.4.0→v9.5.0v2.19.1→v2.19.41.24.1→1.25.2Release Notes
actions/create-github-app-token (actions/create-github-app-token)
v3.2.0Compare Source
Features
repositoriesinput (#372) (85eb8dd)Bug Fixes
docker/build-push-action (docker/build-push-action)
v7.2.0Compare Source
docker/login-action (docker/login-action)
v4.2.0Compare Source
Full Changelog: docker/login-action@v4.1.0...v4.2.0
docker/metadata-action (docker/metadata-action)
v6.1.0Compare Source
docker/setup-buildx-action (docker/setup-buildx-action)
v4.1.0Compare Source
Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0
github/codeql-action (github/codeql-action)
v4.36.0Compare Source
v4.35.5Compare Source
analysis-kindsinput, onlycode-scanningwill be enabled. Theanalysis-kindsinput is experimental, for GitHub-internal use only, and may change without notice at any time. #3892oxsecurity/megalinter (oxsecurity/megalinter)
v9.5.0Compare Source
Take 2 mn to read MegaLinter v9.5.0 announcements
Breaking changes
Docker images published only to GitHub Container Registry (
ghcr.io) until OIDC-based publishing to Docker Hub is implemented. The Docker Hub registry (docker.io/oxsecurity/megalinter) is frozen at v9.4.0: pulls ofoxsecurity/megalinter:v9(or:beta, or any flavor tag) will keep returning v9.4.0. To get v9.5.0 and later from CI tools other than GitHub Actions (GitLab CI, Azure Pipelines, Bitbucket, Jenkins, Drone, rawdocker run, …), switch your image references:oxsecurity/megalinter:v9→ghcr.io/oxsecurity/megalinter:v9oxsecurity/megalinter:beta→ghcr.io/oxsecurity/megalinter:betaoxsecurity/megalinter-<flavor>:v9→ghcr.io/oxsecurity/megalinter-<flavor>:v9GitHub Action users (
uses: oxsecurity/megalinter@v9) andmega-linter-runnerusers are not affected, as both already pull fromghcr.io.ESLint-based linters upgraded to v10+. Legacy
.eslintrc.*configs are no longer supported: you must migrate to flat-config (eslint.config.js) to keep usingJAVASCRIPT_ES,TYPESCRIPT_ES,JSX_ESLINT,TSX_ESLINT, andJSON_ESLINT_PLUGIN_JSONC.Airbnb and Standard ESLint configs replaced (they never shipped ESLint 9+ support):
extends: ["airbnb"]→extends: ["airbnb-extended"]extends: ["standard"]→extends: ["neostandard"]Core
New linters
Disabled linters
Re-enabled linters
Deprecated linters
Removed linters
Media
Linters enhancements
.eslintrc.*configs are now detected and a migration notice is emitted in the report so users know they need to switch to flat-configBASH_SHELLCHECK_CONFIG_FILEvariable /.shellcheckrcconfig fileexclude_mailoption (no longer supported by lychee upstream)Fixes
YAML_V8R_CONFIG_FILE/JSON_V8R_CONFIG_FILEare now correctly applied (the v8r--catalogsoption is wired through)headers/ Accept settings being ignoredcwdoptionReporters
GITLAB_ACCESS_TOKEN_MEGALINTERis set (no longer requiresCI_JOB_TOKEN)###headings (Bitbucket Cloud markdown was displaying the previous<details>HTML tags as literal text)SECURITY_SUGGESTIONS: false.Flavors
linux/arm64in addition tolinux/amd64whenever possible (Apple Silicon, AWS Graviton, Ampere…)Doc
mega-linter-runner
--list-vars [pattern]flag (with--json) lists every MegaLinter env variable that can be passed via-e, with type, default, allowed values and examples (handy for AI coding agents)-e ENABLE_LINTERS=YAML_PRETTIER,YAML_YAMLLINTno longer silently drops values after the first comma (#7500). The--env=KEY=VALUElong form is also accepted.Dev
CLAUDE.mdand a set of/add-linter,/update-linter-version,/review-descriptor,/fix-linter-test,/add-reporter,/add-flavor,/build,/diagnose-config,/fix-security-issueskills to help work on MegaLinter with coding agents (Claude Code, GitHub Copilot, Codex, gemini-cli…)cli_lint_extra_args_afterper lint mode (list_of_files/project/file), a{file}template variable usable in command-line args, and a customizable files separatorCI
type=gha, zstd-compressed) on all deploy workflows, DEV pipeline split into parallel jobs sharing the image via cache, and cargo-based tools (sarif-fmt, zizmor, shellcheck-sarif, stylua) built in parallel multi-stage builders so the Rust toolchain no longer ships in the final image (except for clippy)Linter versions upgrades (62)
step-security/harden-runner (step-security/harden-runner)
v2.19.4Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4
v2.19.3Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3
v2.19.2Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2
zizmorcore/zizmor (zizmor)
v1.25.2Compare Source
Bug Fixes 🐛🔗
v1.25.1Compare Source
Bug Fixes 🐛🔗
Fixed a bug where the cache-poisoning audit would fail to consider release events as exempt from cache usage findings when filtered by a tag condition (#2004)
Fixed a typo when suggesting --fix flags for findings (#2010)
Many thanks to @0xdea for implementing this fix!
Fixed a typo in unpinned-tools annotations (#2008)
Many thanks to @martincostello for implementing this fix!
Fixed a bug where the github-app audit would incorrectly flag some safe uses of actions/create-github-app-token as unsafe (#2011)
v1.25.0Compare Source
New Features 🌈🔗
zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#1913)
Many thanks to @Proximyst for proposing and implementing this improvement!
New audit: github-app detects dangerous usages of GitHub App installation tokens (#1926)
New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#1820)
zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#1935)
zizmor's LSP now honors the --persona flag on the CLI (#1943)
zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#1965)
Enhancements🔗
Recommend gh issue edit --add-label / gh pr edit --add-label as a replacement for actions-ecosystem/action-add-labels in superfluous-actions
Recommend gh issue edit --remove-label / gh pr edit --remove-label as a replacement for actions-ecosystem/action-remove-labels in superfluous-actions
Recommend jq as a replacement for sergeysova/jq-action in superfluous-actions
Recommend git add, git commit, and git push as a replacement for stefanzweifel/git-auto-commit-action in superfluous-actions
Recommend git add, git commit, and git push as a replacement for EndBug/add-and-commit in superfluous-actions
tibdex/github-app-token is now recognized as an archived action by archived-uses (#1910)
The [dangerous-triggers] audit now explicitly exempts workflows that only invoke actions/labeler (#1956)
The unpinned-images audit now detects unpinned image references in Docker-based action definitions (#1965)
zizmor's SARIF output now provides slightly more detailed finding messages (#1972)
The archived-uses audit now detects more archived actions (#1978)
deno is now recognized as a package-ecosystem in dependabot.yml (#1991)
Performance Improvements 🚄🔗
The impostor-commit audit is now significantly faster (in addition to being more correct) when the user has pinned their action to a tag SHA instead of a commit SHA (#1998)
Bug Fixes 🐛🔗
Fixed a crash in the template-injection audit when a workflow uses a parenthesized compound expression in context position (#1904)
Fixed a bug where local directory input collection could miss workflows for relative-path invocations from within .github subdirectories (#1909)
Fixed a bug where the unpinned-images audit would miss images defined in container:![]()
clauses (#1944)
Fixed a bug where inline ignore comments could not be easily applied to superfluous-actions findings (#1945)
Fixed a bug where the cache-poisoning audit would fail to detect some release trigger patterns (#1946)
Fixed a bug where inline ignore comments could not be easily applied to cache-poisoning findings (#1962)
Fixed a class of imprecisions where the cache-poisoning audit would incorrectly flag cache usage that doesn't actually occur on release events (#1940)
Many thanks to @reubenwong97 for implementing this fix!
Fixed a bug where dependabot.yml files containing a private cargo repository couldn't be parsed (#1976)
Fixed a bug where zizmor's input validation warnings lacked a mention of which files failed to validate (#1980)
Fixed a bug where the impostor-commit audit would falsely indicate impostor commits if an action was pinned to a tag SHA instead of a commit SHA (#1998)
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.