chore(deps): Bump the actions group with 4 updates - #106
Conversation
Bumps the actions group with 4 updates: [github/codeql-action](https://github.com/github/codeql-action), [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog), [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail) and [Bogdanp/setup-racket](https://github.com/bogdanp/setup-racket). Updates `github/codeql-action` from 4.37.7 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.7...v4.37.9) Updates `trufflesecurity/trufflehog` from 3.97.0 to 3.97.1 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@v3.97.0...v3.97.1) Updates `dawidd6/action-send-mail` from 3.12.0 to 18 - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](dawidd6/action-send-mail@v3.12.0...v18) Updates `Bogdanp/setup-racket` from 1.9.1 to 1.15 - [Release notes](https://github.com/bogdanp/setup-racket/releases) - [Commits](Bogdanp/setup-racket@v1.9.1...v1.15) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.97.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dawidd6/action-send-mail dependency-version: '18' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: Bogdanp/setup-racket dependency-version: '1.15' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While this PR successfully updates four GitHub Actions and maintains overall project quality standards, there are significant risks regarding the action-send-mail upgrade. The jump from v3 to v18 is a major update that may break the current space-separated recipient list, as modern parsers typically require comma-separation per RFC 5322.
Additionally, all third-party actions in this PR are updated using mutable version tags. To align with security best practices and prevent potential supply-chain attacks, these should be pinned to specific git commit SHAs. Verification of the email delivery logic is required before merging to avoid notification failures.
About this PR
- The significant major version jump for
action-send-mail(v3 to v18) requires careful verification. Major updates in this action often involve migrations to newer Node.js runtimes or updated mail libraries that enforce stricter standards than previous iterations.
Test suggestions
- Verify CodeQL init and analyze steps are updated to v4.37.9
- Verify TruffleHog secret scanning step is updated to v3.97.1
- Verify email notification step is updated to the major version v18
- Verify Racket setup steps across multiple jobs are updated to v1.15
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| - uses: actions/checkout@v7.0.1 | ||
| - name: Secret scanning | ||
| uses: trufflesecurity/trufflehog@v3.97.0 | ||
| uses: trufflesecurity/trufflehog@v3.97.1 |
There was a problem hiding this comment.
🔴 HIGH RISK
Pinning third-party actions to a specific commit SHA rather than a tag (v3.97.1) prevents potential supply-chain attacks where a tag is maliciously repointed. This is especially important for actions that execute code in your CI environment.
Try running the following prompt in your IDE agent:
Find the full git commit SHA associated with the tag 'v3.97.1' for the 'trufflesecurity/trufflehog' repository. Replace the tag with this SHA in .github/workflows/comprehensive-quality.yml and add a comment indicating the original version.
|
|
||
| - name: Setup Racket | ||
| uses: Bogdanp/setup-racket@v1.9.1 | ||
| uses: Bogdanp/setup-racket@v1.15 |
There was a problem hiding this comment.
🔴 HIGH RISK
Pinning third-party actions to a specific commit SHA rather than a tag (v1.15) prevents potential supply-chain attacks where a tag is maliciously repointed. This is especially important for actions that execute code in your CI environment.
Try running the following prompt in your IDE agent:
Find the full git commit SHA associated with the tag 'v1.15' for the 'Bogdanp/setup-racket' repository. Replace the tag with this SHA in .github/workflows/test.yml and add a comment indicating the original version.
| steps: | ||
| - name: Send push notification email | ||
| uses: dawidd6/action-send-mail@v3.12.0 | ||
| uses: dawidd6/action-send-mail@v18 |
There was a problem hiding this comment.
🔴 HIGH RISK
The jump to v18 for action-send-mail introduces two concerns. First, the to field (line 28) uses a space-separated list of emails, which may fail if the new version strictly enforces RFC 5322 comma-separation. Second, for security, this action should be pinned to a specific commit SHA rather than the v18 tag to prevent potential supply-chain attacks where a tag is maliciously repointed.
1 participant
Bumps the actions group with 4 updates: github/codeql-action, trufflesecurity/trufflehog, dawidd6/action-send-mail and Bogdanp/setup-racket.
Updates
github/codeql-actionfrom 4.37.7 to 4.37.9Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
Commits
cdf488fMerge pull request #4107 from github/update-v4.37.9-920ba7cd17243f38Update changelog for v4.37.9920ba7cMerge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4ecfa6e1Add changelog noteadcdf4aUpdate default bundle to codeql-bundle-v2.26.4486fec2Merge pull request #4099 from github/update-supported-enterprise-server-versions134624cMerge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...ff43db8Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde4605e03Rebuild099c869Update changelog and version after v4.37.8Updates
trufflesecurity/trufflehogfrom 3.97.0 to 3.97.1Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
20652fbCarry GitHub App installation ID on repo units (#5215)3ab759fRefine SECURITY.md (#5216)2cdb97d[SCAN-101] s3 source accept persisted unit envelopes in UnmarshalSourceUnit (...4ec7749preallocate bindings capacity in dockerhub and groq, with unit tests (#5213)9610306Doubled timeout, as MongoDB secrets are repeatedly hitting this and failing t...9d3f5d1[SCAN-1020] neon scram pgx (#5217)925c1d0fix(detectors/docker): don't greedy match in keyPat (#5214)e12da3cdocs: add generic config-secret custom detector example (#5195)bcbcab2Fix GHEC with Data Residency (*.ghe.com) base URL (#4777)bc3a3aeUpdate module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] (#5196)Updates
dawidd6/action-send-mailfrom 3.12.0 to 18Release notes
Sourced from dawidd6/action-send-mail's releases.
... (truncated)
Commits
94de994fix: Use extended HELLO with github.com domain (#302)6e50282build(deps): bump actions/checkout from 6 to 7 (#300)1d138f3build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)1369c5bnode_modules: update (#297)d86d472build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)19dc783build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)0dd1be8build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)6bf8b9cbuild(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)51e2c0dbuild(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)076b075build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)Updates
Bogdanp/setup-racketfrom 1.9.1 to 1.15Release notes
Sourced from Bogdanp/setup-racket's releases.
Commits
2466913doc: s/1.14/1.15 and s/8.18/9.1 [skip ci]2d6a750build: update dependencies and run on node 248823878ci: drop macos-13510c17abuild(deps): bump js-yaml from 3.14.1 to 3.14.2 (#84)0e4942fdoc: s/8.17/8.18dff14a0build(deps): bump form-data from 3.0.1 to 3.0.4 (#83)fda0f4ddoc: update version [skip ci]e321cc4ci: drop deprecated windows-2019 environmentb45ffadcore: drop "test" Distribution2c52f9bci: drop BC variant and "test" distribution from Northwestern testsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions