From a97bda3bcd2d0b9f8ca901ed1e81a9c006470f7d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 21:20:09 +0000 Subject: [PATCH] chore(deps): bump the github-actions group across 1 directory with 3 updates Bumps the github-actions group with 3 updates in the / directory: [actions/setup-java](https://github.com/actions/setup-java), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `actions/setup-java` from 5 to 6 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/v5...v6) Updates `anchore/sbom-action` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/codeql.yml | 2 +- .github/workflows/release.yml | 16 ++++++++-------- .github/workflows/scorecard.yml | 2 +- .github/workflows/weekly-health-check.yml | 2 +- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 68b0eb8..d79888a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -158,7 +158,7 @@ jobs: with: node-version: "22" - uses: astral-sh/setup-uv@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "21" @@ -356,7 +356,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "17" @@ -377,7 +377,7 @@ jobs: timeout-minutes: 45 steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "17" @@ -518,7 +518,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "17" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ac4ac3e..e1485e7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: - uses: actions/checkout@v7 - name: Setup Java (Android) if: matrix.language == 'java-kotlin' - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: "17" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 541d42e..0451504 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -96,7 +96,7 @@ jobs: run: bash scripts/pre-release-gate.sh - name: Generate root SBOM - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6 with: path: . format: cyclonedx-json @@ -104,7 +104,7 @@ jobs: - name: Generate web stack SBOM slice if: hashFiles('examples/web/package.json') != '' - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6 with: path: examples/web format: cyclonedx-json @@ -112,7 +112,7 @@ jobs: - name: Generate python stack SBOM slice if: hashFiles('examples/python/pyproject.toml') != '' - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6 with: path: examples/python format: cyclonedx-json @@ -120,7 +120,7 @@ jobs: - name: Generate node stack SBOM slice if: hashFiles('examples/node/package.json') != '' - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6 with: path: examples/node format: cyclonedx-json @@ -128,7 +128,7 @@ jobs: - name: Generate android stack SBOM slice if: hashFiles('examples/android/app/build.gradle.kts') != '' - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6 with: path: examples/android format: cyclonedx-json @@ -136,7 +136,7 @@ jobs: - name: Generate rust stack SBOM slice if: hashFiles('examples/rust/Cargo.lock') != '' - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6 with: path: examples/rust format: cyclonedx-json @@ -144,7 +144,7 @@ jobs: - name: Generate go stack SBOM slice if: hashFiles('examples/go/go.sum') != '' - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6 with: path: examples/go format: cyclonedx-json @@ -200,7 +200,7 @@ jobs: with: ref: ${{ inputs.tag || github.event.release.tag_name || github.ref }} - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 if: steps.sign.outputs.present == 'true' with: distribution: temurin diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 90448b2..215c27b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@v7 with: persist-credentials: false - - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif diff --git a/.github/workflows/weekly-health-check.yml b/.github/workflows/weekly-health-check.yml index d1c689b..6abf2c9 100644 --- a/.github/workflows/weekly-health-check.yml +++ b/.github/workflows/weekly-health-check.yml @@ -238,7 +238,7 @@ jobs: timeout-minutes: 45 steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "17"