Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump the devops group across 1 directory with 8 updates #9335

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 19, 2025

Bumps the devops group with 8 updates in the / directory:

Package From To
docker/login-action 3.3.0 3.4.0
codecov/codecov-action 5.3.1 5.4.0
tj-actions/changed-files 45.0.7 46.0.1
Swatinem/rust-cache 2.7.7 2.7.8
docker/metadata-action 5.6.1 5.7.0
docker/setup-buildx-action 3.9.0 3.10.0
docker/build-push-action 6.14.0 6.15.0
docker/scout-action 1.16.3 1.17.0

Updates docker/login-action from 3.3.0 to 3.4.0

Release notes

Sourced from docker/login-action's releases.

v3.4.0

Full Changelog: docker/login-action@v3.3.0...v3.4.0

Commits
  • 74a5d14 Merge pull request #856 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • 2f4f00e chore: update generated content
  • 67c1845 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
  • 3d4cc89 Merge pull request #844 from graysonpike/master
  • 6cc823a Merge pull request #823 from docker/dependabot/npm_and_yarn/proxy-agent-depen...
  • d94e792 chore: update generated content
  • 033db0d Merge pull request #812 from docker/dependabot/github_actions/codecov/codecov...
  • 09c2ae9 build(deps): bump https-proxy-agent
  • ba56f00 ci: update deprecated input for codecov-action
  • 75bf9a7 Merge pull request #858 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 5.3.1 to 5.4.0

Release notes

Sourced from codecov/codecov-action's releases.

v5.4.0

What's Changed

New Contributors

Full Changelog: codecov/codecov-action@v5.3.1...v5.4.0

Changelog

Sourced from codecov/codecov-action's changelog.

v5.4.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0

Commits
  • 0565863 chore(release): 5.4.0 (#1781)
  • c545d7b update wrapper submodule to 0.2.0, add recurse_submodules arg (#1780)
  • 2488e99 build(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 (#1775)
  • a46c158 build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 (#1776)
  • 062ee7e build(deps): bump github/codeql-action from 3.28.9 to 3.28.10 (#1777)
  • 1fecca8 Clarify in README that use_pypi bypasses integrity checks too (#1773)
  • 2e6e9c5 Fix use of safe.directory inside containers (#1768)
  • a5dc5a5 Fix description for report_type input (#1770)
  • 4898080 build(deps): bump github/codeql-action from 3.28.8 to 3.28.9 (#1765)
  • 5efa07b Fix a typo in the example (#1758)
  • Additional commits viewable in compare view

Updates tj-actions/changed-files from 45.0.7 to 46.0.1

Release notes

Sourced from tj-actions/changed-files's releases.

v46.0.1

[!WARNING]
Security Alert: A critical security issue was identified in this action due to a compromised commit.

This commit has been removed from all tags and branches, and necessary measures have been implemented to prevent similar issues in the future.

Action Required:

  • Review your workflows executed between March 14 and March 15. If you notice unexpected output under the changed-files section, decode it using the following command: echo 'xxx' | base64 -d | base64 -d
    If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.
  • If your workflows reference this commit directly by its SHA, you must update them immediately to avoid using the compromised version.
  • If you are using tagged versions (e.g., v35, v44.5.1), no action is required as these tags have been updated and are now safe to use.

Additionally, as a precaution, we recommend rotating any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.

What's Changed

Full Changelog: tj-actions/changed-files@v46...v46.0.1

v46

[!WARNING]
Security Alert: A critical security issue was identified in this action due to a compromised commit.

This commit has been removed from all tags and branches, and necessary measures have been implemented to prevent similar issues in the future.

Action Required:

  • Review your workflows executed between March 14 and March 15. If you notice unexpected output under the changed-files section, decode it using the following command: echo 'xxx' | base64 -d | base64 -d
    If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.
  • If your workflows reference this commit directly by its SHA, you must update them immediately to avoid using the compromised version.
  • If you are using tagged versions (e.g., v35, v44.5.1), no action is required as these tags have been updated and are now safe to use.

Additionally, as a precaution, we recommend rotating any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.

Changes in v46.0.1

What's Changed

Full Changelog: tj-actions/changed-files@v46...v46.0.1


Changes in v46.0.0

What's Changed

... (truncated)

Changelog

Sourced from tj-actions/changed-files's changelog.

46.0.1 - (2025-03-16)

🔄 Update

  • Updated README.md (#2473)

Co-authored-by: github-actions[bot] (2f7c5bf) - (github-actions[bot])

  • Sync-release-version.yml to use signed commits (#2472) (4189ec6) - (Tonye Jack)

46.0.0 - (2025-03-16)

🐛 Bug Fixes

  • Update update-readme.yml to sign-commits (#2468) (0f1ffe6) - (Tonye Jack)
  • Update permission in update-readme.yml workflow (#2467) (ddef03e) - (Tonye Jack)
  • Update github workflow update-readme.yml (#2466) (9c2df0d) - (Tonye Jack)

➖ Remove

  • Deleted renovate.json (e37e952) - (Tonye Jack)

🔄 Update

  • Sync-release-version.yml (#2471) (4cd184a) - (Tonye Jack)
  • Updated README.md (#2469)

Co-authored-by: github-actions[bot] (5cbf220) - (github-actions[bot])

📚 Documentation

  • Update docs to highlight security issues (#2465) (6525332) - (Tonye Jack)

45.0.9 - (2025-03-15)

🐛 Bug Fixes

  • deps: Update dependency @​octokit/rest to v21.1.1 (#2435) (fb8dcda) - (renovate[bot])
  • deps: Update dependency @​octokit/rest to v21.1.0 (#2394) (7b72c97) - (renovate[bot])
  • deps: Update dependency yaml to v2.7.0 (#2383) (5f974c2) - (renovate[bot])

⚙️ Miscellaneous Tasks

  • deps: Lock file maintenance (#2460) (9200e69) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.13.10 (#2459) (e650cfd) - (renovate[bot])
  • deps: Update dependency eslint-config-prettier to v10.1.1 (#2458) (82af21f) - (renovate[bot])
  • deps: Update dependency eslint-config-prettier to v10.1.0 (#2457) (82fa4a6) - (renovate[bot])
  • deps: Update peter-evans/create-pull-request action to v7.0.8 (#2455) (315505a) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.13.9 (#2454) (c8e1cdb) - (renovate[bot])
  • deps: Update dependency prettier to v3.5.3 (#2453) (bb6d1aa) - (renovate[bot])
  • deps: Lock file maintenance (#2451) (1f74fc9) - (renovate[bot])

... (truncated)

Commits

Updates Swatinem/rust-cache from 2.7.7 to 2.7.8

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.7.8

What's Changed

Full Changelog: Swatinem/rust-cache@v2.7.7...v2.7.8

Changelog

Sourced from Swatinem/rust-cache's changelog.

2.7.8

  • Include CPU arch in the cache key
Commits

Updates docker/metadata-action from 5.6.1 to 5.7.0

Release notes

Sourced from docker/metadata-action's releases.

v5.7.0

Full Changelog: docker/metadata-action@v5.6.1...v5.7.0

Commits
  • 902fa8e Merge pull request #504 from docker/dependabot/npm_and_yarn/semver-7.7.1
  • c30b9c2 chore: update generated content
  • 0698804 chore(deps): Bump semver from 7.6.3 to 7.7.1
  • bb3eeca Merge pull request #501 from docker/dependabot/npm_and_yarn/moment-timezone-0...
  • 94a839c chore: update generated content
  • ecd51a0 Merge pull request #509 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • a85b1db chore(deps): Bump @​docker/actions-toolkit from 0.55.0 to 0.56.0
  • 5a76a0e chore(deps): Bump moment-timezone from 0.5.46 to 0.5.47
  • 1cc4a98 Merge pull request #482 from docker/dependabot/npm_and_yarn/csv-parse-5.6.0
  • d84de1e chore: update generated content
  • Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.9.0 to 3.10.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.10.0

Full Changelog: docker/setup-buildx-action@v3.9.0...v3.10.0

Commits
  • b5ca514 Merge pull request #408 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 1418a4e chore: update generated content
  • 93acf83 build(deps): bump @​docker/actions-toolkit from 0.54.0 to 0.56.0
  • See full diff in compare view

Updates docker/build-push-action from 6.14.0 to 6.15.0

Release notes

Sourced from docker/build-push-action's releases.

v6.15.0

Full Changelog: docker/build-push-action@v6.14.0...v6.15.0

Commits
  • 471d1dc Merge pull request #1330 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • b89ff0a chore: update generated content
  • 1e3ae3a chore(deps): Bump @​docker/actions-toolkit from 0.55.0 to 0.56.0
  • b16f42f Merge pull request #1325 from crazy-max/buildx-edge
  • dc0fea5 ci: update buildx to edge and buildkit to latest
  • See full diff in compare view

Updates docker/scout-action from 1.16.3 to 1.17.0

Commits
  • d341d36 Merge b8e0e28db53a29161c11fabcd6d8ad434b53878e into 0133ff88fe16d4a412dc4827a...
  • b8e0e28 [BOT] Publish v1.17.0 release
  • See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
codecov/codecov-action [>= 3.0.a, < 3.1]
tj-actions/changed-files [>= 31.0.a, < 31.1]
tj-actions/changed-files [>= 30.0.a, < 30.1]
tj-actions/changed-files [< 44.6, > 44.5.2]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the devops group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [docker/login-action](https://github.com/docker/login-action) | `3.3.0` | `3.4.0` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.3.1` | `5.4.0` |
| [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `45.0.7` | `46.0.1` |
| [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.7.7` | `2.7.8` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.6.1` | `5.7.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.9.0` | `3.10.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.14.0` | `6.15.0` |
| [docker/scout-action](https://github.com/docker/scout-action) | `1.16.3` | `1.17.0` |



Updates `docker/login-action` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3.3.0...v3.4.0)

Updates `codecov/codecov-action` from 5.3.1 to 5.4.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5.3.1...v5.4.0)

Updates `tj-actions/changed-files` from 45.0.7 to 46.0.1
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](tj-actions/changed-files@v45.0.7...v46.0.1)

Updates `Swatinem/rust-cache` from 2.7.7 to 2.7.8
- [Release notes](https://github.com/swatinem/rust-cache/releases)
- [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md)
- [Commits](Swatinem/rust-cache@v2.7.7...v2.7.8)

Updates `docker/metadata-action` from 5.6.1 to 5.7.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@v5.6.1...v5.7.0)

Updates `docker/setup-buildx-action` from 3.9.0 to 3.10.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v3.9.0...v3.10.0)

Updates `docker/build-push-action` from 6.14.0 to 6.15.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v6.14.0...v6.15.0)

Updates `docker/scout-action` from 1.16.3 to 1.17.0
- [Release notes](https://github.com/docker/scout-action/releases)
- [Commits](docker/scout-action@v1.16.3...v1.17.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: devops
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: devops
- dependency-name: tj-actions/changed-files
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: devops
- dependency-name: Swatinem/rust-cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: devops
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: devops
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: devops
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: devops
- dependency-name: docker/scout-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: devops
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from a team as a code owner March 19, 2025 15:09
@dependabot dependabot bot added A-dependencies Area: Dependency file updates A-devops Area: Pipelines, CI/CD and Dockerfiles C-exclude-from-changelog Category: The PR should be excluded from the changelog and release notes P-Low ❄️ labels Mar 19, 2025
@dependabot dependabot bot requested review from gustavovalverde and removed request for a team March 19, 2025 15:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-dependencies Area: Dependency file updates A-devops Area: Pipelines, CI/CD and Dockerfiles C-exclude-from-changelog Category: The PR should be excluded from the changelog and release notes P-Low ❄️
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants