412.md (9261B)
1 # PR #412 Bump ossf/scorecard-action from 1.0.4 to 2.1.3 2 3 - **Status:** closed 4 - **Author:** @dependabot[bot] 5 - **Created:** 2023-04-03T09:03:04Z 6 - **Branch:** dependabot/github_actions/ossf/scorecard-action-2.1.3 → main 7 - **Closed:** 2023-06-26T09:00:42Z 8 - **Labels:** dependencies, github_actions 9 - **Assignees:** @MTRNord 10 - **Reviewers:** @MTRNord 11 - **Diff:** [412.diff](./412.diff) 12 13 --- 14 15 Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 1.0.4 to 2.1.3. 16 <details> 17 <summary>Release notes</summary> 18 <p><em>Sourced from <a href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's releases</a>.</em></p> 19 <blockquote> 20 <h2>v2.1.3</h2> 21 <h2>What's Changed</h2> 22 <ul> 23 <li>🌱 Bump github.com/ossf/scorecard/v4 from 4.10.2 to 4.10.5 by <a href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1111">ossf/scorecard-action#1111</a></li> 24 </ul> 25 <h3>Bug Fixes</h3> 26 <ul> 27 <li>Invalid SARIF files from a bug in scorecard 28 <ul> 29 <li><a href="https://redirect.github.com/ossf/scorecard-action/issues/1076">#1076</a>, <a href="https://redirect.github.com/ossf/scorecard-action/issues/1094">#1094</a></li> 30 </ul> 31 </li> 32 <li>Vulnerabilities check crashes if a vulnerable dependency is found via OSVScanner 33 <ul> 34 <li><a href="https://redirect.github.com/ossf/scorecard-action/issues/1092">#1092</a></li> 35 </ul> 36 </li> 37 <li>Scorecard action not reporting binary artifacts in the repo 38 <ul> 39 <li><a href="https://redirect.github.com/ossf/scorecard-action/issues/1116">#1116</a></li> 40 </ul> 41 </li> 42 </ul> 43 <p><strong>Full Scorecard Changelog</strong>: <a href="https://github.com/ossf/scorecard/compare/v4.10.2...v4.10.5">https://github.com/ossf/scorecard/compare/v4.10.2...v4.10.5</a></p> 44 <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.1.2...v2.1.3">https://github.com/ossf/scorecard-action/compare/v2.1.2...v2.1.3</a></p> 45 <h2>v2.1.2</h2> 46 <h2>What's Changed</h2> 47 <h3>Fixes</h3> 48 <ul> 49 <li>🌱 Bump scorecard dependency to v4.10.2 to remove a CODEOWNERS printf statement. by <a href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1054">ossf/scorecard-action#1054</a></li> 50 </ul> 51 <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.1.1...v2.1.2">https://github.com/ossf/scorecard-action/compare/v2.1.1...v2.1.2</a></p> 52 <h2>v2.1.1</h2> 53 <h2>Scorecard version</h2> 54 <p>This release use <a href="https://github.com/ossf/scorecard/releases/tag/v4.10.1">Scorecard's v4.10.1</a></p> 55 <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.1.0...v2.1.1">https://github.com/ossf/scorecard-action/compare/v2.1.0...v2.1.1</a></p> 56 <h2>v2.1.0</h2> 57 <h2>What's Changed</h2> 58 <h3>Scorecard version</h3> 59 <p>This release uses <a href="https://github.com/ossf/scorecard/releases/tag/v4.10.0">scorecard v4.10.0</a>.</p> 60 <h3>Improvements</h3> 61 <ul> 62 <li>Docker build workflow by <a href="https://github.com/naveensrinivasan"><code>@​naveensrinivasan</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/981">ossf/scorecard-action#981</a></li> 63 <li>Use root user in distroless to support GitHub Actions by <a href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/994">ossf/scorecard-action#994</a></li> 64 <li>Disable pull_request_target by <a href="https://github.com/laurentsimon"><code>@​laurentsimon</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1031">ossf/scorecard-action#1031</a></li> 65 </ul> 66 <h3>Documentation</h3> 67 <ul> 68 <li>Add PAT section explaining risks by <a href="https://github.com/olivekl"><code>@​olivekl</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1024">ossf/scorecard-action#1024</a></li> 69 <li>Make the badge text easier to copy by <a href="https://github.com/rajbos"><code>@​rajbos</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1026">ossf/scorecard-action#1026</a></li> 70 </ul> 71 <!-- raw HTML omitted --> 72 </blockquote> 73 <p>... (truncated)</p> 74 </details> 75 <details> 76 <summary>Commits</summary> 77 <ul> 78 <li><a href="https://github.com/ossf/scorecard-action/commit/80e868c13c90f172d68d1f4501dee99e2479f7af"><code>80e868c</code></a> :seedling: Bump docker tag for release. (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1117">#1117</a>)</li> 79 <li><a href="https://github.com/ossf/scorecard-action/commit/aed6134b530f65762d8da8171e42d5ff9108d1a1"><code>aed6134</code></a> :seedling: Bump golang.org/x/net from 0.7.0 to 0.8.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1099">#1099</a>)</li> 80 <li><a href="https://github.com/ossf/scorecard-action/commit/33dfbd30942d716772ffc2fa55d8ea035df8fa73"><code>33dfbd3</code></a> 🌱 Bump github.com/ossf/scorecard/v4 from 4.10.2 to 4.10.5 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1111">#1111</a>)</li> 81 <li><a href="https://github.com/ossf/scorecard-action/commit/193ae3767915e21afcbf44eff2fe6b41edb4d245"><code>193ae37</code></a> :seedling: Bump actions/dependency-review-action from 3.0.3 to 3.0.4 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1110">#1110</a>)</li> 82 <li><a href="https://github.com/ossf/scorecard-action/commit/ca9bf9578ec9f68bd1cd99bfbde41ba4f0516a50"><code>ca9bf95</code></a> :seedling: Bump actions/cache from 3.2.6 to 3.3.1 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1103">#1103</a>)</li> 83 <li><a href="https://github.com/ossf/scorecard-action/commit/fa1521272c15724b2dce74f8b1ce9bd6df33b7ae"><code>fa15212</code></a> :seedling: Bump github/codeql-action from 2.2.4 to 2.2.7 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1105">#1105</a>)</li> 84 <li><a href="https://github.com/ossf/scorecard-action/commit/136025e1eacdf84d71a9c3227f53d7c737852cd8"><code>136025e</code></a> :seedling: Bump step-security/harden-runner from 2.1.0 to 2.2.1 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1104">#1104</a>)</li> 85 <li><a href="https://github.com/ossf/scorecard-action/commit/c59c116cbead5af2de7d75f4d82cf5a2ef5b0304"><code>c59c116</code></a> :seedling: Bump actions/cache from 3.2.5 to 3.2.6 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1097">#1097</a>)</li> 86 <li><a href="https://github.com/ossf/scorecard-action/commit/7cc371152c77bfecfa34fdfb62b1630ff3682cf1"><code>7cc3711</code></a> :seedling: Bump github.com/emicklei/go-restful (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1086">#1086</a>)</li> 87 <li><a href="https://github.com/ossf/scorecard-action/commit/570a953ea0770f30a8aa0a778cfc4bc955bbf9c4"><code>570a953</code></a> :seedling: Bump actions/cache from 3.2.4 to 3.2.5 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1088">#1088</a>)</li> 88 <li>Additional commits viewable in <a href="https://github.com/ossf/scorecard-action/compare/c1aec4ac820532bab364f02a81873c555a0ba3a1...80e868c13c90f172d68d1f4501dee99e2479f7af">compare view</a></li> 89 </ul> 90 </details> 91 <br /> 92 93 94 [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) 95 96 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. 97 98 [//]: # (dependabot-automerge-start) 99 [//]: # (dependabot-automerge-end) 100 101 --- 102 103 <details> 104 <summary>Dependabot commands and options</summary> 105 <br /> 106 107 You can trigger Dependabot actions by commenting on this PR: 108 - `@dependabot rebase` will rebase this PR 109 - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it 110 - `@dependabot merge` will merge this PR after your CI passes on it 111 - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it 112 - `@dependabot cancel merge` will cancel a previously requested merge and block automerging 113 - `@dependabot reopen` will reopen this PR if it is closed 114 - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually 115 - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) 116 - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) 117 - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) 118 119 120 </details> 121 122 <!-- Replace --> 123 ---- 124 ⌛ Deploy Preview - Build in Progress 125 <!-- Replace --> 126 127 128 129 ## Comments 130 131 ### @dependabot[bot] — 2023-06-26T09:00:41Z 132 133 Superseded by #492. 134