From 78447a5f6f1dc6796d70773f274a9464feed7225 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 19:38:59 +0000 Subject: [PATCH] Bump the sast group across 1 directory with 3 updates Bumps the sast group with 3 updates in the / directory: [step-security/harden-runner](https://github.com/step-security/harden-runner), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `step-security/harden-runner` from 2.22.0 to 2.22.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/351661ca32ac09a36dc5ee2d536e3128f2a3c8ed...ccd8616d44fd3846e67624a50d5aad6d37bf2d25) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: sast - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: sast - dependency-name: step-security/harden-runner dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: sast ... Signed-off-by: dependabot[bot] --- .github/workflows/azure-catalog.yml | 2 +- .github/workflows/changeset-release.yml | 2 +- .github/workflows/copilot-setup-steps.yml | 2 +- .github/workflows/defender-for-devops.yml | 2 +- .github/workflows/dependabot-addons.yml | 4 ++-- .github/workflows/dependabot-changeset.yml | 2 +- .github/workflows/devskim.yml | 4 ++-- .github/workflows/eslint.yml | 4 ++-- .github/workflows/nuke-cache.yml | 2 +- .github/workflows/prettier.yml | 2 +- .github/workflows/scorecard.yml | 6 +++--- .github/workflows/test.yml | 4 ++-- .github/workflows/workers-ai-catalog.yml | 2 +- 13 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/azure-catalog.yml b/.github/workflows/azure-catalog.yml index 9b5beb3f0..f7c7e1244 100644 --- a/.github/workflows/azure-catalog.yml +++ b/.github/workflows/azure-catalog.yml @@ -24,7 +24,7 @@ jobs: permissions: contents: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: disable-sudo-and-containers: true egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/changeset-release.yml b/.github/workflows/changeset-release.yml index cb7700979..c69e7dce5 100644 --- a/.github/workflows/changeset-release.yml +++ b/.github/workflows/changeset-release.yml @@ -25,7 +25,7 @@ jobs: pull-requests: write id-token: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo-and-containers: true diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index a197213de..d2c9d5cfa 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -14,7 +14,7 @@ jobs: copilot-setup-steps: runs-on: ubuntu-24.04-arm steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/defender-for-devops.yml b/.github/workflows/defender-for-devops.yml index 9cbc9acbf..fd9255037 100644 --- a/.github/workflows/defender-for-devops.yml +++ b/.github/workflows/defender-for-devops.yml @@ -50,7 +50,7 @@ jobs: env: GDN_RUN_AUTO: true eslint_targets: '**/src/**' - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: ${{ steps.msdo.outputs.sarifFile }} wait-for-processing: false diff --git a/.github/workflows/dependabot-addons.yml b/.github/workflows/dependabot-addons.yml index c481c55db..80c908ef8 100644 --- a/.github/workflows/dependabot-addons.yml +++ b/.github/workflows/dependabot-addons.yml @@ -14,7 +14,7 @@ jobs: issues: write repository-projects: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit disable-sudo-and-containers: true @@ -31,7 +31,7 @@ jobs: permissions: pull-requests: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: disable-sudo-and-containers: true egress-policy: audit diff --git a/.github/workflows/dependabot-changeset.yml b/.github/workflows/dependabot-changeset.yml index f0921904e..e47f42ec2 100644 --- a/.github/workflows/dependabot-changeset.yml +++ b/.github/workflows/dependabot-changeset.yml @@ -21,7 +21,7 @@ jobs: contents: write pull-requests: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo-and-containers: true diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml index 6a080333d..97285b8a6 100644 --- a/.github/workflows/devskim.yml +++ b/.github/workflows/devskim.yml @@ -27,7 +27,7 @@ jobs: contents: read security-events: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: disable-sudo-and-containers: true egress-policy: audit @@ -38,7 +38,7 @@ jobs: check-latest: true cache: 'npm' - uses: microsoft/DevSkim-Action@4b5047945a44163b94642a1cecc0d93a3f428cc6 # v1.0.16 - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: devskim-results.sarif wait-for-processing: false diff --git a/.github/workflows/eslint.yml b/.github/workflows/eslint.yml index 5e01acef5..0cb871853 100644 --- a/.github/workflows/eslint.yml +++ b/.github/workflows/eslint.yml @@ -32,7 +32,7 @@ jobs: security-events: write actions: read steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo-and-containers: true @@ -72,7 +72,7 @@ jobs: - run: npm install -D @microsoft/eslint-formatter-sarif - run: npm run lint -- --format @microsoft/eslint-formatter-sarif --output-file eslint-results.sarif continue-on-error: true - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 id: g_cql_upload with: sarif_file: eslint-results.sarif diff --git a/.github/workflows/nuke-cache.yml b/.github/workflows/nuke-cache.yml index 8561675b7..315dd16e4 100644 --- a/.github/workflows/nuke-cache.yml +++ b/.github/workflows/nuke-cache.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-24.04-arm permissions: write-all steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit disable-sudo-and-containers: true diff --git a/.github/workflows/prettier.yml b/.github/workflows/prettier.yml index 73404a409..0e15aadb1 100644 --- a/.github/workflows/prettier.yml +++ b/.github/workflows/prettier.yml @@ -47,7 +47,7 @@ jobs: permissions: contents: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo-and-containers: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ac3a7afd1..d6edaab81 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -31,13 +31,13 @@ jobs: # Needed to publish results and get a badge (see publish_results below). id-token: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif @@ -47,7 +47,7 @@ jobs: # - See https://github.com/ossf/scorecard-action#publishing-results. publish_results: true # Upload the results to GitHub's code scanning dashboard. - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif wait-for-processing: false diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7c6b05aca..cf9a7da4d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -36,7 +36,7 @@ jobs: build: runs-on: ubuntu-24.04-arm steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit disable-sudo-and-containers: true @@ -85,7 +85,7 @@ jobs: os: [ubuntu-24.04-arm, windows-11-arm, macos-latest] version: ['lts/*', latest] steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 if: matrix.os == 'ubuntu-24.04-arm' with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/workers-ai-catalog.yml b/.github/workflows/workers-ai-catalog.yml index 53639182f..fe0c2dd0f 100644 --- a/.github/workflows/workers-ai-catalog.yml +++ b/.github/workflows/workers-ai-catalog.yml @@ -23,7 +23,7 @@ jobs: permissions: contents: write steps: - - uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0 + - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: disable-sudo-and-containers: true egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs