chore(deps): update all non-major dependencies#174
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
chore(deps): update all non-major dependencies#174renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 7 | 0 | 0 | 0.16s | |
| ✅ COPYPASTE | jscpd | yes | no | no | 1.58s | |
| ✅ DOCKERFILE | hadolint | 1 | 0 | 0 | 0.09s | |
| ✅ JSON | jsonlint | 3 | 0 | 0 | 0.12s | |
| prettier | 3 | 1 | 0 | 0.61s | ||
| ✅ JSON | v8r | 3 | 0 | 0 | 2.84s | |
| ✅ PYTHON | bandit | 1 | 0 | 0 | 2.09s | |
| ✅ PYTHON | black | 1 | 0 | 0 | 0.7s | |
| ✅ PYTHON | flake8 | 1 | 0 | 0 | 1.13s | |
| ✅ PYTHON | isort | 1 | 0 | 0 | 0.44s | |
| ✅ PYTHON | mypy | 1 | 0 | 0 | 3.4s | |
| ✅ PYTHON | pylint | 1 | 0 | 0 | 3.21s | |
| ✅ PYTHON | pyright | 1 | 0 | 0 | 1.68s | |
| ✅ PYTHON | ruff | 1 | 0 | 0 | 0.04s | |
| ✅ REPOSITORY | checkov | yes | no | no | 24.25s | |
| ✅ REPOSITORY | devskim | yes | no | no | 1.56s | |
| ✅ REPOSITORY | dustilock | yes | no | no | 0.02s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.34s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | |
| ✅ REPOSITORY | grype | yes | no | no | 46.81s | |
| ✅ REPOSITORY | kics | yes | no | no | 4.35s | |
| ✅ REPOSITORY | kingfisher | yes | no | no | 5.8s | |
| ✅ REPOSITORY | secretlint | yes | no | no | 1.36s | |
| ✅ REPOSITORY | syft | yes | no | no | 3.12s | |
| ✅ REPOSITORY | trivy | yes | no | no | 12.04s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.09s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.89s | |
| ✅ YAML | prettier | 9 | 0 | 0 | 0.88s | |
| ✅ YAML | v8r | 9 | 0 | 0 | 8.48s | |
| ✅ YAML | yamllint | 9 | 0 | 0 | 1.27s |
Detailed Issues
⚠️ JSON / prettier - 1 error
Checking formatting...
[warn] renovate/default.json
[warn] Code style issues found in the above file. Run Prettier with --write to fix.
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.4.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_KICS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
24c5d52 to
6ea155d
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
6ea155d to
043e571
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
043e571 to
882ad7e
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
882ad7e to
ceabaa0
Compare
Trivy image scan report
|
| Package | ID | Severity | Installed Version | Fixed Version |
|---|---|---|---|---|
libssl3 |
CVE-2026-31790 | MEDIUM | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28387 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28388 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28389 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28390 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-31789 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
No Misconfigurations found
Trivy image scan report
|
| Package | ID | Severity | Installed Version | Fixed Version |
|---|---|---|---|---|
libssl3 |
CVE-2026-31790 | MEDIUM | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28387 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28388 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28389 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28390 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-31789 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
No Misconfigurations found
Trivy image scan report
|
| Package | ID | Severity | Installed Version | Fixed Version |
|---|---|---|---|---|
libssl3 |
CVE-2026-31790 | MEDIUM | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28387 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28388 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28389 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-28390 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
libssl3 |
CVE-2026-31789 | LOW | 3.0.18-1~deb12u2 | 3.0.19-1~deb12u2 |
No Misconfigurations found
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
9.4.0→9.4.11.22.0→1.23.11.24.1(+1)Release Notes
gradle/gradle (gradle)
v9.4.1Compare Source
zizmorcore/zizmor (zizmor)
v1.23.1Compare Source
Bug Fixes 🐛🔗
v1.23.0Compare Source
New Features 🌈🔗
New audit: secrets-outside-env detects usage of the secrets context in jobs that don't have a corresponding environment (#1599)
New audit: superfluous-actions detects usage of actions that perform operations already provided by GitHub's own runner images (#1618)
Enhancements 🌱🔗
zizmor's LSP mode is now configuration-aware, and will load configuration files relative to workspace roots (#1555)
zizmor now reads the GITHUB_TOKEN environment variable as an alias/equivalent for GH_TOKEN (#1566)
zizmor now supports inputs that contain duplicated anchor names (#1575)
zizmor now flags missing cooldowns on opentofu ecosystem definitions in Dependabot (again) (#1586)
zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
The SARIF output format now adds zizmor/confidence, zizmor/persona and zizmor/severity to the properties of findings (#1656)
Added awalsh128/cache-apt-pkgs-action as a cache-aware action to the cache-poisoning audit (#1708)
Changes⚠️ 🔗
SARIF categories have been regraded. zizmor's "medium" is changed from SARIF's "warning" to "low" (#1635)
Bug Fixes 🐛🔗
Fixed a bug where zizmor would crash on uses: clauses containing non-significant whitespace while performing the unpinned-uses audit (#1544)
Fixed a bug in yamlpath where sequences containing anchors were splatted instead of being properly nested (#1557)
Many thanks to @DarkaMaul for implementing this fix!
Fixed a bug in yamlpath where anchor prefixes in sequences and mapping were not stripped during path queries (#1562)
Fixed a bug where "merge into" autofixes would produce incorrect patches in the presence of multi-byte Unicode characters (#1581)
Many thanks to @ManuelLerchnerQC for implementing this fix!
Fixed a bug where the template-injection audit would produce duplicated pedantic-only findings (#1589)
Fixed a bug where the obfuscation audit would produce incorrect autofixes for a subset of constant-reducible expressions (#1597)
Fixed a bug where the obfuscation audit would fail to apply fixes to a subset of inputs with leading whitespace (#1597)
Fixed a bug where the concurrency-limits audit would incorrectly flag reusable-only workflows as needing a concurrency: key (#1620)
Fixed a bug where the known-vulnerable-actions audit would fail when applying some fixes (#1640)
Many thanks to @reubenwong97 for implementing this fix!
Fixed a bug where the pre-commit ecosystem was not recognized in Dependabot configuration files (#1637)
Fixed a bug where the template-injection audit would incorrectly flag github.triggering_actor as an injection risk in the default persona (#1645)
Fixed a bug where zizmor's expression parser did not correctly handle number literals in GitHub Actions expressions (#1625)
Fixed a bug where the template-injection audit would crash on some forms of multi-line expressions (#1669)
Fixed a bug where deserialization of a workflow containing fractional minutes would fail (#1675)
Fixed a bug where deserialization of a workflow where a workflow_run with a scalar types would fail (#1676)
Fixed a bug where zizmor would crash on workflows containing bare numeric values in if: conditions (#1683)
Fixed a bug where GitHub Actions expression string comparisons were not case-insensitive (#1687)
Configuration
📅 Schedule: (UTC)
* 0-3 1 * *)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.