chore(deps): update dependency ossf/scorecard to v5.1.0 #10258
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nicholasdille-bot
previously approved these changes
Feb 13, 2025
nicholasdille-bot
approved these changes
Feb 13, 2025
🔍 Vulnerabilities of
|
| digest | sha256:4af31130978019e7ee0ea9db747c5456b5ee28555558ef9a073d9c87fb038fb4 |
| vulnerabilities |     |
| platform | linux/amd64 |
| size | 18 MB |
| packages | 138 |
|
Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/13302683353. |
|
PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/13302683353. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.0.0->5.1.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
ossf/scorecard (ossf/scorecard)
v5.1.0Compare Source
What's Changed
--file-modeflag to control how repository files are fetched. (#4474, @spencerschrock)--file-mode archivewhich is what older versions of Scorecard always used.--file-mode gitproduces the most accurate results for repositories with.gitattributesfiles at the cost of analysis speed. This currently only supports GitHub but can be expanded to other forges in the future.Azure DevOps Support (Experimental)
There is now experimental support for Azure DevOps repositories (thanks @JamieMagee). Most checks should work, but the following checks do not:
Branch-Protection,SBOM, andSigned-Releases.To analyze a repository:
SCORECARD_EXPERIMENTALenvironment variable to any value.AZURE_DEVOPS_AUTH_TOKENenvironment variable.Checks
Fuzzing,License,Packaging,SAST, andSecurity-Policychecks when using--localoption (#4423, @lharrison13)CI-Tests
Contributors
Dangerous-Workflow
git applyorpatch -p1from the repository's root. The patch is currently only visible when running thehasDangerousWorkflowScriptInjectionprobe directly. (#4218, @pnacht)Fuzzing
License
Pinned-Dependencies
Security-Policy
.githubrepository was checked for a security policy without the proper authenticated transport by @jeffmendoza in https://github.com/ossf/scorecard/pull/4259Signed-Releases
Docs
New Contributors
Full Changelog: ossf/scorecard@v5.0.0...v5.1.0
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.