Skip to content

build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 - #20

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/ossf/scorecard-action-2.5.0
Closed

build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0#20
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/ossf/scorecard-action-2.5.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps ossf/scorecard-action from 2.4.4 to 2.5.0.

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits
  • fa7117d Bump action tag for v2.5.0 release (#1720)
  • cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
  • bedb16e ✨ Add intoto results format (#1702)
  • de70347 Remove the leftover debug print of the auth token (#1709)
  • 950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
  • 2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
  • aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
  • b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
  • 4e9f2a2 📖 RELEASE.md: Document drafting release notes
  • f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0
459aa5b 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@2d11466...fa7117d)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from arr-wf as a code owner October 19, 2026 15:07
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 19, 2026
@socket-security

socket-security Bot commented Oct 19, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgithub/​ossf/​scorecard-action@​2d1146689b8cda280b9bc96326124645441f03bc ⏵ fa7117db83c52d787ae5a89f350999701505d78e93 +1100100100100

View full report

@arr-wf arr-wf mentioned this pull request Oct 27, 2026
Merged
arr-wf pushed a commit that referenced this pull request Oct 27, 2026
Andrew Rose @claude @arr-wf
release: cut v0.1.2
80218fa 
Go 1.26.10 for GO-2026-6809 (crypto/x509, reachable). Bump indirect
cel-go, x/text, klauspost/compress and x/crypto to clear the remaining
govulncheck module findings; GO-2026-5932 (x/crypto/openpgp) has no fix.

Bundles dependabot #12, #15, #16, #20 and #21, which fail security-scan
on main's Go 1.26.9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
arr-wf added a commit that referenced this pull request Oct 27, 2026
@arr-wf @dependabot
Andrew Rose @claude @pi-mono
release: cut v0.1.2 (#22)
01ad3ad 
* build(deps): bump mcp

Bumps the test-fixture-deps group with 1 update in the /testing/elicit-mcp directory: [mcp](https://github.com/modelcontextprotocol/python-sdk).

Updates `mcp` from 2.0.0 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.0.0...v2.2.0)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-fixture-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 19534e6)

* build(deps): bump the codeql-action group across 1 directory with 3 updates

Bumps the codeql-action group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

Updates `github/codeql-action/upload-sarif` from 4.37.9 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...6f2ac81)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit befd670)

* build(deps): bump golang.org/x/sys

Bumps the indirect-and-patch group with 1 update in the / directory: [golang.org/x/sys](https://github.com/golang/sys).

Updates `golang.org/x/sys` from 0.47.0 to 0.49.0
- [Commits](golang/sys@v0.47.0...v0.49.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: indirect-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit de03da1)

* build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0

Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@2d11466...fa7117d)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 459aa5b)

* build(deps): bump step-security/harden-runner from 2.21.1 to 2.22.2

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.21.1 to 2.22.2.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@e14015d...dc2769a)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 5302571)

* release: cut v0.1.2

Go 1.26.10 for GO-2026-6809 (crypto/x509, reachable). Bump indirect
cel-go, x/text, klauspost/compress and x/crypto to clear the remaining
govulncheck module findings; GO-2026-5932 (x/crypto/openpgp) has no fix.

Bundles dependabot #12, #15, #16, #20 and #21, which fail security-scan
on main's Go 1.26.9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(rules): detect Redis AUTH credentials across four leak shapes

Upstream betterleaks has a structural gap for Redis: a bare AUTH
password carries no token prefix and no key=value shape, so the plain
AUTH command line, the node-redis structured error form, redis-cli
-a/--pass invocations, and RESP protocol dumps all passed through
unredacted. Port the four redis-auth rules from
webflow/secrets-scrubber (built around a real Redis key leak into an
AI session), adapted from JS to RE2 + CEL-filter semantics: its
reference-value heuristic becomes a per-rule filter, its tempered-dot
becomes a whitespace/backslash-excluding class, and the RESP rule
additionally requires the *N array header (all of its fixtures carry
it) to keep prose dollar-amounts from matching.

Every rule carries a minimum-length floor: a sub-8-char finding trips
Splices over-redact backstop against unrelated lines carrying the
same short form, which is a worse failure than over-redacting a short
password.

Co-authored-by: Pi <noreply@pi.dev>
Signed-off-by: Andrew Rose <andrew.rose@webflow.com>
(cherry picked from commit dbc2f21)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Andrew Rose <andrew.rose@webflow.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Rose <andrew@andrew-j21r9k.bat-musical.ts.net>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Pi <noreply@pi.dev>
@arr-wf

arr-wf commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

Superseded by #22 (released as v0.1.2): this bump was cherry-picked there and is now on main.

@arr-wf arr-wf closed this Oct 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/github_actions/ossf/scorecard-action-2.5.0 branch October 27, 2026 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arr-wf arr-wf Awaiting requested review from arr-wf arr-wf is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@arr-wf