Repository navigation
chore(ci): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.3 - #2
Conversation
dependabot
Bot
added
dependencies
|
@dependabot recreate |
dependabot
Bot
changed the title
d41f2aa to
e53604a
Compare
|
Heads up on why this is sitting unmerged: the bumps in these workflow PRs are fine, I have no issue with the change itself. What blocks merging is the govulncheck job. It is pinned to Go 1.26.8 in ci.yml, and govulncheck currently flags 11 standard library vulnerabilities in html/template (reachable through internal/report) that are only fixed in Go 1.26.9. Main last ran that job on 7 Oct before those advisories were in the database, so main looks green while every fresh branch run goes red. Until the govulncheck Go pin moves to 1.26.9, none of the five open dependabot PRs here can pass the required checks. Happy to merge this as soon as that pin is fixed. |
|
@dependabot recreate |
Bumps [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) from 0.24.0 to 0.24.3. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@e22c389...66cbf4b) --- updated-dependencies: - dependency-name: anchore/sbom-action/download-syft dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
e53604a to
8b0fc2f
Compare
|
The Go pin fix is merged, govulncheck passes on this branch now and every required check is green. Merging this one. |
Bumps anchore/sbom-action/download-syft from 0.24.0 to 0.24.3.
Release notes
Sourced from anchore/sbom-action/download-syft's releases.
Commits
66cbf4bchore(deps): update Syft to latest release (#735)6b31fa7chore(deps-dev): bump type-fest from 5.9.0 to 5.10.0 (#742)85bda36chore(deps-dev): bump@types/nodefrom 26.5.1 to 26.6.1 (#741)7b97c1echore(deps): bump github.com/anchore/go-make in /.make (#738)891b055chore(deps): bump anchore/go-make/.github/actions/setup (#740)f73cf48chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#739)13576dbchore(deps-dev): bump@types/nodefrom 26.4.1 to 26.5.1 (#737)924e83bchore(deps-dev): bump typescript-eslint from 8.69.0 to 8.70.0 (#736)274555fchore(deps-dev): bump type-fest from 5.8.0 to 5.9.0 (#732)48fb538chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#734)