matrix-art.meta

248.json (10044B)

---

 {
   "number": 248,
   "title": "Bump ossf/scorecard-action from 1.0.4 to 2.1.2",
   "state": "closed",
   "diff_file": "248.diff",
   "author": "dependabot[bot]",
   "created_at": "2023-01-03T16:43:16Z",
   "closed_at": "2023-01-03T16:44:10Z",
   "merged_at": null,
   "base_ref": "main",
   "head_ref": "dependabot/github_actions/ossf/scorecard-action-2.1.2",
   "labels": [
     "dependencies",
     "github_actions"
   ],
   "assignees": [
     "MTRNord"
   ],
   "requested_reviewers": [
     "MTRNord"
   ],
   "body": "Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 1.0.4 to 2.1.2.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a href=\"https://github.com/ossf/scorecard-action/releases\">ossf/scorecard-action's releases</a>.</em></p>\n<blockquote>\n<h2>v2.1.2</h2>\n<h2>What's Changed</h2>\n<h3>Fixes</h3>\n<ul>\n<li>\ud83c\udf31 Bump scorecard dependency to v4.10.2 to remove a CODEOWNERS printf statement. by <a href=\"https://github.com/spencerschrock\"><code>@\u200bspencerschrock</code></a> in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/1054\">ossf/scorecard-action#1054</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/ossf/scorecard-action/compare/v2.1.1...v2.1.2\">https://github.com/ossf/scorecard-action/compare/v2.1.1...v2.1.2</a></p>\n<h2>v2.1.1</h2>\n<h2>Scorecard version</h2>\n<p>This release use <a href=\"https://github.com/ossf/scorecard/releases/tag/v4.10.1\">Scorecard's v4.10.1</a></p>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/ossf/scorecard-action/compare/v2.1.0...v2.1.1\">https://github.com/ossf/scorecard-action/compare/v2.1.0...v2.1.1</a></p>\n<h2>v2.1.0</h2>\n<h2>What's Changed</h2>\n<h3>Scorecard version</h3>\n<p>This release uses <a href=\"https://github.com/ossf/scorecard/releases/tag/v4.10.0\">scorecard v4.10.0</a>.</p>\n<h3>Improvements</h3>\n<ul>\n<li>Docker build workflow by <a href=\"https://github.com/naveensrinivasan\"><code>@\u200bnaveensrinivasan</code></a> in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/981\">ossf/scorecard-action#981</a></li>\n<li>Use root user in distroless to support GitHub Actions by <a href=\"https://github.com/spencerschrock\"><code>@\u200bspencerschrock</code></a> in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/994\">ossf/scorecard-action#994</a></li>\n<li>Disable pull_request_target by <a href=\"https://github.com/laurentsimon\"><code>@\u200blaurentsimon</code></a> in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/1031\">ossf/scorecard-action#1031</a></li>\n</ul>\n<h3>Documentation</h3>\n<ul>\n<li>Add PAT section explaining risks by <a href=\"https://github.com/olivekl\"><code>@\u200bolivekl</code></a> in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/1024\">ossf/scorecard-action#1024</a></li>\n<li>Make the badge text easier to copy by <a href=\"https://github.com/rajbos\"><code>@\u200brajbos</code></a> in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/1026\">ossf/scorecard-action#1026</a></li>\n</ul>\n<h2>New Contributors</h2>\n<ul>\n<li><a href=\"https://github.com/joycebrum\"><code>@\u200bjoycebrum</code></a> made their first contribution in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/984\">ossf/scorecard-action#984</a></li>\n<li><a href=\"https://github.com/rajbos\"><code>@\u200brajbos</code></a> made their first contribution in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/1026\">ossf/scorecard-action#1026</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/ossf/scorecard-action/compare/v2.0.6...v2.1.0\">https://github.com/ossf/scorecard-action/compare/v2.0.6...v2.1.0</a></p>\n<h2>v2.0.6</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>Fix - Broken dockerfile by <a href=\"https://github.com/naveensrinivasan\"><code>@\u200bnaveensrinivasan</code></a> in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/979\">ossf/scorecard-action#979</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/ossf/scorecard-action/compare/v2.0.5...v2.0.6\">https://github.com/ossf/scorecard-action/compare/v2.0.5...v2.0.6</a></p>\n<h2>v2.0.5</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>Remove trailing space from example by <a href=\"https://github.com/jamacku\"><code>@\u200bjamacku</code></a> in <a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/pull/955\">ossf/scorecard-action#955</a></li>\n</ul>\n<!-- raw HTML omitted -->\n</blockquote>\n<p>... (truncated)</p>\n</details>\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/e38b1902ae4f44df626f11ba0734b14fb91f8f86\"><code>e38b190</code></a> Bump docker tag for release. (<a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/issues/1055\">#1055</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/7da02bf0d58396bc404a7e5aef3e9b0c24dcb9bc\"><code>7da02bf</code></a> Bump scorecard to v4.10.2 to remove a CODEOWNERS printf statement. (<a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/issues/1054\">#1054</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/013c0f8bd2b3c3003f636c6766a361e000c32d25\"><code>013c0f8</code></a> :seedling: Bump actions/dependency-review-action from 3.0.1 to 3.0.2</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/f93c094f4acf097f91d5753d637606bc11fdd8f6\"><code>f93c094</code></a> :seedling: Bump github/codeql-action from 2.1.36 to 2.1.37</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/ce8978e058ff447b9df113f0f576b977fc627d6d\"><code>ce8978e</code></a> :seedling: Bump actions/upload-artifact from 3.1.0 to 3.1.1</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/5ce49db1aa7b24de0c4143035a64115e9c674b14\"><code>5ce49db</code></a> :seedling: Bump actions/setup-go from 3.4.0 to 3.5.0</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/15c10fcf1cf912bd22260bfec67569a359ab87da\"><code>15c10fc</code></a> Update tag to v2.1.1 (<a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/issues/1047\">#1047</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/f96da1a128903623ca8553562d0a85aa8b11d5af\"><code>f96da1a</code></a> :seedling: Update scorecard for the panic (<a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/issues/1045\">#1045</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/813a8251528830defc8d1d9e3b20ba7640225d7d\"><code>813a825</code></a> Complete the list of required actions (<a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/issues/1044\">#1044</a>)</li>\n<li><a href=\"https://github.com/ossf/scorecard-action/commit/be62ea89c1d5c6cb8560cb24a4da589926d74068\"><code>be62ea8</code></a> Update RELEASE.md (<a href=\"https://github-redirect.dependabot.com/ossf/scorecard-action/issues/1042\">#1042</a>)</li>\n<li>Additional commits viewable in <a href=\"https://github.com/ossf/scorecard-action/compare/c1aec4ac820532bab364f02a81873c555a0ba3a1...e38b1902ae4f44df626f11ba0734b14fb91f8f86\">compare view</a></li>\n</ul>\n</details>\n<br />\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action&package-manager=github_actions&previous-version=1.0.4&new-version=2.1.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge and block automerging\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n</details>",
   "comments": [
     {
       "author": "dependabot[bot]",
       "created_at": "2023-01-03T16:44:12Z",
       "body": "OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`. You can also ignore all major, minor, or patch releases for a dependency by adding an [`ignore` condition](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#ignore) with the desired `update_types` to your config file.\n\nIf you change your mind, just re-open this PR and I'll resolve any conflicts on it."
     }
   ],
   "review_comments": []
 }