From fe93d284f89b311225e5a4dd5ef180001c492878 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Jul 2025 18:17:12 +0000 Subject: [PATCH] Chore(deps): Bump the action-dependencies group across 1 directory with 4 updates Bumps the action-dependencies group with 4 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node), [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action), [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [actions/upload-artifact](https://github.com/actions/upload-artifact). Updates `actions/setup-node` from 4.1.0 to 4.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4.1.0...v4.4.0) Updates `aquasecurity/trivy-action` from 0.29.0 to 0.30.0 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/0.29.0...0.30.0) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.2 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/v2.4.1...v2.4.2) Updates `actions/upload-artifact` from 4.4.3 to 4.6.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4.4.3...v4.6.2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: action-dependencies - dependency-name: aquasecurity/trivy-action dependency-version: 0.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: action-dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: action-dependencies - dependency-name: actions/upload-artifact dependency-version: 4.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: action-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/main.yml | 10 +++++----- .github/workflows/scorecard.yml | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index eda8363d..b4f4dd64 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -27,7 +27,7 @@ jobs: uses: actions/checkout@v4.2.2 - name: Use Node.js 24.1.0 - uses: actions/setup-node@v4.1.0 + uses: actions/setup-node@v4.4.0 with: node-version: 24.1.0 @@ -46,7 +46,7 @@ jobs: uses: actions/checkout@v4.2.2 - name: Use Node.js 24.1.0 - uses: actions/setup-node@v4.1.0 + uses: actions/setup-node@v4.4.0 with: node-version: 24.1.0 @@ -85,7 +85,7 @@ jobs: uses: actions/checkout@v4.2.2 - name: Use Node.js 24.1.0 - uses: actions/setup-node@v4.1.0 + uses: actions/setup-node@v4.4.0 with: node-version: 24.1.0 @@ -104,7 +104,7 @@ jobs: uses: actions/checkout@v4.2.2 - name: Use Node.js 24.1.0 - uses: actions/setup-node@v4.1.0 + uses: actions/setup-node@v4.4.0 with: node-version: 24.1.0 @@ -136,7 +136,7 @@ jobs: run: docker build . --file Dockerfile --target production --tag angular-ngrx-frontend:${{ steps.vars.outputs.DOCKER_TAG }} - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.29.0 + uses: aquasecurity/trivy-action@0.32.0 with: image-ref: 'angular-ngrx-frontend:${{ steps.vars.outputs.DOCKER_TAG }}' format: 'table' diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index be140770..8e8e30ff 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -39,7 +39,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@v2.4.1 + uses: ossf/scorecard-action@v2.4.2 with: results_file: results.sarif results_format: sarif @@ -61,7 +61,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@v4.4.3 + uses: actions/upload-artifact@v4.6.2 with: name: SARIF file path: results.sarif