chore(deps): bump dawidd6/action-send-mail from 3.12.0 to 18 in the actions group across 1 directory - #496
Conversation
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While the update to version 18 aligns with the functional requirements and satisfies basic quality standards, the current use of a mutable version tag for a third-party action introduces a security risk. To protect against potential supply chain attacks and ensure the immutability of the CI/CD pipeline, the action should be pinned to a specific commit SHA.
Test suggestions
- Confirm the workflow file references version v18 of the action
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| steps: | ||
| - name: Send push notification email | ||
| uses: dawidd6/action-send-mail@v3.12.0 | ||
| uses: dawidd6/action-send-mail@v18 |
There was a problem hiding this comment.
🔴 HIGH RISK
Using a version tag for a third-party action is a security risk. Pinning the action to a specific commit SHA provides an immutable link to the version of the code you intend to run.
Try running the following prompt in your IDE agent:
Find the full commit SHA for dawidd6/action-send-mail version v18 and update the 'uses' field in .github/workflows/push-email-notify.yml to use that SHA, adding '# v18' as a comment on the same line.
Bumps the actions group with 1 update in the / directory: [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail). Updates `dawidd6/action-send-mail` from 3.12.0 to 18 - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](dawidd6/action-send-mail@v3.12.0...v18) --- updated-dependencies: - dependency-name: dawidd6/action-send-mail dependency-version: '18' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
c75acaf to
d0c00be
Compare
1 participant
Bumps the actions group with 1 update in the / directory: dawidd6/action-send-mail.
Updates
dawidd6/action-send-mailfrom 3.12.0 to 18Release notes
Sourced from dawidd6/action-send-mail's releases.
... (truncated)
Commits
94de994fix: Use extended HELLO with github.com domain (#302)6e50282build(deps): bump actions/checkout from 6 to 7 (#300)1d138f3build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)1369c5bnode_modules: update (#297)d86d472build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)19dc783build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)0dd1be8build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)6bf8b9cbuild(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)51e2c0dbuild(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)076b075build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)