GoogleCloudPlatform
chore(deps): update all non-major dependencies
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| actions/dependency-review-action | action | minor | v4.5.0 -> v4.7.1 |
| actions/setup-go | action | minor | v5.3.0 -> v5.5.0 |
| github/codeql-action | action | minor | v3.28.10 -> v3.29.0 |
| go | uses-with | minor | 1.20 -> 1.24 |
| ossf/scorecard-action | action | patch | v2.4.1 -> v2.4.2 |
| step-security/harden-runner | action | minor | v2.11.0 -> v2.12.1 |
Release Notes
actions/dependency-review-action (actions/dependency-review-action)
v4.7.1
- Packages added to
allow-dependencies-licenseswill be allowed even if the package in question has no license information #889 - License expressions (e.g.
Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g.Ruby)
v4.7.0
- Handle complex license expressions (e.g.
MIT AND GPL-2.0) in allow lists (fixes #809 and probably others) - Replace
OTHERin package licenses withLicenseRef-clearlydefined-OTHERso that parsing passes
v4.6.0
What's Changed
- Updating multiple dependency versions by @Ahmed3lmallah in https://github.com/actions/dependency-review-action/pull/870
- Grouping minor and patch dependabot updates to lessen the number of PRs by @Ahmed3lmallah in https://github.com/actions/dependency-review-action/pull/876
- Bump actions/stale from 9.0.0 to 9.1.0 by @dependabot in https://github.com/actions/dependency-review-action/pull/878
- Bump undici from 5.28.4 to 5.28.5 by @dependabot in https://github.com/actions/dependency-review-action/pull/877
- DR Action should link to the proxima stamp when appropriate in error messages by @AshelyTC in https://github.com/actions/dependency-review-action/pull/891
- Allow deny package removal by @ellenfieldn in https://github.com/actions/dependency-review-action/pull/888
- Fix typos by @omahs in https://github.com/actions/dependency-review-action/pull/893
- Bump esbuild from 0.19.5 to 0.25.0 by @dependabot in https://github.com/actions/dependency-review-action/pull/900
- Bump octokit and related dependencies by @RomanIakovlev in https://github.com/actions/dependency-review-action/pull/904
- Bump @babel/helpers from 7.23.2 to 7.26.10 by @dependabot in https://github.com/actions/dependency-review-action/pull/905
- Bump @octokit/plugin-paginate-rest from 9.1.5 to 9.2.2 by @dependabot in https://github.com/actions/dependency-review-action/pull/899
- Update transitive dependency spdx-license-ids by @ailox in https://github.com/actions/dependency-review-action/pull/855
- To not print OpenSSF Scorecard section if no dependencies scanned by @fabasoad in https://github.com/actions/dependency-review-action/pull/884
- Improve usage of this action in dependency-review.yml by @fabasoad in https://github.com/actions/dependency-review-action/pull/883
- Clarify comment-summary-in-pr behaviour by @Pantelis-Santorinios in https://github.com/actions/dependency-review-action/pull/902
- Prepare 4.6.0 Release candidate by @brrygrdn in https://github.com/actions/dependency-review-action/pull/910
New Contributors
- @AshelyTC made their first contribution in https://github.com/actions/dependency-review-action/pull/891
- @ellenfieldn made their first contribution in https://github.com/actions/dependency-review-action/pull/888
- @omahs made their first contribution in https://github.com/actions/dependency-review-action/pull/893
- @RomanIakovlev made their first contribution in https://github.com/actions/dependency-review-action/pull/904
- @ailox made their first contribution in https://github.com/actions/dependency-review-action/pull/855
- @fabasoad made their first contribution in https://github.com/actions/dependency-review-action/pull/884
- @Pantelis-Santorinios made their first contribution in https://github.com/actions/dependency-review-action/pull/902
- @brrygrdn made their first contribution in https://github.com/actions/dependency-review-action/pull/910
Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.5.0...v4.6.0
actions/setup-go (actions/setup-go)
v5.5.0
What's Changed
Bug fixes:
- Update self-hosted environment validation by @priyagupta108 in https://github.com/actions/setup-go/pull/556
- Add manifest validation and improve error handling by @priyagupta108 in https://github.com/actions/setup-go/pull/586
- Update template link by @jsoref in https://github.com/actions/setup-go/pull/527
Dependency updates:
- Upgrade @action/cache from 4.0.2 to 4.0.3 by @aparnajyothi-y in https://github.com/actions/setup-go/pull/574
- Upgrade @actions/glob from 0.4.0 to 0.5.0 by @dependabot in https://github.com/actions/setup-go/pull/573
- Upgrade ts-jest from 29.1.2 to 29.3.2 by @dependabot in https://github.com/actions/setup-go/pull/582
- Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @dependabot in https://github.com/actions/setup-go/pull/537
New Contributors
- @jsoref made their first contribution in https://github.com/actions/setup-go/pull/527
Full Changelog: https://github.com/actions/setup-go/compare/v5...v5.5.0
v5.4.0
What's Changed
Dependency updates :
- Upgrade semver from 7.6.0 to 7.6.3 by @dependabot in https://github.com/actions/setup-go/pull/535
- Upgrade eslint-config-prettier from 8.10.0 to 10.0.1 by @dependabot in https://github.com/actions/setup-go/pull/536
- Upgrade @action/cache from 4.0.0 to 4.0.2 by @aparnajyothi-y in https://github.com/actions/setup-go/pull/568
- Upgrade undici from 5.28.4 to 5.28.5 by @dependabot in https://github.com/actions/setup-go/pull/541
New Contributors
- @aparnajyothi-y made their first contribution in https://github.com/actions/setup-go/pull/568
Full Changelog: https://github.com/actions/setup-go/compare/v5...v5.4.0
github/codeql-action (github/codeql-action)
v3.29.0
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.29.0 - 11 Jun 2025
- Update default CodeQL bundle version to 2.22.0. #2925
- Bump minimum CodeQL bundle version to 2.16.6. #2912
See the full CHANGELOG.md for more information.
v3.28.19
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.19 - 03 Jun 2025
- The CodeQL Action no longer includes its own copy of the extractor for the
actionslanguage, which is currently in public preview. Theactionsextractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled theactionslanguage and you have pinned yourtools:property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disableactionsanalysis. - Update default CodeQL bundle version to 2.21.4. #2910
See the full CHANGELOG.md for more information.
v3.28.18
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.18 - 16 May 2025
- Update default CodeQL bundle version to 2.21.3. #2893
- Skip validating SARIF produced by CodeQL for improved performance. #2894
- The number of threads and amount of RAM used by CodeQL can now be set via the
CODEQL_THREADSandCODEQL_RAMrunner environment variables. If set, these environment variables override thethreadsandraminputs respectively. #2891
See the full CHANGELOG.md for more information.
v3.28.17
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.17 - 02 May 2025
- Update default CodeQL bundle version to 2.21.2. #2872
See the full CHANGELOG.md for more information.
v3.28.16
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.16 - 23 Apr 2025
- Update default CodeQL bundle version to 2.21.1. #2863
See the full CHANGELOG.md for more information.
v3.28.15
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.15 - 07 Apr 2025
- Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842
See the full CHANGELOG.md for more information.
v3.28.14
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.14 - 07 Apr 2025
- Update default CodeQL bundle version to 2.21.0. #2838
See the full CHANGELOG.md for more information.
v3.28.13
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.13 - 24 Mar 2025
No user facing changes.
See the full CHANGELOG.md for more information.
v3.28.12
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.12 - 19 Mar 2025
- Dependency caching should now cache more dependencies for Java
build-mode: noneextractions. This should speed up workflows and avoid inconsistent alerts in some cases. - Update default CodeQL bundle version to 2.20.7. #2810
See the full CHANGELOG.md for more information.
v3.28.11
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
3.28.11 - 07 Mar 2025
- Update default CodeQL bundle version to 2.20.6. #2793
See the full CHANGELOG.md for more information.
actions/go-versions (go)
v1.24.4: 1.24.4
Go 1.24.4
v1.24.3: 1.24.3
Go 1.24.3
v1.24.2: 1.24.2
Go 1.24.2
v1.24.1: 1.24.1
Go 1.24.1
v1.24.0: 1.24.0
Go 1.24.0
v1.23.10: 1.23.10
Go 1.23.10
v1.23.9: 1.23.9
Go 1.23.9
v1.23.8: 1.23.8
Go 1.23.8
v1.23.7: 1.23.7
Go 1.23.7
v1.23.6: 1.23.6
Go 1.23.6
v1.23.5: 1.23.5
Go 1.23.5
v1.23.4: 1.23.4
Go 1.23.4
v1.23.3: 1.23.3
Go 1.23.3
v1.23.2: 1.23.2
Go 1.23.2
v1.23.1: 1.23.1
Go 1.23.1
v1.23.0: 1.23.0
Go 1.23.0
v1.22.12: 1.22.12
Go 1.22.12
v1.22.11: 1.22.11
Go 1.22.11
v1.22.10: 1.22.10
Go 1.22.10
v1.22.9: 1.22.9
Go 1.22.9
v1.22.8: 1.22.8
Go 1.22.8
v1.22.7: 1.22.7
Go 1.22.7
v1.22.6: 1.22.6
Go 1.22.6
v1.22.5: 1.22.5
Go 1.22.5
v1.22.4: 1.22.4
Go 1.22.4
v1.22.3: 1.22.3
Go 1.22.3
v1.22.2: 1.22.2
Go 1.22.2
v1.22.1: 1.22.1
Go 1.22.1
v1.22.0: 1.22.0
Go 1.22.0
v1.21.13: 1.21.13
Go 1.21.13
v1.21.12: 1.21.12
Go 1.21.12
v1.21.11: 1.21.11
Go 1.21.11
v1.21.10: 1.21.10
Go 1.21.10
v1.21.9: 1.21.9
Go 1.21.9
v1.21.8: 1.21.8
Go 1.21.8
v1.21.7: 1.21.7
Go 1.21.7
v1.21.6: 1.21.6
Go 1.21.6
v1.21.5: 1.21.5
Go 1.21.5
v1.21.4: 1.21.4
Go 1.21.4
v1.21.3: 1.21.3
Go 1.21.3
v1.21.2: 1.21.2
Go 1.21.2
v1.21.1: 1.21.1
Go 1.21.1
v1.21.0: 1.21.0
Go 1.21.0
ossf/scorecard-action (ossf/scorecard-action)
v2.4.2
What's Changed
This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.
Full Changelog: https://github.com/ossf/scorecard-action/compare/v2.4.1...v2.4.2
step-security/harden-runner (step-security/harden-runner)
v2.12.1
What's Changed
- Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
- Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.
Full Changelog: https://github.com/step-security/harden-runner/compare/v2...v2.12.1
v2.12.0
What's Changed
-
A new option,
disable-sudo-and-containers, is now available to replace thedisable-sudo policy, addressing Docker-based privilege escalation (CVE-2025-32955). More details can be found in this blog post. -
New detections have been added based on insights from the tj-actions and reviewdog actions incidents.
Full Changelog: https://github.com/step-security/harden-runner/compare/v2...v2.12.0
v2.11.1
What's Changed
- cache: add support for GitHub Actions cache v2 by @h0x0er in https://github.com/step-security/harden-runner/pull/529
Full Changelog: https://github.com/step-security/harden-runner/compare/v2...v2.11.1
Configuration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- [ ] If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
