chore(deps): update github actions #145
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Lochnair-Labs/irtt-rs#145
Reference in new issue
Block a user
This PR contains the following updates:
2892aa5→6f2ac81v2.6.0→v2.7.0v0.6.4→v0.7.1Release Notes
google/osv-scanner-action (google/osv-scanner-action)
v2.7.0Compare Source
What's Changed
Full Changelog: https://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0
zizmorcore/zizmor-action (zizmorcore/zizmor-action)
v0.7.1Compare Source
zizmor changes
Bug Fixes 🐛🔗
action changes
The default version of zizmor is now 1.31.1.
What's Changed
Full Changelog: https://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1
v0.7.0Compare Source
Sponsorship is appreciated!
zizmor notes
Enhancements 🌱🔗
The typosquat-uses audit now supports pre-commit config inputs (#2437)
The self-hosted-runner audit is now significantly more precise (#2350)
Many thanks to @ubiratansoares for proposing and implementing this enhancement!
The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)
zizmor is now aware of the image_version workflow trigger (#2397)
The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)
The cache-poisoning audit is now aware of pnpm/setup (#2409)
The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)
Many thanks to @ubiratansoares for proposing and implementing this enhancement!
The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)
The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)
zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)
Bug Fixes 🐛🔗
Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)
Many thanks to @marcalexiei for implementing this improvement!
Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)
Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)
Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)
Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)
action notes
What's Changed
New Contributors
Full Changelog: https://github.com/zizmorcore/zizmor-action/compare/v0.6.4...v0.7.0
Configuration
📅 Schedule: (in timezone Asia/Jakarta)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
17d2885b41tod5465d87dfchore(deps): update github actions to 24c5418to chore(deps): update github actionsd5465d87dfto805ec97956805ec97956toecf81b8a48ecf81b8a48tob61386abd6View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.