Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update: bump the gh-actions-packages group across 1 directory with 3 updates #1754

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 10, 2024

Bumps the gh-actions-packages group with 3 updates in the / directory: github/codeql-action, bridgecrewio/checkov-action and securego/gosec.

Updates github/codeql-action from 3.26.4 to 3.26.6

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.26.6 - 29 Aug 2024

  • Update default CodeQL bundle version to 2.18.3. #2449

3.26.5 - 23 Aug 2024

  • Fix an issue where the csrutil system call used for telemetry would fail on MacOS ARM machines with System Integrity Protection disabled. #2441

3.26.4 - 21 Aug 2024

  • Deprecation: The add-snippets input on the analyze Action is deprecated and will be removed in the first release in August 2025. #2436
  • Fix an issue where the disk usage system call used for telemetry would fail on MacOS ARM machines with System Integrity Protection disabled, and then surface a warning. The system call is now disabled for these machines. #2434

3.26.3 - 19 Aug 2024

  • Fix an issue where the CodeQL Action could not write diagnostic messages on Windows. This issue did not impact analysis quality. #2430

3.26.2 - 14 Aug 2024

  • Update default CodeQL bundle version to 2.18.2. #2417

3.26.1 - 13 Aug 2024

No user facing changes.

3.26.0 - 06 Aug 2024

  • Deprecation: Swift analysis on Ubuntu runner images is no longer supported. Please migrate to a macOS runner if this affects you. #2403
  • Bump the minimum CodeQL bundle version to 2.13.5. #2408

3.25.15 - 26 Jul 2024

  • Update default CodeQL bundle version to 2.18.1. #2385

3.25.14 - 25 Jul 2024

  • Experimental: add a new start-proxy action which starts the same HTTP proxy as used by github/dependabot-action. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2376

3.25.13 - 19 Jul 2024

... (truncated)

Commits
  • 4dd1613 Merge pull request #2452 from github/update-v3.26.6-7233ec5e6
  • dd9dd2d Update changelog for v3.26.6
  • 7233ec5 Merge pull request #2449 from github/update-bundle/codeql-bundle-v2.18.3
  • a32c44d Add changelog note
  • 2966897 Update default bundle to codeql-bundle-v2.18.3
  • b8efe4d Merge pull request #2435 from github/update-supported-enterprise-server-versions
  • ab408a8 Merge branch 'main' into update-supported-enterprise-server-versions
  • 864b979 Merge pull request #2443 from github/dbartol/config-file-telemetry
  • d36c7aa Merge pull request #2448 from github/dependabot/npm_and_yarn/npm-09b7c43f6b
  • b3bf514 Update checked-in dependencies
  • Additional commits viewable in compare view

Updates bridgecrewio/checkov-action from 12.2857.0 to 12.2867.0

Commits
  • 6429623 Bump checkov container version to 3.2.249
  • 330d6e0 Bump checkov container version to 3.2.248
  • 9794a0e Bump checkov container version to 3.2.247
  • c942186 Bump checkov container version to 3.2.243
  • 37f9854 Bump checkov container version to 3.2.242
  • be3465a Bump checkov container version to 3.2.241
  • 7ac2a96 Bump checkov container version to 3.2.240
  • 1b813e8 Bump checkov container version to 3.2.238
  • f11115e Bump checkov container version to 3.2.237
  • 4fa9032 Bump checkov container version to 3.2.236
  • See full diff in compare view

Updates securego/gosec from 2.20.0 to 2.21.2

Release notes

Sourced from securego/gosec's releases.

v2.21.2

Changelog

  • abfe8cfd6d5687c96abf31f8e7f57982df2a6e4f Update the SARIF schema URL (#1217)
  • 0396179112d5e2071365e5ecb2a75d77e90852f8 Update go version to 1.23.1 and 1.22.7 (#1216)
  • 5e53c8b9f7f77380e95960e6095392f49977e63d chore(deps): update all dependencies (#1215)
  • 014751c91c04fe3fe05e381dea9faadbd4ce8e78 Update gosec version to v2.21.1 in github action (#1213)

v2.21.1

Changelog

  • 0ce4453ddd8cca1291d2056cf903b545baad95a0 Rollback the SARIF version to 2.1 since github doesn't support 2.2 (#1210)
  • ea26e8431f53a5d229b1c07ffe3529008a01c25e Update gosec in github action to v2.21.0 (#1208)

v2.21.0

Changelog

  • b278b40c5266eb2b52f41c57d9e6509d9360a2a6 Update cosign version to v2.4.0 in release github workflow (#1207)
  • eaedce9a8b64ce207e25553232bcc7541e0044e7 Improvement the int conversion overflow logic to handle bound checks (#1194)
  • ea5b2766bb1abd38e13375c0e2d789f8ab2b789c fix: G602 support for nested conditionals with bounds check (#1201)
  • 11d69032b0856c96afd4c493967ab7a30e20ff5e Update go.mod to sue go 1.22.0 toolchain
  • 655527dfb4df16091cbdc0a10bd89c2d5d9312a5 chore(deps): update all dependencies
  • 08985601695d7b6eb13330521c80859adc9d72aa Make variable name more clear
  • ac67231ec5a73f1525942d5ef482d1152e61ac3f Make variable names more explicity and reduce duplications
  • e0414c46402de6813677e1868b6c0f82270fdb80 Fix formatting
  • c7003fc7e5e7f05783097793d4410d50896e06d4 Refactor to reduce some fuctions and variable names
  • 2401936458ea4c80b8c83a3500d9354ca3914605 Pass the value argument directly since is an interface
  • f5d312825f753d7c598fcd5e80e2c9c6f9cb1776 Added suggested changes
  • a14ca4ac59d9b519d1b195afe6098ff13d574d32 Added another test case in order to increase code coverage
  • a6dd589bae11a5eb18408a4a75e63e46833a01a3 Removed function parameter which is always the same
  • b4c746962f33c83ec64ce337e546bd0cc6529cd1 Formatting problems(CI was not passing)
  • 7f8f654235b42704bab6c65c3459a2824bccadd3 Updated analyzer to use new way of initialization
  • a26215cf23be85d473f6d5a1e059a02406ea5d55 Migrated the rule to the analyzers folder
  • 3f6e1e7326fe7849aaaaf35698907a1a7c504997 Refractored code a little bit
  • 0eb8143c23b649a345370fd169baff6525c34bd9 Added new rule G407(hardcoded IV/nonce)
  • 4ae73c8ba3a6b38e3c1bafad75f59cb4910e389f Fix conversion overflow false positive when using ParseUint
  • c52dc0ea4e0fed5898f6b1d1f1028bd20ac0fa86 Add a build step to measure the scan perfomance
  • bcec04e784830d45797201cb889246bf266cd941 Fix conversion overflow false positives when they are checked or pre-determined
  • 71e397b9944c50b3f8f9e0e3e1904047c7b3967e Update go.mod
  • aec45b0b7dd15c03d89d67e16b93f41df8ece85b chore(deps): update all dependencies
  • ab3f6c1c83a0c80fcb8c95838de10cc3cf0d8ba2 Fix false positive in conversion overflow check from uint8/int8 type
  • a39ec5a16bca81f2442050ce3d2d442911ace4cc Disable staticcheck SA1019 rule
  • a1b2ab80af682c279271a7d3e3cf939e0e5c2847 Update the golangci linters
  • 8467f012e0d6238433e299fd0499ee29342000c3 Add more test to cover more use cases for G115 rule
  • 81cda2f91fbe1bf4735feb55febcae03e697a92b Allow excluding analyzers globally (#1180)
  • 18135b439cbafc52ac712528099193a0d6b18a33 Update to Go 1.23.0 (#1183)
  • 91c708a62031dd4b92ae057c8835b975bf80c134 chore(deps): update all dependencies (#1182)
  • 92bac42afce8fee2756fb7d7f491328bd069ebec Read the AI API key also from an environment variable (#1181)
  • 56f943b802579b69d96f0999a7943c588e600ae7 Add support to generate auto fixes using LLM (AI) (#1177)
  • f33fd4bf29722188b24b4a55b512d12adcd8b216 chore(deps): update all dependencies
  • 55a47f37740ea50048d4396051e2a60c794bec1d chore(deps): update all dependencies
  • a5d9ef67e2c945ab409da174596ee8be564633fe chore(deps): update all dependencies
  • 68424445af83e15ed94b4d9b26ee00089d2a87d6 chore(deps): update dependency babel-standalone to v7.24.10

... (truncated)

Commits
  • abfe8cf Update the SARIF schema URL (#1217)
  • 0396179 Update go version to 1.23.1 and 1.22.7 (#1216)
  • 5e53c8b chore(deps): update all dependencies (#1215)
  • 014751c Update gosec version to v2.21.1 in github action (#1213)
  • 0ce4453 Rollback the SARIF version to 2.1 since github doesn't support 2.2 (#1210)
  • ea26e84 Update gosec in github action to v2.21.0 (#1208)
  • b278b40 Update cosign version to v2.4.0 in release github workflow (#1207)
  • eaedce9 Improvement the int conversion overflow logic to handle bound checks (#1194)
  • ea5b276 fix: G602 support for nested conditionals with bounds check (#1201)
  • 11d6903 Update go.mod to sue go 1.22.0 toolchain
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…updates

Bumps the gh-actions-packages group with 3 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action), [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) and [securego/gosec](https://github.com/securego/gosec).


Updates `github/codeql-action` from 3.26.4 to 3.26.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f0f3afe...4dd1613)

Updates `bridgecrewio/checkov-action` from 12.2857.0 to 12.2867.0
- [Release notes](https://github.com/bridgecrewio/checkov-action/releases)
- [Commits](bridgecrewio/checkov-action@b57df80...6429623)

Updates `securego/gosec` from 2.20.0 to 2.21.2
- [Release notes](https://github.com/securego/gosec/releases)
- [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml)
- [Commits](securego/gosec@6fbd381...abfe8cf)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions-packages
- dependency-name: bridgecrewio/checkov-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gh-actions-packages
- dependency-name: securego/gosec
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gh-actions-packages
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Sep 10, 2024
@codecov-commenter
Copy link

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 91.26%. Comparing base (19f4cc7) to head (b078057).
Report is 13 commits behind head on develop.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #1754      +/-   ##
===========================================
+ Coverage    84.00%   91.26%   +7.25%     
===========================================
  Files           42       35       -7     
  Lines         2939     2530     -409     
===========================================
- Hits          2469     2309     -160     
+ Misses         404      170     -234     
+ Partials        66       51      -15     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 11, 2024

Superseded by #1755.

@dependabot dependabot bot closed this Sep 11, 2024
@dependabot dependabot bot deleted the dependabot/github_actions/develop/gh-actions-packages-2ed62f238f branch September 11, 2024 03:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant