Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

merge development into main #94

Merged
merged 72 commits into from
Oct 28, 2023
Merged

merge development into main #94

merged 72 commits into from
Oct 28, 2023

Conversation

nam20485
Copy link
Owner

No description provided.

nam20485 and others added 30 commits October 24, 2023 17:41
@nam20485
move protoc-generated files into new directory to match namespace
ab97f39
@nam20485
change doxygen cmake configuring message
3533ce9
@nam20485
move files into folders matching their namespace
b062ef9
@nam20485
include win.h to fix undefined _WIN32_WINNT macro warnings
6c373db
@nam20485
fix windows header includes
d040720
@nam20485
move lib app files into the correct namespace
dca0caa
@nam20485
use windows include header
2394634
@nam20485
log exception when designs dir doesn't exist in designs/list endpoint
abbd1d6
@nam20485
move DesignCache into Odb::Lib::App namespace & folder
c967e54
@nam20485
guard against including windows header stuff if not using msc
abd6161
@nam20485
disable showing source download buttons in docs site
8983f9e
@nam20485
make branch names bigger in README's CI/CD section
cd6c579
@nam20485
Create scorecard.yml
27abbc9
@nam20485
Create scorecard.yml (#75)
4217b36
@nam20485
add empty proto definition files
5efd3bf
@step-security-bot
[StepSecurity] Apply security best practices
1b355bc 
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@nam20485
[StepSecurity] Apply security best practices (#76)
abff842 
## Summary

This pull request is created by
[StepSecurity](https://app.stepsecurity.io/securerepo) at the request of
@nam20485. Please merge the Pull Request to incorporate the requested
changes. Please tag @nam20485 on your message if you have any questions
related to the PR.
## Security Fixes

### Least Privileged GitHub Actions Token Permissions

The GITHUB_TOKEN is an automatically generated secret to make
authenticated calls to the GitHub API. GitHub recommends setting minimum
token permissions for the GITHUB_TOKEN.

- [GitHub Security
Guide](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions)
### Pinned Dependencies

GitHub Action tags and Docker tags are mutatble. This poses a security
risk. GitHub's Security Hardening guide recommends pinning actions to
full length commit.

- [GitHub Security
Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies)
### Keeping your actions up to date with Dependabot

With Dependabot version updates, when Dependabot identifies an outdated
dependency, it raises a pull request to update the manifest to the
latest version of the dependency. This is recommended by GitHub as well
as The Open Source Security Foundation (OpenSSF).

- [GitHub Security
Guide](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool)
### Add Dependency Review Workflow

The Dependency Review Workflow enforces dependency reviews on your pull
requests. The action scans for vulnerable versions of dependencies
introduced by package version changes in pull requests, and warns you
about the associated security vulnerabilities. This gives you better
visibility of what's changing in a pull request, and helps prevent
vulnerabilities being added to your repository.

- [Github Guide about Dependency
Review](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review)
- [Github Guide for Configuring Dependency Review
Action](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-dependency-review#using-inline-configuration-to-set-up-the-dependency-review-action)


## Feedback
For bug reports, feature requests, and general feedback; please email
support@stepsecurity.io. To create such PRs, please visit
https://app.stepsecurity.io/securerepo.


Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@dependabot
Bump django from 4.2.3 to 4.2.6 in /PyOdbDesignServer
dafe878 
Bumps [django](https://github.com/django/django) from 4.2.3 to 4.2.6.
- [Commits](django/django@4.2.3...4.2.6)

---
updated-dependencies:
- dependency-name: django
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump actions/checkout from 3.1.0 to 4.1.1
abee12c 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.1.0 to 4.1.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3.1.0...b4ffde6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@nam20485
move codeql-config.yml config into top-level .github directory
7d3053b
@nam20485
move disabled workflow config files into a disabled directory to hide…
5a05ff1 
… them from github
@nam20485
fix action urls to move version comment out of the value
4d2e6f0
@nam20485
Bump actions/checkout from 3.1.0 to 4.1.1 (#83)
2cf4add 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.1.0
to 4.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update CODEOWNERS to Launch team by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1510">actions/checkout#1510</a></li>
<li>Correct link to GitHub Docs by <a
href="https://github.com/peterbe"><code>@​peterbe</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1511">actions/checkout#1511</a></li>
<li>Link to release page from what's new section by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1514">actions/checkout#1514</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1510">actions/checkout#1510</a></li>
<li><a href="https://github.com/peterbe"><code>@​peterbe</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1511">actions/checkout#1511</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4.1.0...v4.1.1">https://github.com/actions/checkout/compare/v4.1.0...v4.1.1</a></p>
<h2>v4.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md for V4 by <a
href="https://github.com/sivapalan"><code>@​sivapalan</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1452">actions/checkout#1452</a></li>
<li>Add support for partial checkout filters by <a
href="https://github.com/finleygn"><code>@​finleygn</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1396">actions/checkout#1396</a></li>
<li>Prepare 4.1.0 release by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1496">actions/checkout#1496</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/sivapalan"><code>@​sivapalan</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1452">actions/checkout#1452</a></li>
<li><a href="https://github.com/finleygn"><code>@​finleygn</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1396">actions/checkout#1396</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4.0.0...v4.1.0">https://github.com/actions/checkout/compare/v4.0.0...v4.1.0</a></p>
<h2>v4.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update default runtime to node20 by <a
href="https://github.com/takost"><code>@​takost</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1436">actions/checkout#1436</a></li>
<li>Support fetching without the --progress option by <a
href="https://github.com/simonbaird"><code>@​simonbaird</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1067">actions/checkout#1067</a></li>
<li>Release 4.0.0 by <a
href="https://github.com/takost"><code>@​takost</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1447">actions/checkout#1447</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/takost"><code>@​takost</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1436">actions/checkout#1436</a></li>
<li><a
href="https://github.com/simonbaird"><code>@​simonbaird</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1067">actions/checkout#1067</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v3...v4.0.0">https://github.com/actions/checkout/compare/v3...v4.0.0</a></p>
<h2>v3.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Mark test scripts with Bash'isms to be run via Bash by <a
href="https://github.com/dscho"><code>@​dscho</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1377">actions/checkout#1377</a></li>
<li>Add option to fetch tags even if fetch-depth &gt; 0 by <a
href="https://github.com/RobertWieczoreck"><code>@​RobertWieczoreck</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/579">actions/checkout#579</a></li>
<li>Release 3.6.0 by <a
href="https://github.com/luketomlinson"><code>@​luketomlinson</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1437">actions/checkout#1437</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/RobertWieczoreck"><code>@​RobertWieczoreck</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/579">actions/checkout#579</a></li>
<li><a
href="https://github.com/luketomlinson"><code>@​luketomlinson</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1437">actions/checkout#1437</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v3.5.3...v3.6.0">https://github.com/actions/checkout/compare/v3.5.3...v3.6.0</a></p>
<h2>v3.5.3</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v4.1.0</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/1396">Add
support for partial checkout filters</a></li>
</ul>
<h2>v4.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1067">Support
fetching without the --progress option</a></li>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1436">Update to
node20</a></li>
</ul>
<h2>v3.6.0</h2>
<ul>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1377">Fix: Mark
test scripts with Bash'isms to be run via Bash</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/579">Add
option to fetch tags even if fetch-depth &gt; 0</a></li>
</ul>
<h2>v3.5.3</h2>
<ul>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1196">Fix:
Checkout fail in self-hosted runners when faulty submodule are
checked-in</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/1287">Fix
typos found by codespell</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/1369">Add
support for sparse checkouts</a></li>
</ul>
<h2>v3.5.2</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/1289">Fix
api endpoint for GHES</a></li>
</ul>
<h2>v3.5.1</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/1246">Fix
slow checkout on Windows</a></li>
</ul>
<h2>v3.5.0</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/1237">Add
new public key for known_hosts</a></li>
</ul>
<h2>v3.4.0</h2>
<ul>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1209">Upgrade
codeql actions to v2</a></li>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1210">Upgrade
dependencies</a></li>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1225">Upgrade
<code>@​actions/io</code></a></li>
</ul>
<h2>v3.3.0</h2>
<ul>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1045">Implement
branch list using callbacks from exec function</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/1050">Add
in explicit reference to private checkout options</a></li>
<li>[Fix comment typos (that got added in <a
href="https://redirect.github.com/actions/checkout/issues/770">#770</a>)](<a
href="https://redirect.github.com/actions/checkout/pull/1057">actions/checkout#1057</a>)</li>
</ul>
<h2>v3.2.0</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/942">Add
GitHub Action to perform release</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/967">Fix
status badge</a></li>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1002">Replace
datadog/squid with ubuntu/squid Docker image</a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/964">Wrap
pipeline commands for submoduleForeach in quotes</a></li>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1029">Update
<code>@​actions/io</code> to 1.1.2</a></li>
<li><a
href="https://redirect.github.com/actions/checkout/pull/1039">Upgrading
version to 3.2.0</a></li>
</ul>
<h2>v3.1.0</h2>
<ul>
<li><a href="https://redirect.github.com/actions/checkout/pull/939">Use
<code>@​actions/core</code> <code>saveState</code> and
<code>getState</code></a></li>
<li><a href="https://redirect.github.com/actions/checkout/pull/922">Add
<code>github-server-url</code> input</a></li>
</ul>
<h2>v3.0.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/b4ffde65f46336ab88eb53be808477a3936bae11"><code>b4ffde6</code></a>
Link to release page from what's new section (<a
href="https://redirect.github.com/actions/checkout/issues/1514">#1514</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/8530928916aaef40f59e6f221989ccb31f5759e7"><code>8530928</code></a>
Correct link to GitHub Docs (<a
href="https://redirect.github.com/actions/checkout/issues/1511">#1511</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/7cdaf2fbc075e6f3b9ca94cfd6cec5adc8a75622"><code>7cdaf2f</code></a>
Update CODEOWNERS to Launch team (<a
href="https://redirect.github.com/actions/checkout/issues/1510">#1510</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/8ade135a41bc03ea155e62e844d188df1ea18608"><code>8ade135</code></a>
Prepare 4.1.0 release (<a
href="https://redirect.github.com/actions/checkout/issues/1496">#1496</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/c533a0a4cfc4962971818edcfac47a2899e69799"><code>c533a0a</code></a>
Add support for partial checkout filters (<a
href="https://redirect.github.com/actions/checkout/issues/1396">#1396</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/72f2cec99f417b1a1c5e2e88945068983b7965f9"><code>72f2cec</code></a>
Update README.md for V4 (<a
href="https://redirect.github.com/actions/checkout/issues/1452">#1452</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/3df4ab11eba7bda6032a0b82a6bb43b11571feac"><code>3df4ab1</code></a>
Release 4.0.0 (<a
href="https://redirect.github.com/actions/checkout/issues/1447">#1447</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/8b5e8b768746b50394015010d25e690bfab9dfbc"><code>8b5e8b7</code></a>
Support fetching without the --progress option (<a
href="https://redirect.github.com/actions/checkout/issues/1067">#1067</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/97a652b80035363df47baee5031ec8670b8878ac"><code>97a652b</code></a>
Update default runtime to node20 (<a
href="https://redirect.github.com/actions/checkout/issues/1436">#1436</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f43a0e5ff2bd294095638e18286ca9a3d1956744"><code>f43a0e5</code></a>
Release 3.6.0 (<a
href="https://redirect.github.com/actions/checkout/issues/1437">#1437</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/v3.1.0...b4ffde65f46336ab88eb53be808477a3936bae11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=3.1.0&new-version=4.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@dependabot
Bump actions/dependency-review-action from 2.5.1 to 3.1.0
edda402 
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 2.5.1 to 3.1.0.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@0efb1d1...6c5ccda)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github/codeql-action from 2.2.4 to 2.22.4
b0a197a 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.2.4 to 2.22.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v2.2.4...49abf0b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@nam20485
Bump actions/dependency-review-action from 2.5.1 to 3.1.0 (#82)
8708ee0 
Bumps
[actions/dependency-review-action](https://github.com/actions/dependency-review-action)
from 2.5.1 to 3.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/dependency-review-action/releases">actions/dependency-review-action's
releases</a>.</em></p>
<blockquote>
<h2>3.1.0</h2>
<h2>What's New</h2>
<p>Added support for dependencies submitted through the <a
href="https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#best-practices-for-using-the-dependency-review-api-and-the-dependency-submission-api-together">dependency
submission API</a>. This includes two new configuration parameters:
<code>retry-on-snapshot-warnings</code> and
<code>retry-on-snapshot-warnings-timeout</code>.</p>
<h2>What's Changed</h2>
<ul>
<li>Fix(docs): Correct action input name by <a
href="https://github.com/oerd"><code>@​oerd</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/551">actions/dependency-review-action#551</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/oerd"><code>@​oerd</code></a> made their
first contribution in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/551">actions/dependency-review-action#551</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/dependency-review-action/compare/v3...v3.1.0">https://github.com/actions/dependency-review-action/compare/v3...v3.1.0</a></p>
<h2>3.0.8</h2>
<h2>What's Changed</h2>
<p>Added <code>on-failure</code> option to
<code>comment-summary-in-pr</code> setting by <a
href="https://github.com/sgmurphy"><code>@​sgmurphy</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/540">actions/dependency-review-action#540</a></p>
<p>Previous configuration files using
<code>true</code>/<code>false</code> for
<code>comment-summary-in-pr</code> will be mapped automatically to the
new values, but we encourage you to update to
<code>always</code>/<code>on-failure</code>/<code>never</code>.</p>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/sgmurphy"><code>@​sgmurphy</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/540">actions/dependency-review-action#540</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/dependency-review-action/compare/v3...v3.0.8">https://github.com/actions/dependency-review-action/compare/v3...v3.0.8</a></p>
<h2>3.0.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Make GHES support / setup more clear by <a
href="https://github.com/rajbos"><code>@​rajbos</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/534">actions/dependency-review-action#534</a></li>
<li>Add an option to deny packages or groups of packages by <a
href="https://github.com/adrienpessu"><code>@​adrienpessu</code></a> in
<a
href="https://redirect.github.com/actions/dependency-review-action/pull/544">actions/dependency-review-action#544</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/rajbos"><code>@​rajbos</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/534">actions/dependency-review-action#534</a></li>
<li><a
href="https://github.com/adrienpessu"><code>@​adrienpessu</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/544">actions/dependency-review-action#544</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/dependency-review-action/compare/v3...v3.0.7">https://github.com/actions/dependency-review-action/compare/v3...v3.0.7</a></p>
<h2>3.0.6</h2>
<p>Fixes a bug introduced in 3.0.5 where we raised PURL errors when
Dependency Graph returns an empty <code>package_url</code>.</p>
<h2>3.0.5</h2>
<h2>What's Changed</h2>
<p>Thanks to <a
href="https://github.com/theztefan"><code>@​theztefan</code></a>, we now
have a new <code>allow-dependencies-licenses</code> option that takes a
list of dependencies that will be excluded from license checks. See the
<a
href="https://github.com/actions/dependency-review-action#configuration-options">configuration
options</a> for more information on how to use it.</p>
<ul>
<li>Exclude dependencies from license checks by <a
href="https://github.com/theztefan"><code>@​theztefan</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/423">actions/dependency-review-action#423</a></li>
<li>Documentation examples by <a
href="https://github.com/theztefan"><code>@​theztefan</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/423">actions/dependency-review-action#423</a></li>
<li>Show snapshot warnings in the summary by <a
href="https://github.com/juxtin"><code>@​juxtin</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/439">actions/dependency-review-action#439</a></li>
<li>Fix default values for fail-on-severity by <a
href="https://github.com/febuiles"><code>@​febuiles</code></a> in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/451">actions/dependency-review-action#451</a></li>
<li>Updated dependencies.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/juxtin"><code>@​juxtin</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/dependency-review-action/pull/439">actions/dependency-review-action#439</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/dependency-review-action/commit/6c5ccdad469c9f8a2996bfecaec55a631a347034"><code>6c5ccda</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/dependency-review-action/issues/562">#562</a>
from actions/juxtin/v3.0.9</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/51da82b3f5affb6a0b2d1c4bd097a7f19c01e654"><code>51da82b</code></a>
updating package-lock.json</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/ca13810d947b509c13c81be3fb46e2bd35bff5e5"><code>ca13810</code></a>
Update version to 3.1.0</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/8447b31d383053ea9562a8ce6c1221860836727a"><code>8447b31</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/dependency-review-action/issues/561">#561</a>
from actions/juxtin/dr-snaps-readme</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/85df23de2c6f7c34d74d34a5d673d60bcfa0ec19"><code>85df23d</code></a>
Update readme with new parameters</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/5da6fdbdf999b1766e6884d5c0cdd59982984001"><code>5da6fdb</code></a>
Clean up markdown formatting</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/92837b0ca868477aebc7be9ce9c9381bacd919fc"><code>92837b0</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/dependency-review-action/issues/560">#560</a>
from actions/juxtin/improve-warnings</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/35a52fd146e5ed7ee2860826a8aafadc5d408670"><code>35a52fd</code></a>
Minor tweaks to snapshot warnings</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/bed9726f78c4939768c1ea425ceb5f8491e9b0a6"><code>bed9726</code></a>
Make snapshot warning messages clearer and more actionable</li>
<li><a
href="https://github.com/actions/dependency-review-action/commit/e4d20ce9adc28481ee532e694c11f07e34a0ea08"><code>e4d20ce</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/dependency-review-action/issues/556">#556</a>
from actions/juxtin/dr-snaps-pre-launch</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/dependency-review-action/compare/0efb1d1d84fc9633afcdaad14c485cbbc90ef46c...6c5ccdad469c9f8a2996bfecaec55a631a347034">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/dependency-review-action&package-manager=github_actions&previous-version=2.5.1&new-version=3.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@nam20485
Bump github/codeql-action from 2.2.4 to 2.22.4 (#81)
e470646 
Bumps [github/codeql-action](https://github.com/github/codeql-action)
from 2.2.4 to 2.22.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>CodeQL Bundle</h2>
<p>Bundles CodeQL CLI v2.15.1</p>
<ul>
<li>(<a
href="https://github.com/github/codeql-cli-binaries/blob/HEAD/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.1">release</a>)</li>
</ul>
<p>Includes the following CodeQL language packs from <a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1"><code>github/codeql@codeql-cli/v2.15.1</code></a>:</p>
<ul>
<li><code>codeql/cpp-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/cpp/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/cpp/ql/src">source</a>)</li>
<li><code>codeql/cpp-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/cpp/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/cpp/ql/lib">source</a>)</li>
<li><code>codeql/csharp-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/csharp/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/csharp/ql/src">source</a>)</li>
<li><code>codeql/csharp-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/csharp/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/csharp/ql/lib">source</a>)</li>
<li><code>codeql/go-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/go/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/go/ql/src">source</a>)</li>
<li><code>codeql/go-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/go/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/go/ql/lib">source</a>)</li>
<li><code>codeql/java-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/java/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/java/ql/src">source</a>)</li>
<li><code>codeql/java-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/java/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/java/ql/lib">source</a>)</li>
<li><code>codeql/javascript-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/javascript/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/javascript/ql/src">source</a>)</li>
<li><code>codeql/javascript-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/javascript/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/javascript/ql/lib">source</a>)</li>
<li><code>codeql/python-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/python/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/python/ql/src">source</a>)</li>
<li><code>codeql/python-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/python/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/python/ql/lib">source</a>)</li>
<li><code>codeql/ruby-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/ruby/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/ruby/ql/src">source</a>)</li>
<li><code>codeql/ruby-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/ruby/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/ruby/ql/lib">source</a>)</li>
<li><code>codeql/swift-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/swift/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/swift/ql/src">source</a>)</li>
<li><code>codeql/swift-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/swift/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.1/swift/ql/lib">source</a>)</li>
</ul>
<h2>CodeQL Bundle</h2>
<p>Bundles CodeQL CLI v2.15.0</p>
<ul>
<li>(<a
href="https://github.com/github/codeql-cli-binaries/blob/HEAD/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.0">release</a>)</li>
</ul>
<p>Includes the following CodeQL language packs from <a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0"><code>github/codeql@codeql-cli/v2.15.0</code></a>:</p>
<ul>
<li><code>codeql/cpp-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/cpp/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/cpp/ql/src">source</a>)</li>
<li><code>codeql/cpp-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/cpp/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/cpp/ql/lib">source</a>)</li>
<li><code>codeql/csharp-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/csharp/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/csharp/ql/src">source</a>)</li>
<li><code>codeql/csharp-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/csharp/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/csharp/ql/lib">source</a>)</li>
<li><code>codeql/go-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/go/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/go/ql/src">source</a>)</li>
<li><code>codeql/go-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/go/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/go/ql/lib">source</a>)</li>
<li><code>codeql/java-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/java/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/java/ql/src">source</a>)</li>
<li><code>codeql/java-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/java/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/java/ql/lib">source</a>)</li>
<li><code>codeql/javascript-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/javascript/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/javascript/ql/src">source</a>)</li>
<li><code>codeql/javascript-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/javascript/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/javascript/ql/lib">source</a>)</li>
<li><code>codeql/python-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/python/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/python/ql/src">source</a>)</li>
<li><code>codeql/python-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/python/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/python/ql/lib">source</a>)</li>
<li><code>codeql/ruby-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/ruby/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/ruby/ql/src">source</a>)</li>
<li><code>codeql/ruby-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/ruby/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/ruby/ql/lib">source</a>)</li>
<li><code>codeql/swift-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/swift/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/swift/ql/src">source</a>)</li>
<li><code>codeql/swift-all</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/swift/ql/lib/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.15.0/swift/ql/lib">source</a>)</li>
</ul>
<h2>CodeQL Bundle</h2>
<p>Bundles CodeQL CLI v2.14.6</p>
<ul>
<li>(<a
href="https://github.com/github/codeql-cli-binaries/blob/HEAD/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql-cli-binaries/releases/tag/v2.14.6">release</a>)</li>
</ul>
<p>Includes the following CodeQL language packs from <a
href="https://github.com/github/codeql/tree/codeql-cli/v2.14.6"><code>github/codeql@codeql-cli/v2.14.6</code></a>:</p>
<ul>
<li><code>codeql/cpp-queries</code> (<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.14.6/cpp/ql/src/CHANGELOG.md">changelog</a>,
<a
href="https://github.com/github/codeql/tree/codeql-cli/v2.14.6/cpp/ql/src">source</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>2.22.4 - 20 Oct 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.15.1. <a
href="https://redirect.github.com/github/codeql-action/pull/1953">#1953</a></li>
<li>Users will begin to see warnings on Node.js 16 deprecation in their
Actions logs on code scanning runs starting October 23, 2023.
<ul>
<li>All code scanning workflows should continue to succeed regardless of
the warning.</li>
<li>The team at GitHub maintaining the CodeQL Action is aware of the
deprecation timeline and actively working on creating another version of
the CodeQL Action, v3, that will bump us to Node 20.</li>
<li>For more information, and to communicate with the maintaining team,
please use <a
href="https://redirect.github.com/github/codeql-action/issues/1959">this
issue</a>.</li>
</ul>
</li>
</ul>
<h2>2.22.3 - 13 Oct 2023</h2>
<ul>
<li>Provide an authentication token when downloading the CodeQL Bundle
from the API of a GitHub Enterprise Server instance. <a
href="https://redirect.github.com/github/codeql-action/pull/1945">#1945</a></li>
</ul>
<h2>2.22.2 - 12 Oct 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.15.0. <a
href="https://redirect.github.com/github/codeql-action/pull/1938">#1938</a></li>
<li>Improve the log output when an error occurs in an invocation of the
CodeQL CLI. <a
href="https://redirect.github.com/github/codeql-action/pull/1927">#1927</a></li>
</ul>
<h2>2.22.1 - 09 Oct 2023</h2>
<ul>
<li>Add a workaround for Python 3.12, which is not supported in CodeQL
CLI version 2.14.6 or earlier. If you are running an analysis on Windows
and using Python 3.12 or later, the CodeQL Action will switch to running
Python 3.11. In this case, if Python 3.11 is not found, then the
workflow will fail. <a
href="https://redirect.github.com/github/codeql-action/pull/1928">#1928</a></li>
</ul>
<h2>2.22.0 - 06 Oct 2023</h2>
<ul>
<li>The CodeQL Action now requires CodeQL version 2.10.5 or later. For
more information, see the corresponding changelog entry for CodeQL
Action version 2.21.8. <a
href="https://redirect.github.com/github/codeql-action/pull/1907">#1907</a></li>
<li>The CodeQL Action no longer runs ML-powered queries. For more
information, including details on our investment in AI-powered security
technology, see <a
href="https://github.blog/changelog/2023-09-29-codeql-code-scanning-deprecates-ml-powered-alerts/">&quot;CodeQL
code scanning deprecates ML-powered alerts.&quot;</a> <a
href="https://redirect.github.com/github/codeql-action/pull/1910">#1910</a></li>
<li>Fix a bug which prevented tracing of projects using Go 1.21 and
above on Linux. <a
href="https://redirect.github.com/github/codeql-action/pull/1909">#1909</a></li>
</ul>
<h2>2.21.9 - 27 Sep 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.14.6. <a
href="https://redirect.github.com/github/codeql-action/pull/1897">#1897</a></li>
<li>We are rolling out a feature in October 2023 that will improve the
success rate of C/C++ autobuild. <a
href="https://redirect.github.com/github/codeql-action/pull/1889">#1889</a></li>
<li>We are rolling out a feature in October 2023 that will provide
specific file coverage information for C and C++, Java and Kotlin, and
JavaScript and TypeScript. Currently file coverage information for each
of these pairs of languages is grouped together. <a
href="https://redirect.github.com/github/codeql-action/pull/1903">#1903</a></li>
<li>Add a warning to help customers avoid inadvertently analyzing the
same CodeQL language in multiple matrix jobs. <a
href="https://redirect.github.com/github/codeql-action/pull/1901">#1901</a></li>
</ul>
<h2>2.21.8 - 19 Sep 2023</h2>
<ul>
<li>Add a deprecation warning for customers using CodeQL version 2.10.4
and earlier. These versions of CodeQL were discontinued on 12 September
2023 alongside GitHub Enterprise Server 3.6, and will be unsupported by
the next minor release of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/1884">#1884</a>
<ul>
<li>If you are using one of these versions, please update to CodeQL CLI
version 2.10.5 or later. For instance, if you have specified a custom
version of the CLI using the 'tools' input to the 'init' Action, you can
remove this input to use the default version.</li>
<li>Alternatively, if you want to continue using a version of the CodeQL
CLI between 2.9.5 and 2.10.4, you can replace
<code>github/codeql-action/*@v2</code> by
<code>github/codeql-action/*@v2.21.7</code> in your code scanning
workflow to ensure you continue using this version of the CodeQL
Action.</li>
</ul>
</li>
<li>Enable the following language aliases when using CodeQL 2.14.4 and
later: <code>c-cpp</code> for C/C++ analysis, <code>java-kotlin</code>
for Java/Kotlin analysis, and <code>javascript-typescript</code> for
JavaScript/TypeScript analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/1883">#1883</a></li>
</ul>
<h2>2.21.7 - 14 Sep 2023</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/49abf0ba24d0b7953cb586944e918a0b92074c80"><code>49abf0b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/1961">#1961</a>
from github/update-v2.22.4-63470275e</li>
<li><a
href="https://github.com/github/codeql-action/commit/907abca61b21ae40b4f5b3a5233638842f1ac8d8"><code>907abca</code></a>
Update changelog for v2.22.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/63470275e73bbef3ffab4f0bfff5b52e0772baf5"><code>6347027</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/1953">#1953</a>
from github/update-bundle/codeql-bundle-v2.15.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/b98a636a6be5574bf856f048453614bdd05a9a6e"><code>b98a636</code></a>
Merge branch 'main' into update-bundle/codeql-bundle-v2.15.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/4a368f64ad12c37745429168fc8de8672d16d5a6"><code>4a368f6</code></a>
Add announcement on Node 16 deprecation (<a
href="https://redirect.github.com/github/codeql-action/issues/1960">#1960</a>)</li>
<li><a
href="https://github.com/github/codeql-action/commit/77bbb99abd466b60ab05e710e898ebe72cc5a8a2"><code>77bbb99</code></a>
Bump urllib3 in /python-setup/tests/poetry/python-3.8 (<a
href="https://redirect.github.com/github/codeql-action/issues/1957">#1957</a>)</li>
<li><a
href="https://github.com/github/codeql-action/commit/a75a0d5716c40695ffa2977b51b8bd0daff48b87"><code>a75a0d5</code></a>
Bump urllib3 in /python-setup/tests/poetry/requests-3 (<a
href="https://redirect.github.com/github/codeql-action/issues/1956">#1956</a>)</li>
<li><a
href="https://github.com/github/codeql-action/commit/aa55b87f8723d3b0ef9a4163d3952d085d692c7e"><code>aa55b87</code></a>
Bump urllib3 in /python-setup/tests/pipenv/requests-3 (<a
href="https://redirect.github.com/github/codeql-action/issues/1955">#1955</a>)</li>
<li><a
href="https://github.com/github/codeql-action/commit/b6b0833c3dcbc510e52e232ffa10b394011136f9"><code>b6b0833</code></a>
Bump urllib3 in /python-setup/tests/pipenv/python-3.8 (<a
href="https://redirect.github.com/github/codeql-action/issues/1954">#1954</a>)</li>
<li><a
href="https://github.com/github/codeql-action/commit/013244878413b4d09fc10936471c302365ae9548"><code>0132448</code></a>
Add changelog note</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/v2.2.4...49abf0ba24d0b7953cb586944e918a0b92074c80">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=2.2.4&new-version=2.22.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@dependabot
Bump actions/upload-artifact from 2.3.1 to 3.1.3
c44653a 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 2.3.1 to 3.1.3.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v2.3.1...a8a3f3a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@nam20485
Bump actions/upload-artifact from 2.3.1 to 3.1.3 (#80)
519ea00 
Bumps
[actions/upload-artifact](https://github.com/actions/upload-artifact)
from 2.3.1 to 3.1.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.3</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(github): remove trailing whitespaces by <a
href="https://github.com/ljmf00"><code>@​ljmf00</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/313">actions/upload-artifact#313</a></li>
<li>Bump <code>@​actions/artifact</code> version to v1.1.2 by <a
href="https://github.com/bethanyj28"><code>@​bethanyj28</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/436">actions/upload-artifact#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v3...v3.1.3">https://github.com/actions/upload-artifact/compare/v3...v3.1.3</a></p>
<h2>v3.1.2</h2>
<ul>
<li>Update all <code>@actions/*</code> NPM packages to their latest
versions- <a
href="https://redirect.github.com/actions/upload-artifact/issues/374">#374</a></li>
<li>Update all dev dependencies to their most recent versions - <a
href="https://redirect.github.com/actions/upload-artifact/issues/375">#375</a></li>
</ul>
<h2>v3.1.1</h2>
<ul>
<li>Update actions/core package to latest version to remove
<code>set-output</code> deprecation warning <a
href="https://redirect.github.com/actions/upload-artifact/issues/351">#351</a></li>
</ul>
<h2>v3.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/artifact</code> to v1.1.0 (<a
href="https://redirect.github.com/actions/upload-artifact/pull/327">actions/upload-artifact#327</a>)
<ul>
<li>Adds checksum headers on artifact upload (<a
href="https://redirect.github.com/actions/toolkit/pull/1095">actions/toolkit#1095</a>)
(<a
href="https://redirect.github.com/actions/toolkit/pull/1063">actions/toolkit#1063</a>)</li>
</ul>
</li>
</ul>
<h2>v3.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update default runtime to node16 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/293">#293</a>)</li>
<li>Update package-lock.json file version to 2 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/302">#302</a>)</li>
</ul>
<h3>Breaking Changes</h3>
<p>With the update to Node 16, all scripts will now be run with Node 16
rather than Node 12.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/a8a3f3ad30e3422c9c7b888a15615d19a852ae32"><code>a8a3f3a</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/436">#436</a>
from bethanyj28/main</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/7b48769c030f7121ecb01c3558dd3cd8b9660a20"><code>7b48769</code></a>
update dependency cache</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/66630398dfe3d04deb4c489ac54b9b468f071706"><code>6663039</code></a>
update dist/index.js</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/55e76b779da56f582e27a6f7aff54c1e610551e5"><code>55e76b7</code></a>
bump <code>@​actions/artifact</code> version</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/65d862660abb392b8c4a3d1195a2108db131dd05"><code>65d8626</code></a>
chore(github): remove trailing whitespaces (<a
href="https://redirect.github.com/actions/upload-artifact/issues/313">#313</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/0b7f8abb1508181956e8e162db84b466c27e18ce"><code>0b7f8ab</code></a>
ci(github): update action/download-artifact from v1 to v3 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/312">#312</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/013d2b89baa2f354c5ffec54c68bec4ab39a2534"><code>013d2b8</code></a>
Create devcontainer for codespaces + update all dev dependencies (<a
href="https://redirect.github.com/actions/upload-artifact/issues/375">#375</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/055b8b3f04a4a7ed853f2c6ab04256f83e4874dc"><code>055b8b3</code></a>
Bump Actions NPM dependencies (<a
href="https://redirect.github.com/actions/upload-artifact/issues/374">#374</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/7a5d4831f75130126bffffb8443b412485f7b836"><code>7a5d483</code></a>
ci(github): update action/checkout from v2 to v3 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/315">#315</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e0057a5b76f2fdad976135e8dd7b691e632b9056"><code>e0057a5</code></a>
README: Bump actions/checkout to v3 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/352">#352</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/upload-artifact/compare/v2.3.1...a8a3f3ad30e3422c9c7b888a15615d19a852ae32">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=2.3.1&new-version=3.1.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@dependabot
Bump docker/metadata-action from 3.3.0 to 5.0.0
fc5ced4 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 3.3.0 to 5.0.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Upgrade guide](https://github.com/docker/metadata-action/blob/master/UPGRADE.md)
- [Commits](docker/metadata-action@98669ae...96383f4)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
nam20485 and others added 17 commits October 26, 2023 19:27
@nam20485
Bump docker/build-push-action from 2.10.0 to 5.0.0 (#85)
98859e6 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps
[docker/build-push-action](https://github.com/docker/build-push-action)
from 2.10.0 to 5.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/build-push-action/releases">docker/build-push-action's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<ul>
<li>Node 20 as default runtime (requires <a
href="https://github.com/actions/runner/releases/tag/v2.308.0">Actions
Runner v2.308.0</a> or later) by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/954">docker/build-push-action#954</a></li>
<li>Bump <code>@​actions/core</code> from 1.10.0 to 1.10.1 in <a
href="https://redirect.github.com/docker/build-push-action/pull/959">docker/build-push-action#959</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v4.2.1...v5.0.0">https://github.com/docker/build-push-action/compare/v4.2.1...v5.0.0</a></p>
<h2>v4.2.1</h2>
<blockquote>
<p><strong>Note</strong></p>
<p>Buildx v0.10 enables support for a minimal <a
href="https://slsa.dev/provenance/">SLSA Provenance</a> attestation,
which requires support for <a
href="https://github.com/opencontainers/image-spec">OCI-compliant</a>
multi-platform images. This may introduce issues with registry and
runtime support (e.g. <a
href="https://redirect.github.com/docker/buildx/issues/1533">Google
Cloud Run and AWS Lambda</a>). You can optionally disable the default
provenance attestation functionality using <code>provenance:
false</code>.</p>
</blockquote>
<ul>
<li>warn if docker config can't be parsed by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/957">docker/build-push-action#957</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v4.2.0...v4.2.1">https://github.com/docker/build-push-action/compare/v4.2.0...v4.2.1</a></p>
<h2>v4.2.0</h2>
<blockquote>
<p><strong>Note</strong></p>
<p>Buildx v0.10 enables support for a minimal <a
href="https://slsa.dev/provenance/">SLSA Provenance</a> attestation,
which requires support for <a
href="https://github.com/opencontainers/image-spec">OCI-compliant</a>
multi-platform images. This may introduce issues with registry and
runtime support (e.g. <a
href="https://redirect.github.com/docker/buildx/issues/1533">Google
Cloud Run and AWS Lambda</a>). You can optionally disable the default
provenance attestation functionality using <code>provenance:
false</code>.</p>
</blockquote>
<ul>
<li>display proxy configuration by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/872">docker/build-push-action#872</a></li>
<li>chore(deps): Bump <code>@​docker/actions-toolkit</code> from 0.6.0
to 0.8.0 in <a
href="https://redirect.github.com/docker/build-push-action/pull/930">docker/build-push-action#930</a></li>
<li>chore(deps): Bump word-wrap from 1.2.3 to 1.2.5 in <a
href="https://redirect.github.com/docker/build-push-action/pull/925">docker/build-push-action#925</a></li>
<li>chore(deps): Bump semver from 6.3.0 to 6.3.1 in <a
href="https://redirect.github.com/docker/build-push-action/pull/902">docker/build-push-action#902</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v4.1.1...v4.2.0">https://github.com/docker/build-push-action/compare/v4.1.1...v4.2.0</a></p>
<h2>v4.1.1</h2>
<blockquote>
<p><strong>Note</strong></p>
<p>Buildx v0.10 enables support for a minimal <a
href="https://slsa.dev/provenance/">SLSA Provenance</a> attestation,
which requires support for <a
href="https://github.com/opencontainers/image-spec">OCI-compliant</a>
multi-platform images. This may introduce issues with registry and
runtime support (e.g. <a
href="https://redirect.github.com/docker/buildx/issues/1533">Google
Cloud Run and AWS Lambda</a>). You can optionally disable the default
provenance attestation functionality using <code>provenance:
false</code>.</p>
</blockquote>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.3.0 to 0.5.0 by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/880">docker/build-push-action#880</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v4.1.0...v4.1.1">https://github.com/docker/build-push-action/compare/v4.1.0...v4.1.1</a></p>
<h2>v4.1.0</h2>
<blockquote>
<p><strong>Note</strong></p>
<p>Buildx v0.10 enables support for a minimal <a
href="https://slsa.dev/provenance/">SLSA Provenance</a> attestation,
which requires support for <a
href="https://github.com/opencontainers/image-spec">OCI-compliant</a>
multi-platform images. This may introduce issues with registry and
runtime support (e.g. <a
href="https://redirect.github.com/docker/buildx/issues/1533">Google
Cloud Run and AWS Lambda</a>). You can optionally disable the default
provenance attestation functionality using <code>provenance:
false</code>.</p>
</blockquote>
<ul>
<li>Switch to actions-toolkit implementation by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/811">docker/build-push-action#811</a>
<a
href="https://redirect.github.com/docker/build-push-action/pull/838">docker/build-push-action#838</a>
<a
href="https://redirect.github.com/docker/build-push-action/pull/855">docker/build-push-action#855</a>
<a
href="https://redirect.github.com/docker/build-push-action/pull/860">docker/build-push-action#860</a>
<a
href="https://redirect.github.com/docker/build-push-action/pull/875">docker/build-push-action#875</a></li>
<li>e2e: quay.io by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/799">docker/build-push-action#799</a>
<a
href="https://redirect.github.com/docker/build-push-action/pull/805">docker/build-push-action#805</a></li>
<li>e2e: local harbor and nexus by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/800">docker/build-push-action#800</a></li>
<li>e2e: add artifactory container registry to test against by <a
href="https://github.com/jedevc"><code>@​jedevc</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/804">docker/build-push-action#804</a></li>
<li>e2e: add distribution tests by <a
href="https://github.com/jedevc"><code>@​jedevc</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/814">docker/build-push-action#814</a>
<a
href="https://redirect.github.com/docker/build-push-action/pull/815">docker/build-push-action#815</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v4.0.0...v4.1.0">https://github.com/docker/build-push-action/compare/v4.0.0...v4.1.0</a></p>
<h2>v4.0.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/build-push-action/commit/0565240e2d4ab88bba5387d719585280857ece09"><code>0565240</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/959">#959</a>
from docker/dependabot/npm_and_yarn/actions/core-1.10.1</li>
<li><a
href="https://github.com/docker/build-push-action/commit/3ab07f880128dd3b47d7764b661d608b1e37712a"><code>3ab07f8</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/b9e7e4daec1dd1fed28b226354d2eef8aa92ca38"><code>b9e7e4d</code></a>
chore(deps): Bump <code>@​actions/core</code> from 1.10.0 to 1.10.1</li>
<li><a
href="https://github.com/docker/build-push-action/commit/04d1a3b0491bb1fbd0843d1fea3390e385bf2252"><code>04d1a3b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/954">#954</a>
from crazy-max/update-node20</li>
<li><a
href="https://github.com/docker/build-push-action/commit/1a4d1a13fb219ebf616f93930a8c4c6a9ff24155"><code>1a4d1a1</code></a>
chore: node 20 as default runtime</li>
<li><a
href="https://github.com/docker/build-push-action/commit/675965c0e16f1a0f94ecafff969d8c966f92c17b"><code>675965c</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/58ee34cb6bad9fc3b471453afb4ed741cb0e6ff3"><code>58ee34c</code></a>
chore: fix author in package.json</li>
<li><a
href="https://github.com/docker/build-push-action/commit/c97c4060bdc51e97b1b2a972eab2f77d6ae8e57a"><code>c97c406</code></a>
fix ProxyConfig type when checking length</li>
<li><a
href="https://github.com/docker/build-push-action/commit/47d5369e0b15ff3b951d5787a265fbecf0fc2bac"><code>47d5369</code></a>
vendor: bump <code>@​docker/actions-toolkit</code> from 0.8.0 to
0.12.0</li>
<li><a
href="https://github.com/docker/build-push-action/commit/8895c7468fbe88881dcc4c5b416553e604722cf2"><code>8895c74</code></a>
chore: update dev dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/build-push-action/compare/ac9327eae2b366085ac7f6a2d02df8aa8ead720a...0565240e2d4ab88bba5387d719585280857ece09">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/build-push-action&package-manager=github_actions&previous-version=2.10.0&new-version=5.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@dependabot
Bump ilammy/msvc-dev-cmd from 1.12.0 to 1.12.1
f941fea 
Bumps [ilammy/msvc-dev-cmd](https://github.com/ilammy/msvc-dev-cmd) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/ilammy/msvc-dev-cmd/releases)
- [Commits](ilammy/msvc-dev-cmd@7315a94...cec98b9)

---
updated-dependencies:
- dependency-name: ilammy/msvc-dev-cmd
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@nam20485
Bump ilammy/msvc-dev-cmd from 1.12.0 to 1.12.1 (#84)
5b48838 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [ilammy/msvc-dev-cmd](https://github.com/ilammy/msvc-dev-cmd) from
1.12.0 to 1.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ilammy/msvc-dev-cmd/releases">ilammy/msvc-dev-cmd's
releases</a>.</em></p>
<blockquote>
<h2>msvc-dev-cmd v1.12.1</h2>
<ul>
<li>Bump <code>@actions/core</code> to 1.10.0 (<a
href="https://redirect.github.com/ilammy/msvc-dev-cmd/pull/62">#62</a>)</li>
</ul>
<p>Thanks to <a
href="https://github.com/Simran-B"><code>@​Simran-B</code></a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ilammy/msvc-dev-cmd/commit/cec98b9d092141f74527d0afa6feb2af698cfe89"><code>cec98b9</code></a>
msvc-dev-cmd v1.12.1</li>
<li><a
href="https://github.com/ilammy/msvc-dev-cmd/commit/bba535b3febaff0dc5acaa23eca66da3024e6e24"><code>bba535b</code></a>
Bump <code>@​actions/core</code> to 1.10.0 (<a
href="https://redirect.github.com/ilammy/msvc-dev-cmd/issues/62">#62</a>)</li>
<li><a
href="https://github.com/ilammy/msvc-dev-cmd/commit/674ff850cbd739c402260838fa45b7114f750570"><code>674ff85</code></a>
Have &quot;Release&quot; job test <code>release/v1</code> branch (<a
href="https://redirect.github.com/ilammy/msvc-dev-cmd/issues/61">#61</a>)</li>
<li><a
href="https://github.com/ilammy/msvc-dev-cmd/commit/f57be51deefa14a6df9e6b949b71bed9e5d9abff"><code>f57be51</code></a>
Bump to 1.13.0-dev</li>
<li>See full diff in <a
href="https://github.com/ilammy/msvc-dev-cmd/compare/7315a94840631165970262a99c72cfb48a65d25d...cec98b9d092141f74527d0afa6feb2af698cfe89">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ilammy/msvc-dev-cmd&package-manager=github_actions&previous-version=1.12.0&new-version=1.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@nam20485
pin base image tags to shas in dockerfiles
fb5f074
@nam20485
Merge branch 'development' of github.com:nam20485/OdbDesign into deve…
2abad09 
…lopment
@nam20485
descend into directory before pip install'ing requirements.txt to see…
6cea070 
… if it fixes scorecard flagging it as non-pinned dependencies
@nam20485
comment out pip install command in python Dockerfile
443b056
@nam20485
use pip-compile to generate hashes for python dependencies in require…
324ba0d 
…ments.txt
@nam20485
uncomment final image build in python Dockerfile
7fdd894
@nam20485
create sha256sum's for binaries and upload them as release assets
f2272f9
@nam20485
import GPG key and create signature binary release assets
0014526
@dependabot
Bump github/codeql-action from 2.22.4 to 2.22.5
80c6457 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.4 to 2.22.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@49abf0b...74483a3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@step-security-bot
[StepSecurity] Apply security best practices
6d0d808 
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@nam20485
[StepSecurity] Apply security best practices (#92)
d9bfaa0 
## Summary

This pull request is created by
[StepSecurity](https://app.stepsecurity.io/securerepo) at the request of
@nam20485. Please merge the Pull Request to incorporate the requested
changes. Please tag @nam20485 on your message if you have any questions
related to the PR.
## Security Fixes

### Pinned Dependencies

GitHub Action tags and Docker tags are mutatble. This poses a security
risk. GitHub's Security Hardening guide recommends pinning actions to
full length commit.

- [GitHub Security
Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies)
### Keeping your actions up to date with Dependabot

With Dependabot version updates, when Dependabot identifies an outdated
dependency, it raises a pull request to update the manifest to the
latest version of the dependency. This is recommended by GitHub as well
as The Open Source Security Foundation (OpenSSF).

- [GitHub Security
Guide](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool)


## Feedback
For bug reports, feature requests, and general feedback; please email
support@stepsecurity.io. To create such PRs, please visit
https://app.stepsecurity.io/securerepo.


Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@nam20485
Bump github/codeql-action from 2.22.4 to 2.22.5 (#90)
6946cd0 
Bumps [github/codeql-action](https://github.com/github/codeql-action)
from 2.22.4 to 2.22.5.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>2.22.5 - 27 Oct 2023</h2>
<p>No user facing changes.</p>
<h2>2.22.4 - 20 Oct 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.15.1. <a
href="https://redirect.github.com/github/codeql-action/pull/1953">#1953</a></li>
<li>Users will begin to see warnings on Node.js 16 deprecation in their
Actions logs on code scanning runs starting October 23, 2023.
<ul>
<li>All code scanning workflows should continue to succeed regardless of
the warning.</li>
<li>The team at GitHub maintaining the CodeQL Action is aware of the
deprecation timeline and actively working on creating another version of
the CodeQL Action, v3, that will bump us to Node 20.</li>
<li>For more information, and to communicate with the maintaining team,
please use <a
href="https://redirect.github.com/github/codeql-action/issues/1959">this
issue</a>.</li>
</ul>
</li>
</ul>
<h2>2.22.3 - 13 Oct 2023</h2>
<ul>
<li>Provide an authentication token when downloading the CodeQL Bundle
from the API of a GitHub Enterprise Server instance. <a
href="https://redirect.github.com/github/codeql-action/pull/1945">#1945</a></li>
</ul>
<h2>2.22.2 - 12 Oct 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.15.0. <a
href="https://redirect.github.com/github/codeql-action/pull/1938">#1938</a></li>
<li>Improve the log output when an error occurs in an invocation of the
CodeQL CLI. <a
href="https://redirect.github.com/github/codeql-action/pull/1927">#1927</a></li>
</ul>
<h2>2.22.1 - 09 Oct 2023</h2>
<ul>
<li>Add a workaround for Python 3.12, which is not supported in CodeQL
CLI version 2.14.6 or earlier. If you are running an analysis on Windows
and using Python 3.12 or later, the CodeQL Action will switch to running
Python 3.11. In this case, if Python 3.11 is not found, then the
workflow will fail. <a
href="https://redirect.github.com/github/codeql-action/pull/1928">#1928</a></li>
</ul>
<h2>2.22.0 - 06 Oct 2023</h2>
<ul>
<li>The CodeQL Action now requires CodeQL version 2.10.5 or later. For
more information, see the corresponding changelog entry for CodeQL
Action version 2.21.8. <a
href="https://redirect.github.com/github/codeql-action/pull/1907">#1907</a></li>
<li>The CodeQL Action no longer runs ML-powered queries. For more
information, including details on our investment in AI-powered security
technology, see <a
href="https://github.blog/changelog/2023-09-29-codeql-code-scanning-deprecates-ml-powered-alerts/">&quot;CodeQL
code scanning deprecates ML-powered alerts.&quot;</a> <a
href="https://redirect.github.com/github/codeql-action/pull/1910">#1910</a></li>
<li>Fix a bug which prevented tracing of projects using Go 1.21 and
above on Linux. <a
href="https://redirect.github.com/github/codeql-action/pull/1909">#1909</a></li>
</ul>
<h2>2.21.9 - 27 Sep 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.14.6. <a
href="https://redirect.github.com/github/codeql-action/pull/1897">#1897</a></li>
<li>We are rolling out a feature in October 2023 that will improve the
success rate of C/C++ autobuild. <a
href="https://redirect.github.com/github/codeql-action/pull/1889">#1889</a></li>
<li>We are rolling out a feature in October 2023 that will provide
specific file coverage information for C and C++, Java and Kotlin, and
JavaScript and TypeScript. Currently file coverage information for each
of these pairs of languages is grouped together. <a
href="https://redirect.github.com/github/codeql-action/pull/1903">#1903</a></li>
<li>Add a warning to help customers avoid inadvertently analyzing the
same CodeQL language in multiple matrix jobs. <a
href="https://redirect.github.com/github/codeql-action/pull/1901">#1901</a></li>
</ul>
<h2>2.21.8 - 19 Sep 2023</h2>
<ul>
<li>Add a deprecation warning for customers using CodeQL version 2.10.4
and earlier. These versions of CodeQL were discontinued on 12 September
2023 alongside GitHub Enterprise Server 3.6, and will be unsupported by
the next minor release of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/1884">#1884</a>
<ul>
<li>If you are using one of these versions, please update to CodeQL CLI
version 2.10.5 or later. For instance, if you have specified a custom
version of the CLI using the 'tools' input to the 'init' Action, you can
remove this input to use the default version.</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/74483a38d39275f33fcff5f35b679b5ca4a26a99"><code>74483a3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/1972">#1972</a>
from github/update-v2.22.5-2d5ffa777</li>
<li><a
href="https://github.com/github/codeql-action/commit/2ba6829f2be5b94619d62b0fa920cbceb03b4c25"><code>2ba6829</code></a>
Update changelog for v2.22.5</li>
<li><a
href="https://github.com/github/codeql-action/commit/2d5ffa7773a66e73dade704e35d2d50378caddac"><code>2d5ffa7</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/1970">#1970</a>
from github/henrymercer/clean-up-init-logs</li>
<li><a
href="https://github.com/github/codeql-action/commit/14d0fa93b407a5901c543d04d95cb7f47b64da50"><code>14d0fa9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/1967">#1967</a>
from github/henrymercer/enable-features-on-ghes</li>
<li><a
href="https://github.com/github/codeql-action/commit/5744b13b669bded0635b39ab6bcfea7bd8aa81b2"><code>5744b13</code></a>
Rebuild Action</li>
<li><a
href="https://github.com/github/codeql-action/commit/f3b55862ea536f287e422fe679ff5a2d31ae22ee"><code>f3b5586</code></a>
Check out the right branch in <code>rebuild.yml</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/95c219819daf2d5528ce5e88bd18d58ed97d1550"><code>95c2198</code></a>
Add a log in the OK case</li>
<li><a
href="https://github.com/github/codeql-action/commit/e8e83c3a56bd831d3e9bf6353a799842468c8299"><code>e8e83c3</code></a>
Merge branch 'main' into henrymercer/enable-features-on-ghes</li>
<li><a
href="https://github.com/github/codeql-action/commit/c7abe9ca5f33e2f7fa03694eef40bb97815c7250"><code>c7abe9c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/1971">#1971</a>
from github/henrymercer/bot-rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/3fc281e07926297f6a1415e70999053c90c5e329"><code>3fc281e</code></a>
Add workflow to rebuild the Action on a label</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/49abf0ba24d0b7953cb586944e918a0b92074c80...74483a38d39275f33fcff5f35b679b5ca4a26a99">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=2.22.4&new-version=2.22.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@dependabot
Bump crazy-max/ghaction-import-gpg from 4.4.0 to 6.0.0
ec3a144 
Bumps [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) from 4.4.0 to 6.0.0.
- [Release notes](https://github.com/crazy-max/ghaction-import-gpg/releases)
- [Commits](crazy-max/ghaction-import-gpg@e00cb83...82a020f)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-import-gpg
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@nam20485
Merge branch 'development' into dependabot/github_actions/crazy-max/g…
56f1dcb 
…haction-import-gpg-6.0.0
@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 28, 2023
View reviewed changes
Dockerfile_PyOdbDesignServer
@@ -60,7 +59,8 @@
python3-dev \
python3-pip

RUN python3 -m pip install -r /PyOdbDesignServer/requirements.txt --break-system-packages
WORKDIR /PyOdbDesignServer
RUN python3 -m pip install -r requirements.txt --break-system-packages

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 9: pipCommand not pinned by hash
Click Remediation section below to solve this issue
@github-actions
Copy link

github-actions bot commented Oct 28, 2023 •
edited
Loading

Outdated

🔍 Vulnerabilities of nam20485/odbdesign:pr-94

📦 Image Reference nam20485/odbdesign:pr-94
digestsha256:dd76ec5bb458d0fded4f2f5eea6722d8c084269171af3c02cd134f5a83e7a527
vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
platformlinux/amd64
size39 MB
packages126
📦 Base Image debian:12-slim
also known as
  • 12.2-slim
  • bookworm-20231009-slim
  • bookworm-slim
digestsha256:ceffa8e71bafc0190f915774b9696a0b6cb6262d1df5f64028b570ca4055ba83
vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
critical: 1 high: 0 medium: 0 low: 0 zlib 1:1.2.13.dfsg-1 (deb)

pkg:deb/debian/zlib@1:1.2.13.dfsg-1?os_distro=bookworm&os_name=debian&os_version=12

critical : CVE--2023--45853

Affected range>=1:1.2.13.dfsg-1
Fixed versionNot Fixed
Description

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product.

critical: 0 high: 0 medium: 0 low: 2 perl 5.36.0-7 (deb)

pkg:deb/debian/perl@5.36.0-7?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--31486

Affected range>=5.36.0-7
Fixed versionNot Fixed
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

low : CVE--2011--4116

Affected range>=5.36.0-7
Fixed versionNot Fixed
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 0 low: 2 glibc 2.36-9+deb12u3 (deb)

pkg:deb/debian/glibc@2.36-9+deb12u3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--20796

Affected range>=2.36-9+deb12u2
Fixed versionNot Fixed
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

low : CVE--2010--4756

Affected range>=2.36-9+deb12u2
Fixed versionNot Fixed
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

critical: 0 high: 0 medium: 0 low: 2 tar 1.34+dfsg-1.2 (deb)

pkg:deb/debian/tar@1.34+dfsg-1.2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--48303

Affected range>=1.34+dfsg-1.2
Fixed versionNot Fixed
Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

low : CVE--2005--2541

Affected range>=1.34+dfsg-1.2
Fixed versionNot Fixed
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

critical: 0 high: 0 medium: 0 low: 2 shadow 1:4.13+dfsg1-1 (deb)

pkg:deb/debian/shadow@1:4.13+dfsg1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2019--19882

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).

low : CVE--2007--5686

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

critical: 0 high: 0 medium: 0 low: 1 systemd 252.17-1~deb12u1 (deb)

pkg:deb/debian/systemd@252.17-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2013--4392

Affected range>=252.17-1~deb12u1
Fixed versionNot Fixed
Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.38.1-5+b1 (deb)

pkg:deb/debian/util-linux@2.38.1-5+b1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--0563

Affected range>=2.38.1-5
Fixed versionNot Fixed
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 apt 2.6.1 (deb)

pkg:deb/debian/apt@2.6.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3374

Affected range>=2.6.1
Fixed versionNot Fixed
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.38.1-5 (deb)

pkg:deb/debian/util-linux@2.38.1-5?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--0563

Affected range>=2.38.1-5
Fixed versionNot Fixed
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 libgcrypt20 1.10.1-3 (deb)

pkg:deb/debian/libgcrypt20@1.10.1-3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--6829

Affected range>=1.10.1-3
Fixed versionNot Fixed
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.2.40-1.1 (deb)

pkg:deb/debian/gnupg2@2.2.40-1.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--3219

Affected range>=2.2.40-1.1
Fixed versionNot Fixed
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.7.9-2 (deb)

pkg:deb/debian/gnutls28@3.7.9-2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3389

Affected range>=3.7.9-2
Fixed versionNot Fixed
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

critical: 0 high: 0 medium: 0 low: 1 coreutils 9.1-1 (deb)

pkg:deb/debian/coreutils@9.1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2017--18018

Affected range>=9.1-1
Fixed versionNot Fixed
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 1 gcc-12 12.2.0-14 (deb)

pkg:deb/debian/gcc-12@12.2.0-14?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--27943

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

@github-actions
Copy link

github-actions bot commented Oct 28, 2023 •
edited
Loading

Outdated

Recommended fixes for image nam20485/odbdesign:pr-94

Base image is debian:12-slim

Namebookworm-20231009-slim
Digestsha256:ceffa8e71bafc0190f915774b9696a0b6cb6262d1df5f64028b570ca4055ba83
Vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
Pushed2 weeks ago
Size29 MB
Packages126
Flavordebian
OS12
Slim✅
The base image is also available under the supported tag(s): 12.2-slim, bookworm-20231009-slim, bookworm-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
stable-slim
Tag is preferred tag
Also known as:
  • stable-20231009-slim
 Benefits:
  • Same OS detected
  • Tag is preferred tag
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • Tag is using slim variant
  • stable-slim was pulled 46K times last month
Image details:
  • Size: 29 MB
  • Flavor: debian
  • OS: 11
  • Slim: ✅
 2 weeks ago



12
Tag is latest
Also known as:
  • 12.2
  • bookworm
  • bookworm-20231009
  • latest
 Benefits:
  • Same OS detected
  • Tag is latest
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 50 MB
  • Flavor: debian
  • OS: 12
 2 weeks ago



@github-actions
Copy link

github-actions bot commented Oct 28, 2023 •
edited
Loading

Overview

Image reference ghcr.io/nam20485/odbdesign:main-latest nam20485/odbdesign:pr-94
- digest bf20aa28a478 68005e486f23
- provenance 77064eb 54762ee
- vulnerabilities critical: 1 high: 0 medium: 0 low: 17 critical: 1 high: 0 medium: 0 low: 17
- platform linux/amd64 linux/amd64
- size 35 MB 39 MB (+4.3 MB)
- packages 126 126
Base Image debian:12-slim
also known as:
• 12.2-slim
• bookworm-20231009-slim
• bookworm-slim		 debian:12-slim
also known as:
• 12.2-slim
• bookworm-20231009-slim
• bookworm-slim
- vulnerabilities critical: 1 high: 0 medium: 0 low: 17 critical: 1 high: 0 medium: 0 low: 17
Labels (3 changes)
  • ± 3 changed
  • 6 unchanged
 org.opencontainers.image.authors=https://github.com/nam20485
-org.opencontainers.image.created=2023-10-25T01:19:09.529Z
+org.opencontainers.image.created=2023-10-28T13:33:56.448Z
 org.opencontainers.image.description=A free open source cross-platform C++ library for parsing ODB++ Design archives, accessing their data, and building net list product models. Exposed via a REST API and packaged inside of a Docker image.
 org.opencontainers.image.licenses=MIT
-org.opencontainers.image.revision=77064ebbbddee984c7f5fdf882d6d0be10f2878c
+org.opencontainers.image.revision=54762ee9eb0fab66586e651abc3da9a33df4dc41
 org.opencontainers.image.source=https://github.com/nam20485/OdbDesign
 org.opencontainers.image.title=OdbDesign
 org.opencontainers.image.url=https://github.com/nam20485/OdbDesign
-org.opencontainers.image.version=main-288
+org.opencontainers.image.version=pr-94

@nam20485
Bump crazy-max/ghaction-import-gpg from 4.4.0 to 6.0.0 (#93)
e647764 
Bumps
[crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg)
from 4.4.0 to 6.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/crazy-max/ghaction-import-gpg/releases">crazy-max/ghaction-import-gpg's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<ul>
<li>Node 20 as default runtime (requires <a
href="https://github.com/actions/runner/releases/tag/v2.308.0">Actions
Runner v2.308.0</a> or later) by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/183">crazy-max/ghaction-import-gpg#183</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/crazy-max/ghaction-import-gpg/compare/v5.4.0...v6.0.0">https://github.com/crazy-max/ghaction-import-gpg/compare/v5.4.0...v6.0.0</a></p>
<h2>v5.4.0</h2>
<ul>
<li>Fallback to gpg homedir if <code>HOME</code> not set by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/181">crazy-max/ghaction-import-gpg#181</a></li>
<li>Bump openpgp from 5.8.0 to 5.10.1 in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/177">crazy-max/ghaction-import-gpg#177</a>
<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/171">crazy-max/ghaction-import-gpg#171</a></li>
<li>Bump semver from 6.3.0 to 6.3.1 in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/174">crazy-max/ghaction-import-gpg#174</a></li>
<li>Bump word-wrap from 1.2.3 to 1.2.4 in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/175">crazy-max/ghaction-import-gpg#175</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/crazy-max/ghaction-import-gpg/compare/v5.3.0...v5.4.0">https://github.com/crazy-max/ghaction-import-gpg/compare/v5.3.0...v5.4.0</a></p>
<h2>v5.3.0</h2>
<ul>
<li>Add <code>trust_level</code> input to set private key trust level by
<a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in
<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/168">crazy-max/ghaction-import-gpg#168</a></li>
<li>Missing <code>name</code> output to action metadata by <a
href="https://github.com/dtan4"><code>@​dtan4</code></a> in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/154">crazy-max/ghaction-import-gpg#154</a></li>
<li>Update yarn to 3.5.1 by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/165">crazy-max/ghaction-import-gpg#165</a></li>
<li>Update dev dependencies by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/167">crazy-max/ghaction-import-gpg#167</a></li>
<li>Bump openpgp from 5.5.0 to 5.8.0 in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/164">crazy-max/ghaction-import-gpg#164</a></li>
<li>Bump minimatch from 3.0.4 to 3.1.2 in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/155">crazy-max/ghaction-import-gpg#155</a></li>
<li>Bump json5 from 2.1.3 to 2.2.3 in <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/pull/157">crazy-max/ghaction-import-gpg#157</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/crazy-max/ghaction-import-gpg/compare/v5.2.0...v5.3.0">https://github.com/crazy-max/ghaction-import-gpg/compare/v5.2.0...v5.3.0</a></p>
<h2>v5.2.0</h2>
<ul>
<li>Remove <code>setOutput</code> workaround by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> (<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/152">#152</a>)</li>
<li>Bump <code>@​actions/core</code> from 1.9.0 to 1.10.0 (<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/147">#147</a>
<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/151">#151</a>)</li>
<li>Bump openpgp from 5.3.1 to 5.5.0 (<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/149">#149</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/crazy-max/ghaction-import-gpg/compare/v5.1.0...v5.2.0">https://github.com/crazy-max/ghaction-import-gpg/compare/v5.1.0...v5.2.0</a></p>
<h2>v5.1.0</h2>
<ul>
<li>Bump openpgp from 5.2.1 to 5.3.1 (<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/145">#145</a>)</li>
<li>Bump <code>@​actions/core</code> from 1.6.0 to 1.9.0 (<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/143">#143</a>)</li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Node 16 as default runtime (<a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/136">#136</a>)
<ul>
<li>This requires a minimum <a
href="https://github.com/actions/runner/releases/tag/v2.285.0">Actions
Runner</a> version of v2.285.0, which is by default available in GHES
3.4 or later.</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/82a020f1f7f605c65dd2449b392a52c3fcfef7ef"><code>82a020f</code></a>
Merge pull request <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/182">#182</a>
from crazy-max/dependabot/github_actions/actions/chec...</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/7ad3b9b075d7e4c94cc45f12f73edcc115c64652"><code>7ad3b9b</code></a>
Merge pull request <a
href="https://redirect.github.com/crazy-max/ghaction-import-gpg/issues/183">#183</a>
from crazy-max/update-node20</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/40ca14fdc2215474855e51f743cf08683c74be74"><code>40ca14f</code></a>
chore: node 20 as default runtime</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/418bb95bb7aaf74c1b37823e17f12eb304babae2"><code>418bb95</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/ecf7766ee2d646b498860c4d575b59bdb722c031"><code>ecf7766</code></a>
chore: update dev dependencies</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/d3591c7a658826fcccb9bd6d764b19325adf79d5"><code>d3591c7</code></a>
chore: update to node 20</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/255def40cc5a37d7d2b8517d2a24ec91c1d3b20b"><code>255def4</code></a>
chore: update yarn to 3.6.3</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/3a0627944a3bc77987f2860d7434fba20280ffa3"><code>3a06279</code></a>
codecov: update config</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/c0d46203bf82f5d7efaa4c47ddfff570eb5f7746"><code>c0d4620</code></a>
codecov: update config</li>
<li><a
href="https://github.com/crazy-max/ghaction-import-gpg/commit/f30daee9c1f2eeb76089d0baa4df925f58ce500a"><code>f30daee</code></a>
Bump actions/checkout from 3 to 4</li>
<li>Additional commits viewable in <a
href="https://github.com/crazy-max/ghaction-import-gpg/compare/e00cb83a68c1158b29afc5217dd0582cada6d172...82a020f1f7f605c65dd2449b392a52c3fcfef7ef">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=crazy-max/ghaction-import-gpg&package-manager=github_actions&previous-version=4.4.0&new-version=6.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@nam20485
comment out paths field in CodeQL config, its only used when scanning…
ae1334a 
… interpreted languages (i.e. not C++)
@github-actions
Copy link

github-actions bot commented Oct 28, 2023 •
edited
Loading

Outdated

🔍 Vulnerabilities of nam20485/odbdesign:pr-94

📦 Image Reference nam20485/odbdesign:pr-94
digestsha256:162125b7e6eef27f92b27f21ea5b022f3fb11c22f77660e19b3d34fe9912c8b7
vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
platformlinux/amd64
size39 MB
packages126
📦 Base Image debian:12-slim
also known as
  • 12.2-slim
  • bookworm-20231009-slim
  • bookworm-slim
digestsha256:ceffa8e71bafc0190f915774b9696a0b6cb6262d1df5f64028b570ca4055ba83
vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
critical: 1 high: 0 medium: 0 low: 0 zlib 1:1.2.13.dfsg-1 (deb)

pkg:deb/debian/zlib@1:1.2.13.dfsg-1?os_distro=bookworm&os_name=debian&os_version=12

critical : CVE--2023--45853

Affected range>=1:1.2.13.dfsg-1
Fixed versionNot Fixed
Description

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product.

critical: 0 high: 0 medium: 0 low: 2 perl 5.36.0-7 (deb)

pkg:deb/debian/perl@5.36.0-7?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--31486

Affected range>=5.36.0-7
Fixed versionNot Fixed
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

low : CVE--2011--4116

Affected range>=5.36.0-7
Fixed versionNot Fixed
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 0 low: 2 shadow 1:4.13+dfsg1-1 (deb)

pkg:deb/debian/shadow@1:4.13+dfsg1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2019--19882

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).

low : CVE--2007--5686

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

critical: 0 high: 0 medium: 0 low: 2 tar 1.34+dfsg-1.2 (deb)

pkg:deb/debian/tar@1.34+dfsg-1.2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--48303

Affected range>=1.34+dfsg-1.2
Fixed versionNot Fixed
Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

low : CVE--2005--2541

Affected range>=1.34+dfsg-1.2
Fixed versionNot Fixed
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

critical: 0 high: 0 medium: 0 low: 2 glibc 2.36-9+deb12u3 (deb)

pkg:deb/debian/glibc@2.36-9+deb12u3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--20796

Affected range>=2.36-9+deb12u2
Fixed versionNot Fixed
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

low : CVE--2010--4756

Affected range>=2.36-9+deb12u2
Fixed versionNot Fixed
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.38.1-5+b1 (deb)

pkg:deb/debian/util-linux@2.38.1-5+b1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--0563

Affected range>=2.38.1-5
Fixed versionNot Fixed
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 gcc-12 12.2.0-14 (deb)

pkg:deb/debian/gcc-12@12.2.0-14?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--27943

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.38.1-5 (deb)

pkg:deb/debian/util-linux@2.38.1-5?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--0563

Affected range>=2.38.1-5
Fixed versionNot Fixed
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.2.40-1.1 (deb)

pkg:deb/debian/gnupg2@2.2.40-1.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--3219

Affected range>=2.2.40-1.1
Fixed versionNot Fixed
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

critical: 0 high: 0 medium: 0 low: 1 coreutils 9.1-1 (deb)

pkg:deb/debian/coreutils@9.1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2017--18018

Affected range>=9.1-1
Fixed versionNot Fixed
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.7.9-2 (deb)

pkg:deb/debian/gnutls28@3.7.9-2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3389

Affected range>=3.7.9-2
Fixed versionNot Fixed
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

critical: 0 high: 0 medium: 0 low: 1 libgcrypt20 1.10.1-3 (deb)

pkg:deb/debian/libgcrypt20@1.10.1-3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--6829

Affected range>=1.10.1-3
Fixed versionNot Fixed
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 1 systemd 252.17-1~deb12u1 (deb)

pkg:deb/debian/systemd@252.17-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2013--4392

Affected range>=252.17-1~deb12u1
Fixed versionNot Fixed
Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

critical: 0 high: 0 medium: 0 low: 1 apt 2.6.1 (deb)

pkg:deb/debian/apt@2.6.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3374

Affected range>=2.6.1
Fixed versionNot Fixed
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

@github-actions
Copy link

github-actions bot commented Oct 28, 2023 •
edited
Loading

Outdated

Recommended fixes for image nam20485/odbdesign:pr-94

Base image is debian:12-slim

Namebookworm-20231009-slim
Digestsha256:ceffa8e71bafc0190f915774b9696a0b6cb6262d1df5f64028b570ca4055ba83
Vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
Pushed2 weeks ago
Size29 MB
Packages126
Flavordebian
OS12
Slim✅
The base image is also available under the supported tag(s): 12.2-slim, bookworm-20231009-slim, bookworm-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
stable-slim
Tag is preferred tag
Also known as:
  • stable-20231009-slim
 Benefits:
  • Same OS detected
  • Tag is preferred tag
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • Tag is using slim variant
  • stable-slim was pulled 46K times last month
Image details:
  • Size: 29 MB
  • Flavor: debian
  • OS: 11
  • Slim: ✅
 2 weeks ago



12
Tag is latest
Also known as:
  • 12.2
  • bookworm
  • bookworm-20231009
  • latest
 Benefits:
  • Same OS detected
  • Tag is latest
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 50 MB
  • Flavor: debian
  • OS: 12
 2 weeks ago



@github-actions
Copy link

🔍 Vulnerabilities of nam20485/odbdesign:pr-94

📦 Image Reference nam20485/odbdesign:pr-94
digestsha256:68005e486f2337f221271d0fe3c24178a973f70bb4015091d42d71f88584ee42
vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
platformlinux/amd64
size39 MB
packages126
📦 Base Image debian:12-slim
also known as
  • 12.2-slim
  • bookworm-20231009-slim
  • bookworm-slim
digestsha256:ceffa8e71bafc0190f915774b9696a0b6cb6262d1df5f64028b570ca4055ba83
vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
critical: 1 high: 0 medium: 0 low: 0 zlib 1:1.2.13.dfsg-1 (deb)

pkg:deb/debian/zlib@1:1.2.13.dfsg-1?os_distro=bookworm&os_name=debian&os_version=12

critical : CVE--2023--45853

Affected range>=1:1.2.13.dfsg-1
Fixed versionNot Fixed
Description

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product.

critical: 0 high: 0 medium: 0 low: 2 shadow 1:4.13+dfsg1-1 (deb)

pkg:deb/debian/shadow@1:4.13+dfsg1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2019--19882

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).

low : CVE--2007--5686

Affected range>=1:4.13+dfsg1-1
Fixed versionNot Fixed
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

critical: 0 high: 0 medium: 0 low: 2 tar 1.34+dfsg-1.2 (deb)

pkg:deb/debian/tar@1.34+dfsg-1.2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--48303

Affected range>=1.34+dfsg-1.2
Fixed versionNot Fixed
Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

low : CVE--2005--2541

Affected range>=1.34+dfsg-1.2
Fixed versionNot Fixed
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

critical: 0 high: 0 medium: 0 low: 2 glibc 2.36-9+deb12u3 (deb)

pkg:deb/debian/glibc@2.36-9+deb12u3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--20796

Affected range>=2.36-9+deb12u2
Fixed versionNot Fixed
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

low : CVE--2010--4756

Affected range>=2.36-9+deb12u2
Fixed versionNot Fixed
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

critical: 0 high: 0 medium: 0 low: 2 perl 5.36.0-7 (deb)

pkg:deb/debian/perl@5.36.0-7?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2023--31486

Affected range>=5.36.0-7
Fixed versionNot Fixed
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

low : CVE--2011--4116

Affected range>=5.36.0-7
Fixed versionNot Fixed
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.7.9-2 (deb)

pkg:deb/debian/gnutls28@3.7.9-2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3389

Affected range>=3.7.9-2
Fixed versionNot Fixed
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

critical: 0 high: 0 medium: 0 low: 1 gcc-12 12.2.0-14 (deb)

pkg:deb/debian/gcc-12@12.2.0-14?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--27943

Affected range>=12.2.0-14
Fixed versionNot Fixed
Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

critical: 0 high: 0 medium: 0 low: 1 coreutils 9.1-1 (deb)

pkg:deb/debian/coreutils@9.1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2017--18018

Affected range>=9.1-1
Fixed versionNot Fixed
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.2.40-1.1 (deb)

pkg:deb/debian/gnupg2@2.2.40-1.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--3219

Affected range>=2.2.40-1.1
Fixed versionNot Fixed
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.38.1-5 (deb)

pkg:deb/debian/util-linux@2.38.1-5?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--0563

Affected range>=2.38.1-5
Fixed versionNot Fixed
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 libgcrypt20 1.10.1-3 (deb)

pkg:deb/debian/libgcrypt20@1.10.1-3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2018--6829

Affected range>=1.10.1-3
Fixed versionNot Fixed
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 1 systemd 252.17-1~deb12u1 (deb)

pkg:deb/debian/systemd@252.17-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2013--4392

Affected range>=252.17-1~deb12u1
Fixed versionNot Fixed
Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.38.1-5+b1 (deb)

pkg:deb/debian/util-linux@2.38.1-5+b1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--0563

Affected range>=2.38.1-5
Fixed versionNot Fixed
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 apt 2.6.1 (deb)

pkg:deb/debian/apt@2.6.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3374

Affected range>=2.6.1
Fixed versionNot Fixed
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

@github-actions
Copy link

Recommended fixes for image nam20485/odbdesign:pr-94

Base image is debian:12-slim

Namebookworm-20231009-slim
Digestsha256:ceffa8e71bafc0190f915774b9696a0b6cb6262d1df5f64028b570ca4055ba83
Vulnerabilitiescritical: 1 high: 0 medium: 0 low: 17
Pushed2 weeks ago
Size29 MB
Packages126
Flavordebian
OS12
Slim✅
The base image is also available under the supported tag(s): 12.2-slim, bookworm-20231009-slim, bookworm-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

TagDetailsPushedVulnerabilities
stable-slim
Tag is preferred tag
Also known as:
  • stable-20231009-slim
 Benefits:
  • Same OS detected
  • Tag is preferred tag
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • Tag is using slim variant
  • stable-slim was pulled 46K times last month
Image details:
  • Size: 29 MB
  • Flavor: debian
  • OS: 11
  • Slim: ✅
 2 weeks ago



12
Tag is latest
Also known as:
  • 12.2
  • bookworm
  • bookworm-20231009
  • latest
 Benefits:
  • Same OS detected
  • Tag is latest
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
Image details:
  • Size: 50 MB
  • Flavor: debian
  • OS: 12
 2 weeks ago



@nam20485 nam20485 merged commit f7e878f into main Oct 28, 2023
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@nam20485 @step-security-bot