From fd4636aab2bf06229f89524160bea4b1bf718714 Mon Sep 17 00:00:00 2001 From: Owl Bot Date: Tue, 15 Jul 2025 17:23:06 +0000 Subject: [PATCH] build: fix cross-span and setuptools CVEs Fixes CVE-2024-21538 and CVE-2024-6345 . b/430729479 * use python:3.10.18-bullseye for PHP base to fix Kokoro failure Source-Link: https://github.com/googleapis/synthtool/commit/65d4020efe345d7e36b676eba3d02f991b3314e9 Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-nodejs:latest@sha256:a52bd494fc1fe28479d7982db3d0f8bd49d862b4184c4574ca0931e99ac1ffee --- .github/.OwlBot.lock.yaml | 4 ++-- .github/workflows/ci.yaml | 2 +- .github/workflows/issues-no-repro.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/.OwlBot.lock.yaml b/.github/.OwlBot.lock.yaml index 60443342..cfb414e1 100644 --- a/.github/.OwlBot.lock.yaml +++ b/.github/.OwlBot.lock.yaml @@ -13,5 +13,5 @@ # limitations under the License. docker: image: gcr.io/cloud-devrel-public-resources/owlbot-nodejs:latest - digest: sha256:c7e4968cfc97a204a4b2381f3ecb55cabc40c4cccf88b1ef8bef0d976be87fee -# created: 2025-04-08T17:33:08.498793944Z + digest: sha256:a52bd494fc1fe28479d7982db3d0f8bd49d862b4184c4574ca0931e99ac1ffee +# created: 2025-07-15T17:18:59.198670588Z diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 883082c0..ba80cb2c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - node: [18, 20, 22] + node: [18, 20, 22, 24] steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 diff --git a/.github/workflows/issues-no-repro.yaml b/.github/workflows/issues-no-repro.yaml index 9b2f7014..816d9a70 100644 --- a/.github/workflows/issues-no-repro.yaml +++ b/.github/workflows/issues-no-repro.yaml @@ -11,7 +11,7 @@ jobs: pull-requests: write steps: - uses: actions/checkout@v4 - - uses: actions/setup-node@v3 + - uses: actions/setup-node@v4 with: node-version: 18 - run: npm install