Update all dependencies by renovate[bot] · Pull Request #73 · HSLdevcom/jore4-tools

renovate · 2026-01-19T00:31:55Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v6` → `v7`
actions/dependency-review-action	action	major	`v4` → `v5.0.0`
actions/download-artifact	action	major	`v7` → `v8`
actions/upload-artifact	action	major	`v6` → `v7`
azure/login	action	major	`v2` → `v3`
ctrf-io/github-test-reporter	action	minor	`v1.0.26` → `v1.1.0`
dawidd6/action-send-mail	action	major	`v7` → `v17`
docker/build-push-action	action	major	`v6` → `v7`
docker/setup-buildx-action	action	major	`v3` → `v4`
docker/setup-qemu-action	action	major	`v3` → `v4`
suzuki-shunsuke/github-action-renovate-config-validator	action	major	`v1.1.1` → `v2.1.0`
trufflesecurity/trufflehog	action	minor	`v3.92.4` → `v3.95.6`

Release Notes

actions/checkout (actions/checkout)

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Compare Source

Add worktree support for persist-credentials includeIf by @ericsciple in #2327

actions/dependency-review-action (actions/dependency-review-action)

`v5.0.0`: 5.0.0

Compare Source

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

Add .github/copilot-instructions.md for Copilot coding agent by @ahpook in #1067
Update Node.js runtime from 20 to 24 by @scottschreckengaust in #1084
Bump spdx-license-ids from 3.0.20 to 3.0.23 by @mongolyy in #1091
docs: bump actions/checkout from v4 to v6 in workflow examples by @Marukome0743 in #1077
fix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by @tspascoal in #1076
Resolve security findings by @AshelyTC in #1094
v5.0.0 release branch by @ahpook in #1098

New Contributors

@scottschreckengaust made their first contribution in #1084
@mongolyy made their first contribution in #1091
@Marukome0743 made their first contribution in #1077

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

`v4.9.0`: Dependency Review Action 4.9.0

Compare Source

This feature release contains a couple of notable changes:

There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @felickz!
Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @jantiebot!
There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @juxtin!

What's Changed

Compare normalized purls to account for encoding quirks by @juxtin in #1056
Make purl comparisons case insensitive by @juxtin in #1057
Feat: Add Patched Version to Vulnerabilities summary by @felickz in #1045
fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @jantiebot in #1060
Bump actions/stale from 10.1.0 to 10.2.0 by @dependabot[bot] in #1058
Bump actions/checkout from 4 to 6 by @dependabot[bot] in #1021
Updates for release 4.9.0 by @ahpook in #1064

New Contributors

@jantiebot made their first contribution in #1060

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

`v4.8.3`: 4.8.3

Compare Source

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

GitHub Actions can't push to our protected main by @dangoor in #1017
Bump actions/stale from 9.1.0 to 10.1.0 by @dependabot[bot] in #995
Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #1003
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #1005
Upgrade glob to address a vulnerability by @brrygrdn in #1024
Bump js-yaml by @dependabot[bot] in #1020
Addressing vulnerabilities by @Ahmed3lmallah in #1036
Bump fast-xml-parser from 5.3.3 to 5.3.5 by @dependabot[bot] in #1050
Bump fast-xml-parser from 5.3.5 to 5.3.6 by @dependabot[bot] in #1053
Properly truncate long summaries and catch errors by @juxtin in #1052
Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by @dependabot[bot] in #931
Changes for Release 4.8.3 by @ahpook in #1054

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

`v4.8.2`

Compare Source

Minor fixes:

Fix PURL parsing for scoped packages (#1008 from @danielhardej)
Fix for large summaries (#1007 from @gitulisca)
README includes a working example for allow-dependencies-licenses (#1009 from @danielhardej)

`v4.8.1`: Dependency Review Action v4.8.1

Compare Source

What's Changed

(bug) Fix spamming link test in deprecation warning (again) by @ahpook in #1000
Bump version for 4.8.1 release by @ahpook in #1001

Full Changelog: actions/dependency-review-action@v4...v4.8.1

`v4.8.0`

Compare Source

What's Changed

Make Ruby Code Scannable by @ljones140 in #978
Batch some contributions for release by @brrygrdn in #986
- Make license lists collapsable by @jasperkamerling
- feat: add large summary handling with artifact upload by @MattMencel

New Contributors

@ljones140 made their first contribution in #978
@jasperkamerling made their first contribution in #986
@MattMencel made their first contribution in #986

Full Changelog: actions/dependency-review-action@v4...v4.8.0

`v4.7.4`

Compare Source

`v4.7.3`: 4.7.3

Compare Source

What's Changed

Add explicit permissions to workflow files by @AshelyTC in #966
Claire153/fix spamming mentioned issue by @claire153 in #974

Full Changelog: actions/dependency-review-action@v4...v4.7.3

`v4.7.2`: 4.7.2

Compare Source

What's Changed

Add Missing Languages to CodeQL Advanced Configuration by @KyFaSt in #945
Deprecate deny lists by @claire153 in #958
Address discrepancy between docs and reality by @ahpook in #960

New Contributors

@KyFaSt made their first contribution in #945
@claire153 made their first contribution in #958
@ahpook made their first contribution in #960

Full Changelog: actions/dependency-review-action@v4...v4.7.2

`v4.7.1`

Compare Source

Packages added to allow-dependencies-licenses will be allowed even if the package in question has no license information #889
License expressions (e.g. Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g. Ruby)

`v4.7.0`

Compare Source

Handle complex license expressions (e.g. MIT AND GPL-2.0) in allow lists (fixes #809 and probably others)
Replace OTHER in package licenses with LicenseRef-clearlydefined-OTHER so that parsing passes

`v4.6.0`

Compare Source

What's Changed

Updating multiple dependency versions by @Ahmed3lmallah in #870
Grouping minor and patch dependabot updates to lessen the number of PRs by @Ahmed3lmallah in #876
Bump actions/stale from 9.0.0 to 9.1.0 by @dependabot in #878
Bump undici from 5.28.4 to 5.28.5 by @dependabot in #877
DR Action should link to the proxima stamp when appropriate in error messages by @AshelyTC in #891
Allow deny package removal by @ellenfieldn in #888
Fix typos by @omahs in #893
Bump esbuild from 0.19.5 to 0.25.0 by @dependabot in #900
Bump octokit and related dependencies by @RomanIakovlev in #904
Bump @babel/helpers from 7.23.2 to 7.26.10 by @dependabot in #905
Bump @octokit/plugin-paginate-rest from 9.1.5 to 9.2.2 by @dependabot in #899
Update transitive dependency spdx-license-ids by @ailox in #855
To not print OpenSSF Scorecard section if no dependencies scanned by @fabasoad in #884
Improve usage of this action in dependency-review.yml by @fabasoad in #883
Clarify comment-summary-in-pr behaviour by @Pantelis-Santorinios in #902
Prepare 4.6.0 Release candidate by @brrygrdn in #910

New Contributors

@AshelyTC made their first contribution in #891
@ellenfieldn made their first contribution in #888
@omahs made their first contribution in #893
@RomanIakovlev made their first contribution in #904
@ailox made their first contribution in #855
@fabasoad made their first contribution in #884
@Pantelis-Santorinios made their first contribution in #902
@brrygrdn made their first contribution in #910

Full Changelog: actions/dependency-review-action@v4.5.0...v4.6.0

`v4.5.0`

Compare Source

What's Changed

Bump got from 14.4.2 to 14.4.3 by @dependabot in #844
Bump nodemon from 3.1.0 to 3.1.7 by @dependabot in #847
Bump @vercel/ncc from 0.38.1 to 0.38.3 by @dependabot in #849
Overriding the cross-spawn dependency to use a safe version by @Ahmed3lmallah in #850
fix: add summary comment on failure when warn-only: true by @ebickle in #827
Prepare for 4.5.0 release by @Ahmed3lmallah in #851

New Contributors

@ebickle made their first contribution in #827

Full Changelog: actions/dependency-review-action@v4...v4.5.0

`v4.4.0`

Compare Source

What's Changed

Fix for merge_group event bug by @Ahmed3lmallah in #846

Full Changelog: actions/dependency-review-action@v4.3.5...v4.4.0

`v4.3.5`

Compare Source

What's Changed

fix: getRefs function to handle merge_group events by @louis-bompart in #766
Create pull_request_template.md by @jonjanego in #794
Update CONTRIBUTING.md by @jonjanego in #793
Bump @types/node from 20.11.28 to 20.16.0 by @dependabot in #815
Upgrade transitive micromatch library by @elireisman in #829
Do not list changed dependencies in summary by @hmaurer in #828
Update stale.yaml by @jonjanego in #832
Bump got from 14.4.1 to 14.4.2 by @dependabot in #822
Bump eslint-plugin-jest and ts-jest by @Ahmed3lmallah in #840

New Contributors

@louis-bompart made their first contribution in #766
@Ahmed3lmallah made their first contribution in #840

Full Changelog: actions/dependency-review-action@v4.3.4...v4.3.5

`v4.3.4`

Compare Source

What's Changed

Include all added dependencies in scorecard entries by @elireisman in #783
Update SPDX Expression Parsing by @febuiles in #719
- This PR is a significant refactor of SPDX expression parsing that may fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version.

Full Changelog: actions/dependency-review-action@v4.3.3...v4.3.4

`v4.3.3`: Notes for v4.3.3

Compare Source

What's Changed

Allow slashes in purl package names by @juxtin in #765
use the v3 version of the deps.dev API by @josieang in #741
PR with suggestions - [Improvement]: Help streamline / simplify dependency review action README by @am-stead in #773
fix show-openssf-scorecard-levels input by @ramann in #776
Updates to the contribution guidelines by @jonjanego in #778
Create issue templates by @jonjanego in #777
Fix the max comment length issue by @jhutchings1 and @elireisman in #767
Bump project version to 4.3.3 in prep for a release by @elireisman in #781

New Contributors

@josieang made their first contribution in #741
@am-stead made their first contribution in #773
@ramann made their first contribution in #776

Full Changelog: actions/dependency-review-action@v4.3.2...v4.3.3

`v4.3.2`

Compare Source

What's Changed

Fix package-url parsing for allow-dependencies-licenses by @juxtin in #761

Full Changelog: actions/dependency-review-action@v4.3.1...v4.3.2

`v4.3.1`

Compare Source

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See #753.

Full Changelog: actions/dependency-review-action@V4.3.0...v4.3.1

`vV4.3.0`

Compare Source

`v4.3.0`

Compare Source

New Features

The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

Fix action variable name for scorecard by @lukehinds in #735
Fix extra https:// in summary by @jhutchings1 in #748
Bump typescript from 5.3.3 to 5.4.5 by @dependabot in #744
Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @dependabot in #737
Show denied packages with red X by @juxtin in #750
deny-packages configuration option can deny specified version or all packages by @febuiles and @bteng22 in #733

New Contributors

@bteng22 made their first contribution in #733
@lukehinds made their first contribution in #735

Full Changelog: actions/dependency-review-action@v4.2.5...V4.3.0

`v4.2.5`: 4.2.5

Compare Source

What's Changed

Fixed a bug where some configuration options in external files were not being properly picked up -- #722
Bump eslint from 8.56.0 to 8.57.0

Full Changelog: actions/dependency-review-action@v4.2.4...v4.2.5

`v4.2.4`

Compare Source

What's Changed

Fixed a bug in the output of OpenSSF cards for GitHub Actions.

New Contributors

@sporkmonger made their first contribution in #721

Full Changelog: actions/dependency-review-action@v4.2.3...v4.2.4

`v4.2.3`: 4.2.3

Compare Source

What's Changed

Set comment as output by @jsoref in #698
Add support for calculating OpenSSF Scorecards by @jhutchings1 in #709
Add outputs for the changes data by @laughedelic in #707

New Contributors

@jhutchings1 made their first contribution in #709
@laughedelic made their first contribution in #707

Full Changelog: actions/dependency-review-action@v4.1.3...v4.2.3

`v4.1.3`: 4.1.3

Compare Source

Fixes a bug in 4.1.2 that would introduce comments in every pull request, regardless of the user's configuration (see #697).

Full Changelog: actions/dependency-review-action@v4.1.2...v4.1.3

`v4.1.2`: 4.1.2

Compare Source

What's Changed

Expose dependency comment content by @jsoref in #696

Full Changelog: actions/dependency-review-action@v4.1.1...v4.1.2

`v4.1.1`: 4.1.1

Compare Source

What's Changed

Bump undici to fix GHSA-wqq4-5wpv-mx2g
Bump @types/node from 20.11.17 to 20.11.19 by @dependabot in #693

Full Changelog: actions/dependency-review-action@v4.1.0...v4.1.1

`v4.1.0`: 4.1.0

Compare Source

What's Changed

Add warn-only by @tgrall in #432

Added a new configuration option (warn-only, boolean) that makes the action always succeed while still displaying found vulnerabilities in the log.

Create stale.yaml by @jonjanego in #671
Use manual codeql config by @juxtin in #678
Multiple dependency updates (see the changelog below for more information)

New Contributors

@jonjanego made their first contribution in #671
@tgrall made their first contribution in #432

Full Changelog: actions/dependency-review-action@v4...v4.1.0

actions/download-artifact (actions/download-artifact)

`v8.0.1`

Compare Source

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in #471
Add a regression test for artifact name + content-type mismatches by @danwkennedy in #472

Full Changelog: actions/download-artifact@v8...v8.0.1

`v8.0.0`

Compare Source

v8 - What's new

[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in #460
Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in #461

Full Changelog: actions/download-artifact@v7...v8.0.0

`v8`

Compare Source

actions/upload-artifact (actions/upload-artifact)

`v7.0.1`

Compare Source

What's Changed

Update the readme with direct upload details by @danwkennedy in #795
Readme: bump all the example versions to v7 by @danwkennedy in #796
Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in #797

Full Changelog: actions/upload-artifact@v7...v7.0.1

`v7.0.0`

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in #754
Upgrade the module to ESM and bump dependencies by @danwkennedy in #762
Support direct file uploads by @danwkennedy in #764

New Contributors

@Link- made their first contribution in #754

Full Changelog: actions/upload-artifact@v6...v7.0.0

`v7`

Compare Source

azure/login (azure/login)

`v3.0.0`: Azure Login Action v3.0.0

Compare Source

What's Changed

Upgrade nodejs from 20 to 24 and update dependencies by @YanaXu in Azure#578

Full Changelog: Azure/login@v2.3.0...v3.0.0

`v3`: Azure Login Action v3

Compare Source

What's Changed

upgrade nodejs from 20 to 24 and update dependencies by @YanaXu in Azure#578

Full Changelog: Azure/login@v2.3.0...v3

`v2.3.0`: Azure Login Action v2.3.0

Compare Source

What's Changed

Replace the invalid link for the GitHub Action Doc by @MoChilia in Azure#510
Bump braces from 3.0.2 to 3.0.3 by @YanaXu in Azure#511
Mention "allow-no-subscriptions" in missing subscriptionId error by @MoChilia in Azure#512
Log more claims for OIDC login by @MoChilia in Azure#520
Use --client-id for user-assigned managed identity authentication in Azure CLI v2.69.0 or later. by @MoChilia in Azure#514

Full Changelog: Azure/login@v2.2.0...v2.3.0

`v2.2.0`: Azure Login Action v2.2.0

Compare Source

What's Changed

Replace az --version with az version by @MoChilia in Azure#450
Update documentation for setting audience when environment is set by @jcantosz in Azure#455
Fix #459: Errors when registering cloud profile for AzureStack by @MoChilia in Azure#466
Fix typo by @KronosTheLate in Azure#483
move pre cleanup to main and add pre-if and post-if by @YanaXu in Azure#484

New Contributors

@jcantosz made their first contribution in Azure#455
@KronosTheLate made their first contribution in Azure#483

Full Changelog: Azure/login@v2.1.1...v2.2.0

`v2.1.1`

Compare Source

What's Changed

Disable information output in Connect-AzAccount by @YanaXu in Azure#448

New Contributors

@jiasli made their first contribution in Azure#438
@isra-fel made their first contribution in Azure#446

Full Changelog: Azure/login@v2.1.0...v2.1.1

`v2.1.0`: Azure Login Action v2.1.0

Compare Source

What's Changed

Use @vercel/ncc to compile Azure/login by @MoChilia in Azure#428

Full Changelog: Azure/login@v2.0.0...v2.1.0

ctrf-io/github-test-reporter (ctrf-io/github-test-reporter)

`v1.1.0`

Compare Source

What's Changed

Modernized the action internals with an ESM migration and CTRF type updates for a cleaner, more maintainable runtime foundation (#290, #295).
Improved release and CI reliability with clearer check summaries, explicit workflow permissions, separated package CI vs action self-tests, and follow-up build/dependency stability work (#280, #288, #303, #304, #306).
Various dependency and maintenance updates across the GitHub, build, lint, and test toolchain (#267, #275, #277, #284, #285, #286, #289, #291, #292, #293, #294, #298, #299, #300, #301).

Thanks to @dshatz and @Ma11hewThomas for contributions included in this release.

**Full Change

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This change is

github-actions · 2026-01-19T00:32:05Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/shared-dependency-scan.yml

Package	Version	License	Issue Type
actions/checkout	7..	Null	Unknown License

.github/workflows/test-setup-e2e-environment-action.yml

Package	Version	License	Issue Type
actions/checkout	7..	Null	Unknown License

Allowed Licenses:
CC0-1.0, CC-BY-4.0, Unlicense, WTFPL, 0BSD, MIT, Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause, Zlib, MPL-1.1, MPL-2.0, CDDL-1.0, EPL-1.0, EPL-2.0, CECILL-2.1, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, EUPL-1.0, EUPL-1.1, EUPL-1.2, AAL, AFL-3.0, Apache-1.1, APL-1.0, APSL-2.0, Artistic-1.0-Perl, Artistic-2.0, BlueOak-1.0.0, BSL-1.0, CATOSL-1.1, CPAL-1.0, CUA-OPL-1.0, ECL-2.0, EFL-2.0, Entessa, EUDatagrid, Fair, LPPL-1.3c, LPL-1.02, MirOS, Motosoto, Multics, NASA-1.3, NCSA, NTP, Naumen, Nokia, PostgreSQL, PSF-2.0, RPSL-1.0, RSCPL, SimPL-2.0, Sleepycat, SPL-1.0, VSL-1.0, W3C, W3C-20150513, Xnet, ZPL-2.0

Excluded from license check:
pkg:githubactions/trufflesecurity/trufflehog, pkg:npm/knex, pkg:npm/mapbox-gl

OpenSSF Scorecard

Package

Version

Score

Details

actions/actions/checkout

7.*.*

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	⚠️ 2	3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
License	🟢 10	license file detected
Packaging	⚠️ -1	packaging workflow not detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
SAST	🟢 8	SAST tool detected but not run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches

actions/actions/dependency-review-action

5.0.0

🟢 7.7

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	17 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 9	security policy file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
SAST	🟢 9	SAST tool detected but not run on all commits

actions/actions/checkout

7.*.*

🟢 5.9

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	⚠️ 2	3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
License	🟢 10	license file detected
Packaging	⚠️ -1	packaging workflow not detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
SAST	🟢 8	SAST tool detected but not run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches

Scanned Files

.github/workflows/shared-dependency-scan.yml
.github/workflows/test-setup-e2e-environment-action.yml

renovate Bot added the dependencies label Jan 19, 2026

renovate Bot requested a review from a team January 19, 2026 00:31

renovate Bot force-pushed the renovate/all branch 3 times, most recently from 3f19c5b to 20533ff Compare February 5, 2026 10:56

renovate Bot force-pushed the renovate/all branch 3 times, most recently from c3c9935 to b6d145b Compare February 11, 2026 16:38

renovate Bot force-pushed the renovate/all branch 2 times, most recently from a45be0a to c1b7f30 Compare February 25, 2026 23:11

renovate Bot force-pushed the renovate/all branch 7 times, most recently from 466b40d to 92e48fc Compare March 5, 2026 08:41

renovate Bot force-pushed the renovate/all branch 5 times, most recently from 9eb1adf to 34eecc5 Compare March 11, 2026 09:02

renovate Bot force-pushed the renovate/all branch 4 times, most recently from 5beb9cf to 196e75b Compare March 18, 2026 18:04

renovate Bot force-pushed the renovate/all branch 3 times, most recently from 3ac3847 to b1fd059 Compare March 25, 2026 18:12

renovate Bot force-pushed the renovate/all branch 3 times, most recently from 115470d to 4cda12b Compare April 1, 2026 13:19

renovate Bot force-pushed the renovate/all branch from 4cda12b to 27eb118 Compare April 8, 2026 17:22

renovate Bot force-pushed the renovate/all branch 4 times, most recently from aaef2fb to ab025e8 Compare April 21, 2026 23:44

renovate Bot force-pushed the renovate/all branch from ab025e8 to da1fdf6 Compare April 28, 2026 15:32

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 1500d94 to 87d4254 Compare May 11, 2026 20:57

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 77c44a9 to 303bc1f Compare June 2, 2026 19:07

renovate Bot force-pushed the renovate/all branch from 303bc1f to 9e4a655 Compare June 18, 2026 21:36

Update all dependencies

e2768da

renovate Bot force-pushed the renovate/all branch from 9e4a655 to e2768da Compare June 20, 2026 18:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update all dependencies#73

Update all dependencies#73
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all

renovate Bot commented Jan 19, 2026 •

edited by culka

Loading

Uh oh!

github-actions Bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jan 19, 2026 • edited by culka Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v5.0.0: 5.0.0

What's Changed

New Contributors

v4.9.0: Dependency Review Action 4.9.0

What's Changed

New Contributors

v4.8.3: 4.8.3

Dependency Review Action v4.8.3

What's Changed

v4.8.1: Dependency Review Action v4.8.1

What's Changed

What's Changed

New Contributors

v4.7.3: 4.7.3

What's Changed

v4.7.2: 4.7.2

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

v4.3.3: Notes for v4.3.3

What's Changed

New Contributors

What's Changed

What's Changed

New Features

What's Changed

New Contributors

v4.2.5: 4.2.5

What's Changed

What's Changed

New Contributors

v4.2.3: 4.2.3

What's Changed

New Contributors

v4.1.3: 4.1.3

v4.1.2: 4.1.2

What's Changed

v4.1.1: 4.1.1

What's Changed

v4.1.0: 4.1.0

What's Changed

New Contributors

What's Changed

v8 - What's new

Direct downloads

Enforced checks (breaking)

ESM

What's Changed

What's Changed

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v3.0.0: Azure Login Action v3.0.0

What's Changed

v3: Azure Login Action v3

What's Changed

v2.3.0: Azure Login Action v2.3.0

What's Changed

v2.2.0: Azure Login Action v2.2.0

What's Changed

New Contributors

What's Changed

New Contributors

v2.1.0: Azure Login Action v2.1.0

What's Changed

What's Changed

renovate Bot commented Jan 19, 2026 •

edited by culka

Loading

`v5.0.0`: 5.0.0

`v4.9.0`: Dependency Review Action 4.9.0

`v4.8.3`: 4.8.3

`v4.8.1`: Dependency Review Action v4.8.1

`v4.7.3`: 4.7.3

`v4.7.2`: 4.7.2

`v4.3.3`: Notes for v4.3.3

`v4.2.5`: 4.2.5

`v4.2.3`: 4.2.3

`v4.1.3`: 4.1.3

`v4.1.2`: 4.1.2

`v4.1.1`: 4.1.1

`v4.1.0`: 4.1.0

`v3.0.0`: Azure Login Action v3.0.0

`v3`: Azure Login Action v3

`v2.3.0`: Azure Login Action v2.3.0

`v2.2.0`: Azure Login Action v2.2.0

`v2.1.0`: Azure Login Action v2.1.0

github-actions Bot commented Jan 19, 2026 •

edited

Loading