chore(deps): update all non-major dependencies #233

renovate-bot · 2023-05-01T00:01:50Z

This PR contains the following updates:

Package	Type	Update	Change
GoogleCloudPlatform/functions-framework-conformance	action	minor	`v1.6.0` -> `v1.8.0`
actions/checkout	action	minor	`v2.6.0` -> `v2.7.0`
actions/checkout	action	minor	`v3.1.0` -> `v3.5.2`
github/codeql-action	action	minor	`v2.1.27` -> `v2.3.2`
github/codeql-action	action	minor	`v2.2.12` -> `v2.3.2`
ossf/scorecard-action	action	minor	`v2.0.6` -> `v2.1.3`
step-security/harden-runner	action	minor	`v2.1.0` -> `v2.3.1`
step-security/harden-runner	action	patch	`v2.3.0` -> `v2.3.1`

Release Notes

GoogleCloudPlatform/functions-framework-conformance

`v1.8.0`

Compare Source

Client

Update builder image path

`v1.7.0`

Compare Source

Actions

Add cache-path parameter to actions/client/install Action

actions/checkout

`v2.7.0`

Compare Source

What's Changed

Add new public key for known_hosts (#1237) by @TingluoHuang in https://github.com/actions/checkout/pull/1238

Full Changelog: actions/checkout@v2.6.0...v2.7.0

github/codeql-action

ossf/scorecard-action

`v2.1.3`

Compare Source

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 from 4.10.2 to 4.10.5 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1111

Bug Fixes

Invalid SARIF files from a bug in scorecard
- #1076, #1094
Vulnerabilities check crashes if a vulnerable dependency is found via OSVScanner
- #1092
Scorecard action not reporting binary artifacts in the repo
- #1116

Full Scorecard Changelog: ossf/scorecard@v4.10.2...v4.10.5

Full Changelog: ossf/scorecard-action@v2.1.2...v2.1.3

`v2.1.2`

Compare Source

What's Changed

Fixes

🌱 Bump scorecard dependency to v4.10.2 to remove a CODEOWNERS printf statement. by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1054

Full Changelog: ossf/scorecard-action@v2.1.1...v2.1.2

`v2.1.1`

Compare Source

Scorecard version

This release use Scorecard's v4.10.1

Full Changelog: ossf/scorecard-action@v2.1.0...v2.1.1

`v2.1.0`

Compare Source

What's Changed

Scorecard version

This release uses scorecard v4.10.0.

Improvements

Docker build workflow by @naveensrinivasan in https://github.com/ossf/scorecard-action/pull/981
Use root user in distroless to support GitHub Actions by @spencerschrock in https://github.com/ossf/scorecard-action/pull/994
Disable pull_request_target by @laurentsimon in https://github.com/ossf/scorecard-action/pull/1031

Documentation

Add PAT section explaining risks by @olivekl in https://github.com/ossf/scorecard-action/pull/1024
Make the badge text easier to copy by @rajbos in https://github.com/ossf/scorecard-action/pull/1026

New Contributors

@joycebrum made their first contribution in https://github.com/ossf/scorecard-action/pull/984
@rajbos made their first contribution in https://github.com/ossf/scorecard-action/pull/1026

Full Changelog: ossf/scorecard-action@v2.0.6...v2.1.0

step-security/harden-runner

`v2.3.1`

Compare Source

What's Changed

Release v2.3.1 by @arjundashrath and @varunsh-coder in https://github.com/step-security/harden-runner/pull/281
Fixes #279 and #275
Update README.md by @varunsh-coder in https://github.com/step-security/harden-runner/pull/267
Bump step-security/harden-runner from 2.2.1 to 2.3.0 by @dependabot in https://github.com/step-security/harden-runner/pull/268
Bump codecov/codecov-action from 3.1.1 to 3.1.2 by @dependabot in https://github.com/step-security/harden-runner/pull/273
Bump ossf/scorecard-action from 2.1.2 to 2.1.3 by @dependabot in https://github.com/step-security/harden-runner/pull/265
Bump actions/checkout from 3.3.0 to 3.5.0 by @dependabot in https://github.com/step-security/harden-runner/pull/261
Bump github/codeql-action from 2.2.6 to 2.2.11 by @dependabot in https://github.com/step-security/harden-runner/pull/270

Full Changelog: step-security/harden-runner@v2...v2.3.1

`v2.3.0`

Compare Source

What's Changed

Enable setting policy via insights website (link to documentation) by @h0x0er and @varunsh-coder in https://github.com/step-security/harden-runner/pull/266
The Policy Store helps you manage Harden Runner policies without altering your workflow files.
Update README.md by @varunsh-coder in https://github.com/step-security/harden-runner/pull/255
Bump github/codeql-action from 2.2.4 to 2.2.6 by @dependabot in https://github.com/step-security/harden-runner/pull/254
Bump step-security/harden-runner from 2.2.0 to 2.2.1 by @dependabot in https://github.com/step-security/harden-runner/pull/256

Full Changelog: step-security/harden-runner@v2...v2.3.0

`v2.2.1`

Compare Source

What's Changed

Fix issue to get cache endpoint by @h0x0er in https://github.com/step-security/harden-runner/pull/253
Harden runner has the ability to automatically detect the cache endpoint used by each job. When Harden runner is used in block mode, this endpoint is added to the list of allowed endpoints. A fix has been implemented to improve this feature by updating the logic used to fetch the cache endpoint. This update involves using code from the actions/cache library to ensure the endpoint is properly retrieved.
Update README.md by @varunsh-coder in https://github.com/step-security/harden-runner/pull/247
Bump step-security/harden-runner from 2.1.0 to 2.2.0 by @dependabot in https://github.com/step-security/harden-runner/pull/248
Bump github/codeql-action from 2.1.38 to 2.2.4 by @dependabot in https://github.com/step-security/harden-runner/pull/244

Full Changelog: step-security/harden-runner@v2...v2.2.1

`v2.2.0`

Compare Source

What's Changed

Release v2.2.0 by @varunsh-coder in https://github.com/step-security/harden-runner/pull/245
1. Added functionality that allows for skipping Harden Runner installation if any errors arise during the installation process.
2. Updated Harden-Runner GitHub Action to use the latest version of the Harden Runner agent, which resolves three issues:
  - Addressed a bug that allowed calls to direct IP addresses not included in the allowed list when executing code in a docker image.
  - Enhanced annotations to eliminate false positives, specifically not showing false positive calls to docker.io
  - Upgraded containerd dependency to a non-vulnerable version.
Bump codecov/codecov-action from 2.1.0 to 3.1.1 by @dependabot in https://github.com/step-security/harden-runner/pull/233
Bump step-security/harden-runner from 2.0.0 to 2.1.0 by @dependabot in https://github.com/step-security/harden-runner/pull/232
Bump github/codeql-action from 2.1.37 to 2.1.38 by @dependabot in https://github.com/step-security/harden-runner/pull/229
Update README.md by @varunsh-coder in https://github.com/step-security/harden-runner/pull/231

Full Changelog: step-security/harden-runner@v2...v2.2.0

Configuration

📅 Schedule: Branch creation - "before 3am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

forking-renovate · 2023-05-04T02:19:57Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.

chore(deps): update all non-major dependencies

704c9bb

blunderbuss-gcf bot assigned HKWinterhalter May 1, 2023

Merge branch 'master' into renovate/all-minor-patch

c8d2b51

KaylaNguyen added 2 commits May 3, 2023 19:25

Merge branch 'master' into renovate/all-minor-patch

55bf91e

Merge branch 'master' into renovate/all-minor-patch

a755566

KaylaNguyen approved these changes May 4, 2023

View reviewed changes

KaylaNguyen merged commit 586cc4e into GoogleCloudPlatform:master May 4, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update all non-major dependencies #233

chore(deps): update all non-major dependencies #233

renovate-bot commented May 1, 2023

forking-renovate bot commented May 4, 2023

chore(deps): update all non-major dependencies #233

chore(deps): update all non-major dependencies #233

Conversation

renovate-bot commented May 1, 2023

Release Notes

Client

Actions

What's Changed

What's Changed

Bug Fixes

What's Changed

Fixes

Scorecard version

What's Changed

Scorecard version

Improvements

Documentation

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

forking-renovate bot commented May 4, 2023

Edited/Blocked Notification