Bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.61.0 - #100
Bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.61.0#100dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) from 0.60.0 to 0.61.0. - [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases) - [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md) - [Commits](rojopolis/spellcheck-github-actions@0.60.0...0.61.0) --- updated-dependencies: - dependency-name: rojopolis/spellcheck-github-actions dependency-version: 0.61.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Kusari Analysis Results:Caution Flagged Issues Detected The dependency analysis found no pinned version dependency changes, presenting no additional risk. However, the code analysis identified 2 high-severity supply chain risks in the GitHub Actions workflow files (.github/workflows/es-spellcheck.yml and .github/workflows/spellcheck.yml). In both files, the action Note View full detailed analysis result for more information on the output and the checks that were run. Required Code MitigationsThe action
|
![kusari-inspector[bot]](https://avatars.githubusercontent.com/in/1220830?s=60&v=4){kind=small}
| diff content/es/.wordlist.txt <(LC_ALL= sort -f content/es/.wordlist.txt) | ||
| - name: GitHub Spellcheck Action | ||
| uses: rojopolis/spellcheck-github-actions@0.60.0 | ||
| uses: rojopolis/spellcheck-github-actions@0.61.0 |
There was a problem hiding this comment.
Issue: The action rojopolis/spellcheck-github-actions is pinned to a mutable version tag (@0.61.0) instead of an immutable commit SHA. Pin this action to a full commit SHA to prevent supply chain attacks. Look up the commit SHA for the desired release of rojopolis/spellcheck-github-actions and replace the tag reference with it.
Recommended Code Changes:
uses: rojopolis/spellcheck-github-actions@<full-commit-sha>
|
|
||
| - name: GitHub Spellcheck Action | ||
| uses: rojopolis/spellcheck-github-actions@0.60.0 | ||
| uses: rojopolis/spellcheck-github-actions@0.61.0 |
There was a problem hiding this comment.
Issue: The action rojopolis/spellcheck-github-actions is pinned to a mutable version tag (@0.61.0) instead of an immutable commit SHA. Pin this action to a full commit SHA to prevent supply chain attacks. Look up the commit SHA for the desired release of rojopolis/spellcheck-github-actions and replace the tag reference with it.
Recommended Code Changes:
uses: rojopolis/spellcheck-github-actions@<full-commit-sha>
|
Superseded by #102. |
Bumps rojopolis/spellcheck-github-actions from 0.60.0 to 0.61.0.
Release notes
Sourced from rojopolis/spellcheck-github-actions's releases.
Changelog
Sourced from rojopolis/spellcheck-github-actions's changelog.
... (truncated)
Commits
ca94733Merge pull request #353 from rojopolis/release_0.61.0fcd939dPotential fix for pull request findingd472ce6Potential fix for pull request finding484a1f2Preparing release for 0.61.0 and working on using claude for release preparation5af1527Merge pull request #351 from rojopolis/dependabot/github_actions/docker/setup...96a2036Merge pull request #352 from rojopolis/dependabot/github_actions/actions/chec...8f52249Bump actions/checkout from 6.0.2 to 6.0.35cff951Bump docker/setup-qemu-action from 4.0.0 to 4.1.081db2e8Merge pull request #350 from rojopolis/dependabot/github_actions/docker/login...bc10c5eMerge pull request #347 from rojopolis/dependabot/github_actions/docker/build...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)