Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): Bump the minor-patch group across 1 directory with 13 updates #1814

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): Bump the minor-patch group across 1 directory with 13 updates #1814

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 4, 2025

Bumps the minor-patch group with 13 updates in the / directory:

Package From To
sigstore/cosign-installer 3.7.0 3.8.1
ko-build/setup-ko 0.7 0.8
google-github-actions/auth 2.1.7 2.1.8
actions/cache 4.2.0 4.2.3
github/codeql-action 3.27.9 3.28.13
mikefarah/yq 4.44.6 4.45.1
anchore/sbom-action 0.17.9 0.18.0
goreleaser/goreleaser-action 6.1.0 6.3.0
google-github-actions/setup-gcloud 2.1.2 2.1.4
slsa-framework/slsa-github-generator 2.0.0 2.1.0
ossf/scorecard-action 2.4.0 2.4.1
actions/upload-artifact 4.4.3 4.6.2
codecov/codecov-action 5.1.1 5.4.0

Updates sigstore/cosign-installer from 3.7.0 to 3.8.1

Release notes

Sourced from sigstore/cosign-installer's releases.

v3.8.1

What's Changed

Full Changelog: sigstore/cosign-installer@v3...v3.8.1

v3.8.0

What's Changed

Full Changelog: sigstore/cosign-installer@v3...v3.8.0

Commits

Updates ko-build/setup-ko from 0.7 to 0.8

Release notes

Sourced from ko-build/setup-ko's releases.

v0.8

What's Changed

New Contributors

Full Changelog: ko-build/setup-ko@v0.7...v0.8

Commits

Updates google-github-actions/auth from 2.1.7 to 2.1.8

Release notes

Sourced from google-github-actions/auth's releases.

v2.1.8

What's Changed

New Contributors

Full Changelog: google-github-actions/auth@v2...v2.1.8

Commits

Updates actions/cache from 4.2.0 to 4.2.3

Release notes

Sourced from actions/cache's releases.

v4.2.3

What's Changed

  • Update to use @​actions/cache 4.0.3 package & prepare for new release by @​salmanmkc in actions/cache#1577 (SAS tokens for cache entries are now masked in debug logs)

New Contributors

Full Changelog: actions/cache@v4.2.2...v4.2.3

v4.2.2

What's Changed

[!IMPORTANT] As a reminder, there were important backend changes to release v4.2.0, see those release notes and the announcement for more details.

Full Changelog: actions/cache@v4.2.1...v4.2.2

v4.2.1

What's Changed

[!IMPORTANT] As a reminder, there were important backend changes to release v4.2.0, see those release notes and the announcement for more details.

New Contributors

Full Changelog: actions/cache@v4.2.0...v4.2.1

Changelog

Sourced from actions/cache's changelog.

Releases

4.2.3

  • Bump @actions/cache to v4.0.3 (obfuscates SAS token in debug logs for cache entries)

4.2.2

  • Bump @actions/cache to v4.0.2

4.2.1

  • Bump @actions/cache to v4.0.1

4.2.0

TLDR; The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.

We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).

If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0

If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.

Upgrading to the recommended versions will not break your workflows.

4.1.2

  • Add GitHub Enterprise Cloud instances hostname filters to inform API endpoint choices - #1474
  • Security fix: Bump braces from 3.0.2 to 3.0.3 - #1475

4.1.1

  • Restore original behavior of cache-hit output - #1467

4.1.0

  • Ensure cache-hit output is set when a cache is missed - #1404
  • Deprecate save-always input - #1452

4.0.2

  • Fixed restore fail-on-cache-miss not working.

4.0.1

  • Updated isGhes check

... (truncated)

Commits

Updates github/codeql-action from 3.27.9 to 3.28.13

Release notes

Sourced from github/codeql-action's releases.

v3.28.13

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.13 - 24 Mar 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.12

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.12 - 19 Mar 2025

  • Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.
  • Update default CodeQL bundle version to 2.20.7. #2810

See the full CHANGELOG.md for more information.

v3.28.11

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.11 - 07 Mar 2025

  • Update default CodeQL bundle version to 2.20.6. #2793

See the full CHANGELOG.md for more information.

v3.28.10

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.10 - 21 Feb 2025

  • Update default CodeQL bundle version to 2.20.5. #2772
  • Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

See the full CHANGELOG.md for more information.

v3.28.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • Update default CodeQL bundle version to 2.21.0. #2838

3.28.13 - 24 Mar 2025

No user facing changes.

3.28.12 - 19 Mar 2025

  • Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.
  • Update default CodeQL bundle version to 2.20.7. #2810

3.28.11 - 07 Mar 2025

  • Update default CodeQL bundle version to 2.20.6. #2793

3.28.10 - 21 Feb 2025

  • Update default CodeQL bundle version to 2.20.5. #2772
  • Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

3.28.9 - 07 Feb 2025

  • Update default CodeQL bundle version to 2.20.4. #2753

3.28.8 - 29 Jan 2025

  • Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

3.28.7 - 29 Jan 2025

No user facing changes.

3.28.6 - 27 Jan 2025

  • Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

3.28.5 - 24 Jan 2025

  • Update default CodeQL bundle version to 2.20.3. #2717

3.28.4 - 23 Jan 2025

No user facing changes.

... (truncated)

Commits
  • 1b549b9 Merge pull request #2819 from github/update-v3.28.13-e0ea14102
  • 82630c8 Update changelog for v3.28.13
  • e0ea141 Merge pull request #2818 from github/cklin/empty-pr-diff-range
  • b361a91 Diff-informed analysis: fix empty PR handling
  • bd1d9ab Merge pull request #2816 from github/cklin/overlay-file-list
  • b98ae6c Add overlay-database-utils tests
  • 9825184 Add getFileOidsUnderPath() tests
  • ac67cff Merge pull request #2817 from github/cklin/default-setup-diff-informed
  • 9c674ba build: refresh js files
  • d109dd5 Detect PR branches for Default Setup
  • Additional commits viewable in compare view

Updates mikefarah/yq from 4.44.6 to 4.45.1

Release notes

Sourced from mikefarah/yq's releases.

v4.45.1 - Create parent directories when --split-exp is used!

  • Create parent directories when --split-exp is used, Thanks @​rudo-thomas
  • Bumped dependencies
Changelog

Sourced from mikefarah/yq's changelog.

4.45.1:

  • Create parent directories when --split-exp is used, Thanks @​rudo-thomas
  • Bumped dependencies

4.44.6:

4.44.5:

  • Fixing release pipeline

4.44.4:

  • Format comments with a gray foreground (Thanks @​gabe565)
  • Fixed handling of nulls with sort_by expressions #2164
  • Force no color output when NO_COLOR env presents (Thanks @​narqo)
  • Fixed array subtraction update bug #2159
  • Fixed index out of range error
  • Can traverse straight from parent operator (parent.blah)
  • Bumped dependencies

4.44.3:

  • Fixed upper-case file extension detection, Thanks @​ryenus (#2121)
  • Log printing follow no-colors flag #2082
  • Skip and warn when interpolating strings and theres a unclosed bracket #2083
  • Fixed CSV content starting with # issue #2076
  • Bumped dependencies

4.44.2:

  • Handle numbers with underscores #2039
  • Unique now works on maps and arrays #2068
  • Added support for short hand splat with env[] expression #2071, as well as many other operators (split,select,eval,pick..)
  • Bumped dependencies

4.44.1:

4.43.1:

... (truncated)

Commits
  • 8bf425b Bumping version
  • f755755 Updated release notes
  • 0f390b2 Bumping goccy
  • 31ad7fb Bump github.com/magiconair/properties from 1.8.7 to 1.8.9
  • 566cf82 Bump github.com/goccy/go-json from 0.10.3 to 0.10.4
  • 2c9f833 Bump github.com/elliotchance/orderedmap from 1.7.0 to 1.7.1
  • c02d44d Bump golang.org/x/net from 0.32.0 to 0.33.0
  • f73c862 feat: Create parent directories if --split-exp is used.
  • 294a170 Bumping version
  • See full diff in compare view

Updates anchore/sbom-action from 0.17.9 to 0.18.0

Release notes

Sourced from anchore/sbom-action's releases.

v0.18.0

Changes in v0.18.0

Commits
  • f325610 chore(deps): bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 (#511)
  • 83a99f5 chore(deps): bump release-drafter/release-drafter from 6.0.0 to 6.1.0 (#512)
  • 9af714f chore(deps): update Syft to v1.19.0 (#513)
  • See full diff in compare view

Updates goreleaser/goreleaser-action from 6.1.0 to 6.3.0

Release notes

Sourced from goreleaser/goreleaser-action's releases.

v6.3.0

Full Changelog: goreleaser/goreleaser-action@v6.2.1...v6.3.0

v6.2.1

What's Changed

This version of the actions adds support for GoReleaser Pro v2.7.0 versioning (which dropped the -pro suffix). Older versions should work fine.

[!WARNING] This version is required for GoReleaser Pro v2.7.0+. Read more here.

Full Changelog: goreleaser/goreleaser-action@v6.2.0...v6.2.1

v6.2.0

What's Changed

This version of the actions adds support for GoReleaser Pro v2.7.0 versioning (which dropped the -pro suffix). Older versions should work fine.

[!WARNING] This version is required for GoReleaser Pro v2.7.0+. Read more here.

Full Changelog: goreleaser/goreleaser-action@v6.1.0...v6.2.0

Commits

Updates google-github-actions/setup-gcloud from 2.1.2 to 2.1.4

Release notes

Sourced from google-github-actions/setup-gcloud's releases.

v2.1.4

What's Changed

Full Changelog: google-github-actions/setup-gcloud@v2.1.3...v2.1.4

v2.1.3

What's Changed

Full Changelog: google-github-actions/setup-gcloud@v2...v2.1.3

Commits

Updates slsa-framework/slsa-github-generator from 2.0.0 to 2.1.0

Release notes

Sourced from slsa-framework/slsa-github-generator's releases.

v2.1.0

What's Changed

... (truncated)

Changelog

Sourced from slsa-framework/slsa-github-generator's changelog.

v2.1.0

v2.1.0: Sigstore Bundles for Generic Generator and Go Builder

The workflows generator_generic_slsa3.yml and builder_go_slsa3.yml have been updated to produce signed Sigstore Bundles, just like all the other builders that use the BYOB framework.

The workflow logs will now print a LogIndex, rather than a LogUUID. Both are equally searchanble on https://search.sigstore.dev/.

v2.1.0: Vars context recorded in provenance

  • Updated: GitHub vars context is now recorded in provenance for the generic and container generators. The vars context cannot affect the build in the Go builder so it is not recorded.
Commits

Updates ossf/scorecard-action from 2.4.0 to 2.4.1

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.1

What's Changed

  • This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to the v5.1.0 and v5.1.1 release notes.
  • Publishing results now uses half the API quota as before. The exact savings depends on the repository in question.
  • Some errors were made into annotations to make them more visible
  • There is now an optional file_mode input which controls how repository files are fetched from GitHub. The default is archive, but git produces the most accurate results for repositories with .gitattributes files at the cost of analysis speed.
  • The underlying container for the action is now hosted on GitHub Container Registry. There should be no functional changes.

Docs

New Contributors

Commits
  • f49aabe bump docker to ghcr v2.4.1 (#1478)
  • 30a595b 🌱 Bump github.com/sigstore/cosign/v2 from 2.4.2 to 2.4.3 (#1515)
  • 69ae593 omit vcs info ...

    Description has been truncated

@dependabot
chore(deps): Bump the minor-patch group across 1 directory with 13 up…
0590066 
…dates

Bumps the minor-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.7.0` | `3.8.1` |
| [ko-build/setup-ko](https://github.com/ko-build/setup-ko) | `0.7` | `0.8` |
| [google-github-actions/auth](https://github.com/google-github-actions/auth) | `2.1.7` | `2.1.8` |
| [actions/cache](https://github.com/actions/cache) | `4.2.0` | `4.2.3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.27.9` | `3.28.13` |
| [mikefarah/yq](https://github.com/mikefarah/yq) | `4.44.6` | `4.45.1` |
| [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.17.9` | `0.18.0` |
| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6.1.0` | `6.3.0` |
| [google-github-actions/setup-gcloud](https://github.com/google-github-actions/setup-gcloud) | `2.1.2` | `2.1.4` |
| [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) | `2.0.0` | `2.1.0` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.0` | `2.4.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.4.3` | `4.6.2` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.1.1` | `5.4.0` |



Updates `sigstore/cosign-installer` from 3.7.0 to 3.8.1
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@dc72c7d...d7d6bc7)

Updates `ko-build/setup-ko` from 0.7 to 0.8
- [Release notes](https://github.com/ko-build/setup-ko/releases)
- [Commits](ko-build/setup-ko@3aebd05...d982fec)

Updates `google-github-actions/auth` from 2.1.7 to 2.1.8
- [Release notes](https://github.com/google-github-actions/auth/releases)
- [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md)
- [Commits](google-github-actions/auth@6fc4af4...71f9864)

Updates `actions/cache` from 4.2.0 to 4.2.3
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@1bd1e32...5a3ec84)

Updates `github/codeql-action` from 3.27.9 to 3.28.13
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@df409f7...1b549b9)

Updates `mikefarah/yq` from 4.44.6 to 4.45.1
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@4839dbb...8bf425b)

Updates `anchore/sbom-action` from 0.17.9 to 0.18.0
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@df80a98...f325610)

Updates `goreleaser/goreleaser-action` from 6.1.0 to 6.3.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@9ed2f89...9c156ee)

Updates `google-github-actions/setup-gcloud` from 2.1.2 to 2.1.4
- [Release notes](https://github.com/google-github-actions/setup-gcloud/releases)
- [Changelog](https://github.com/google-github-actions/setup-gcloud/blob/main/CHANGELOG.md)
- [Commits](google-github-actions/setup-gcloud@6189d56...77e7a55)

Updates `slsa-framework/slsa-github-generator` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases)
- [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md)
- [Commits](slsa-framework/slsa-github-generator@v2.0.0...v2.1.0)

Updates `ossf/scorecard-action` from 2.4.0 to 2.4.1
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@62b2cac...f49aabe)

Updates `actions/upload-artifact` from 4.4.3 to 4.6.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@b4b15b8...ea165f8)

Updates `codecov/codecov-action` from 5.1.1 to 5.4.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@7f8b4b4...0565863)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 3.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: ko-build/setup-ko
  dependency-version: '0.8'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: google-github-actions/auth
  dependency-version: 2.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: actions/cache
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: github/codeql-action
  dependency-version: 3.28.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: mikefarah/yq
  dependency-version: 4.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: anchore/sbom-action
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: google-github-actions/setup-gcloud
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: slsa-framework/slsa-github-generator
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: actions/upload-artifact
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: codecov/codecov-action
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants