chore(deps): update all non-major dependencies

This PR contains the following updates:

Package	Type	Update	Change
GoogleCloudPlatform/functions-framework-conformance	action	patch	`v1.8.2` -> `v1.8.5`
actions/checkout	action	minor	`v3.5.2` -> `v3.6.0`
actions/setup-go	action	minor	`v4.0.1` -> `v4.1.0`
actions/setup-java	action	minor	`v3.11.0` -> `v3.12.0`
github/codeql-action	action	minor	`v2.3.6` -> `v2.21.5`
ossf/scorecard-action	action	minor	`v2.1.3` -> `v2.2.0`
step-security/harden-runner	action	minor	`v2.4.0` -> `v2.5.1`
org.apache.maven.plugins:maven-shade-plugin	build	minor	`3.4.1` -> `3.5.0`
org.eclipse.jetty:jetty-client (source)	test	patch	`9.4.51.v20230217` -> `9.4.52.v20230823`
com.google.truth.extensions:truth-java8-extension	test	patch	`1.1.4` -> `1.1.5`
com.google.truth:truth	test	patch	`1.1.4` -> `1.1.5`
org.eclipse.jetty:jetty-server (source)	compile	patch	`9.4.51.v20230217` -> `9.4.52.v20230823`
org.eclipse.jetty:jetty-servlet (source)	compile	patch	`9.4.51.v20230217` -> `9.4.52.v20230823`
com.google.auto.value:auto-value-annotations (source)	provided	patch	`1.10.1` -> `1.10.4`
com.google.auto.value:auto-value (source)	provided	patch	`1.10.1` -> `1.10.4`
org.apache.maven:maven-core	compile	patch	`3.9.2` -> `3.9.4`
org.apache.maven:maven-plugin-api	compile	patch	`3.9.2` -> `3.9.4`

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the logs for more information.

Release Notes

GoogleCloudPlatform/functions-framework-conformance (GoogleCloudPlatform/functions-framework-conformance)

### [`v1.8.5`](https://togithub.com/GoogleCloudPlatform/functions-framework-conformance/releases/tag/v1.8.5) [Compare Source](https://togithub.com/GoogleCloudPlatform/functions-framework-conformance/compare/v1.8.4...v1.8.5) ##### Client - Add support for the specification of a custom builder image to use via new `-builder-url` flag. ### [`v1.8.4`](https://togithub.com/GoogleCloudPlatform/functions-framework-conformance/releases/tag/v1.8.4) [Compare Source](https://togithub.com/GoogleCloudPlatform/functions-framework-conformance/compare/v1.8.3...v1.8.4) ### Client - Adds support for specifying runtime version using the `builder-runtime-version` flag. ### [`v1.8.3`](https://togithub.com/GoogleCloudPlatform/functions-framework-conformance/releases/tag/v1.8.3) [Compare Source](https://togithub.com/GoogleCloudPlatform/functions-framework-conformance/compare/v1.8.2...v1.8.3) ### Client - Added `FUNCTION_SIGNATURE_TYPE` to the set of env vars populated at runtime.

actions/checkout (actions/checkout)

### [`v3.6.0`](https://togithub.com/actions/checkout/blob/HEAD/CHANGELOG.md#v360) [Compare Source](https://togithub.com/actions/checkout/compare/v3.5.3...v3.6.0) - [Fix: Mark test scripts with Bash'isms to be run via Bash](https://togithub.com/actions/checkout/pull/1377) - [Add option to fetch tags even if fetch-depth > 0](https://togithub.com/actions/checkout/pull/579) ### [`v3.5.3`](https://togithub.com/actions/checkout/blob/HEAD/CHANGELOG.md#v353) [Compare Source](https://togithub.com/actions/checkout/compare/v3.5.2...v3.5.3) - [Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in](https://togithub.com/actions/checkout/pull/1196) - [Fix typos found by codespell](https://togithub.com/actions/checkout/pull/1287) - [Add support for sparse checkouts](https://togithub.com/actions/checkout/pull/1369)

actions/setup-go (actions/setup-go)

### [`v4.1.0`](https://togithub.com/actions/setup-go/releases/tag/v4.1.0) [Compare Source](https://togithub.com/actions/setup-go/compare/v4.0.1...v4.1.0) ##### What's Changed In scope of this release, slow installation on Windows was fixed by [@dsame](https://togithub.com/dsame) in [https://github.com/actions/setup-go/pull/393](https://togithub.com/actions/setup-go/pull/393) and OS version was added to `primaryKey` for Ubuntu runners to avoid conflicts ([https://github.com/actions/setup-go/pull/383](https://togithub.com/actions/setup-go/pull/383)) This release also includes the following changes: - Remove implicit dependencies by [@nikolai-laevskii](https://togithub.com/nikolai-laevskii) in [https://github.com/actions/setup-go/pull/378](https://togithub.com/actions/setup-go/pull/378) - Update action.yml by [@mkelly](https://togithub.com/mkelly) in [https://github.com/actions/setup-go/pull/379](https://togithub.com/actions/setup-go/pull/379) - Added a description that go-version should be specified as a string type by [@n3xem](https://togithub.com/n3xem) in [https://github.com/actions/setup-go/pull/367](https://togithub.com/actions/setup-go/pull/367) - Add note about YAML parsing versions by [@dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [https://github.com/actions/setup-go/pull/382](https://togithub.com/actions/setup-go/pull/382) - Automatic update of configuration files from 05/23/2023 by [@github-actions](https://togithub.com/github-actions) in [https://github.com/actions/setup-go/pull/377](https://togithub.com/actions/setup-go/pull/377) - Bump tough-cookie and [@azure/ms-rest-js](https://togithub.com/azure/ms-rest-js) by [@dependabot](https://togithub.com/dependabot) in [https://github.com/actions/setup-go/pull/392](https://togithub.com/actions/setup-go/pull/392) - Bump word-wrap from 1.2.3 to 1.2.4 by [@dependabot](https://togithub.com/dependabot) in [https://github.com/actions/setup-go/pull/397](https://togithub.com/actions/setup-go/pull/397) - Bump semver from 6.3.0 to 6.3.1 by [@dependabot](https://togithub.com/dependabot) in [https://github.com/actions/setup-go/pull/396](https://togithub.com/actions/setup-go/pull/396) ##### New Contributors - [@mkelly](https://togithub.com/mkelly) made their first contribution in [https://github.com/actions/setup-go/pull/379](https://togithub.com/actions/setup-go/pull/379) - [@n3xem](https://togithub.com/n3xem) made their first contribution in [https://github.com/actions/setup-go/pull/367](https://togithub.com/actions/setup-go/pull/367) **Full Changelog**: https://github.com/actions/setup-go/compare/v4...v4.1.0

actions/setup-java (actions/setup-java)

### [`v3.12.0`](https://togithub.com/actions/setup-java/releases/tag/v3.12.0) [Compare Source](https://togithub.com/actions/setup-java/compare/v3.11.0...v3.12.0) In scope of this release the following changes were made: **Bug fixes:** - Always check postfix "Contents/Home" on macOS by [@erwin1](https://togithub.com/erwin1) in [https://github.com/actions/setup-java/pull/397](https://togithub.com/actions/setup-java/pull/397) - Fix sbt/scala cache key by [@Dogacel](https://togithub.com/Dogacel) in [https://github.com/actions/setup-java/pull/478](https://togithub.com/actions/setup-java/pull/478) - Corretto toolcache folder name fix by [@IvanZosimov](https://togithub.com/IvanZosimov) in [https://github.com/actions/setup-java/pull/480](https://togithub.com/actions/setup-java/pull/480) - Update versions of Oracle JDK and Microsoft Build of OpenJDK by [@anishi1222](https://togithub.com/anishi1222) in [https://github.com/actions/setup-java/pull/489](https://togithub.com/actions/setup-java/pull/489) - Update Oracle JDK download URL calculation by [@nikolai-laevskii](https://togithub.com/nikolai-laevskii) in [https://github.com/actions/setup-java/pull/507](https://togithub.com/actions/setup-java/pull/507) **Feature implementations:** - Add versions properties to cache by [@Endi327](https://togithub.com/Endi327) in [https://github.com/actions/setup-java/pull/280](https://togithub.com/actions/setup-java/pull/280) **Resolving dependencies issues:** - Remove implicit dependencies by [@nikolai-laevskii](https://togithub.com/nikolai-laevskii) in [https://github.com/actions/setup-java/pull/494](https://togithub.com/actions/setup-java/pull/494) - Update xml2js by [@dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [https://github.com/actions/setup-java/pull/484](https://togithub.com/actions/setup-java/pull/484) - Update dependencies by [@IvanZosimov](https://togithub.com/IvanZosimov) in [https://github.com/actions/setup-java/pull/511](https://togithub.com/actions/setup-java/pull/511) **Infrastructure updates:** - Fix glob bug in package.json scripts section by [@IvanZosimov](https://togithub.com/IvanZosimov) in [https://github.com/actions/setup-java/pull/475](https://togithub.com/actions/setup-java/pull/475) - Update mocks by [@nikolai-laevskii](https://togithub.com/nikolai-laevskii) in [https://github.com/actions/setup-java/pull/498](https://togithub.com/actions/setup-java/pull/498) **Documentation changes:** - Instruction to download custom distribution JDK and install by [@ragsmpl](https://togithub.com/ragsmpl) in [https://github.com/actions/setup-java/pull/500](https://togithub.com/actions/setup-java/pull/500) ##### New Contributors - [@erwin1](https://togithub.com/erwin1) made their first contribution in [https://github.com/actions/setup-java/pull/397](https://togithub.com/actions/setup-java/pull/397) - [@Dogacel](https://togithub.com/Dogacel) made their first contribution in [https://github.com/actions/setup-java/pull/478](https://togithub.com/actions/setup-java/pull/478) - [@anishi1222](https://togithub.com/anishi1222) made their first contribution in [https://github.com/actions/setup-java/pull/489](https://togithub.com/actions/setup-java/pull/489) - [@nikolai-laevskii](https://togithub.com/nikolai-laevskii) made their first contribution in [https://github.com/actions/setup-java/pull/498](https://togithub.com/actions/setup-java/pull/498) - [@ragsmpl](https://togithub.com/ragsmpl) made their first contribution in [https://github.com/actions/setup-java/pull/500](https://togithub.com/actions/setup-java/pull/500) - [@Endi327](https://togithub.com/Endi327) made their first contribution in [https://github.com/actions/setup-java/pull/280](https://togithub.com/actions/setup-java/pull/280) **Full Changelog**: https://github.com/actions/setup-java/compare/v3...v3.12.0

github/codeql-action (github/codeql-action)

### [`v2.21.5`](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5) ### [`v2.21.4`](https://togithub.com/github/codeql-action/compare/v2.21.3...v2.21.4) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.3...v2.21.4) ### [`v2.21.3`](https://togithub.com/github/codeql-action/compare/v2.21.2...v2.21.3) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.2...v2.21.3) ### [`v2.21.2`](https://togithub.com/github/codeql-action/compare/v2.21.1...v2.21.2) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.1...v2.21.2) ### [`v2.21.1`](https://togithub.com/github/codeql-action/compare/v2.21.0...v2.21.1) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.0...v2.21.1) ### [`v2.21.0`](https://togithub.com/github/codeql-action/compare/v2.20.4...v2.21.0) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.20.4...v2.21.0) ### [`v2.20.4`](https://togithub.com/github/codeql-action/compare/v2.20.3...v2.20.4) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.20.3...v2.20.4) ### [`v2.20.3`](https://togithub.com/github/codeql-action/compare/v2.20.2...v2.20.3) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.20.2...v2.20.3) ### [`v2.20.2`](https://togithub.com/github/codeql-action/compare/v2.20.1...v2.20.2) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.20.1...v2.20.2) ### [`v2.20.1`](https://togithub.com/github/codeql-action/compare/v2.20.0...v2.20.1) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.20.0...v2.20.1) ### [`v2.20.0`](https://togithub.com/github/codeql-action/compare/v2.3.6...v2.20.0) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.3.6...v2.20.0)

ossf/scorecard-action (ossf/scorecard-action)

### [`v2.2.0`](https://togithub.com/ossf/scorecard-action/releases/tag/v2.2.0) [Compare Source](https://togithub.com/ossf/scorecard-action/compare/v2.1.3...v2.2.0) #### What's Changed - :seedling: Bump github.com/ossf/scorecard/v4 from v4.10.5 to v4.11.0 by [@spencerschrock](https://togithub.com/spencerschrock) in [https://github.com/ossf/scorecard-action/pull/1192](https://togithub.com/ossf/scorecard-action/pull/1192) #### Scorecard Result Viewer Thanks to contributions from [@cynthia-sg](https://togithub.com/cynthia-sg) and [@tegioz](https://togithub.com/tegioz) at [CLOMonitor](https://togithub.com/cncf/clomonitor), there is a new Scorecard Result visualization page at `https://securityscorecards.dev/viewer/?uri=`. - [https://github.com/ossf/scorecard-webapp/pull/406](https://togithub.com/ossf/scorecard-webapp/pull/406) - [https://github.com/ossf/scorecard-webapp/pull/422](https://togithub.com/ossf/scorecard-webapp/pull/422) As an example, you can see our own score visualized [here](https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard) Checkout our [README](https://togithub.com/ossf/scorecard-action/blob/08b4669551908b1024bb425080c797723083c031/README.md#scorecard-badge) to learn how to link your README badge to the new visualization page. #### Publishing Results This release contains two fixes which will improve the user experience when `publish_results` is `true` - Runs that fail our [workflow restrictions](https://togithub.com/ossf/scorecard-action/blob/08b4669551908b1024bb425080c797723083c031/README.md#workflow-restrictions) will fail with a 400 response indicating the problem, instead of a vague 500 status. ([https://github.com/ossf/scorecard-action/pull/1156](https://togithub.com/ossf/scorecard-action/pull/1156), resolved [https://github.com/ossf/scorecard-action/issues/1150](https://togithub.com/ossf/scorecard-action/issues/1150)) - Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. ([https://github.com/ossf/scorecard-action/pull/1191](https://togithub.com/ossf/scorecard-action/pull/1191)) #### Docs - 📖 Update README to accept fine-grained tokens by [@pnacht](https://togithub.com/pnacht) in [https://github.com/ossf/scorecard-action/pull/1175](https://togithub.com/ossf/scorecard-action/pull/1175) - 📖 Update installation instructions to match current GitHub UI by [@joycebrum](https://togithub.com/joycebrum) in [https://github.com/ossf/scorecard-action/pull/1153](https://togithub.com/ossf/scorecard-action/pull/1153) - 📖 Document the GitHub action workflow restrictions when publishing results. by [@spencerschrock](https://togithub.com/spencerschrock) in #### New Contributors - [@bobcallaway](https://togithub.com/bobcallaway) made their first contribution in [https://github.com/ossf/scorecard-action/pull/1140](https://togithub.com/ossf/scorecard-action/pull/1140) - [@pnacht](https://togithub.com/pnacht) made their first contribution in [https://github.com/ossf/scorecard-action/pull/1175](https://togithub.com/ossf/scorecard-action/pull/1175) **Full Changelog**: https://github.com/ossf/scorecard-action/compare/v2.1.3...v2.2.0

step-security/harden-runner (step-security/harden-runner)

### [`v2.5.1`](https://togithub.com/step-security/harden-runner/releases/tag/v2.5.1) [Compare Source](https://togithub.com/step-security/harden-runner/compare/v2.5.0...v2.5.1) ##### What's Changed - Updated default allowed endpoints to include `*.actions.githubusercontent.com`. GitHub Actions recently started making calls to additional sub-domains for this domain. Please update to this latest version of harden-runner to allow these new endpoints. - Update README.md by [@varunsh-coder](https://togithub.com/varunsh-coder) in [https://github.com/step-security/harden-runner/pull/326](https://togithub.com/step-security/harden-runner/pull/326) - Bump step-security/harden-runner from 2.4.1 to 2.5.0 by [@dependabot](https://togithub.com/dependabot) in [https://github.com/step-security/harden-runner/pull/327](https://togithub.com/step-security/harden-runner/pull/327) **Full Changelog**: https://github.com/step-security/harden-runner/compare/v2...v2.5.1 ### [`v2.5.0`](https://togithub.com/step-security/harden-runner/releases/tag/v2.5.0) [Compare Source](https://togithub.com/step-security/harden-runner/compare/v2.4.1...v2.5.0) #### What's Changed Release v2.5.0 by [@h0x0er](https://togithub.com/h0x0er) and [@varunsh-coder](https://togithub.com/varunsh-coder) in [https://github.com/step-security/harden-runner/pull/325](https://togithub.com/step-security/harden-runner/pull/325) This release: 1. Adds support for Actions Runner Controller (ARC) environment 2. Improves the job summary markdown **Full Changelog**: https://github.com/step-security/harden-runner/compare/v2...v2.5.0 ### [`v2.4.1`](https://togithub.com/step-security/harden-runner/releases/tag/v2.4.1) [Compare Source](https://togithub.com/step-security/harden-runner/compare/v2.4.0...v2.4.1) ##### What's Changed Release v2.4.1 by [@varunsh-coder](https://togithub.com/varunsh-coder) and [@Devils-Knight](https://togithub.com/Devils-Knight) in [https://github.com/step-security/harden-runner/pull/309](https://togithub.com/step-security/harden-runner/pull/309) This release 1. Shows a preview of the network events in the job summary markdown 2. Uses a fallback DNS service from Cloudflare in addition to Google DNS to improve reliability **Full Changelog**: https://github.com/step-security/harden-runner/compare/v2...v2.4.1

google/truth (com.google.truth.extensions:truth-java8-extension)

### [`v1.1.5`](https://togithub.com/google/truth/releases/tag/v1.1.5): 1.1.5 [Compare Source](https://togithub.com/google/truth/compare/v1.1.4...v1.1.5) - Updated Truth to depend on [Guava 32.0.1](https://togithub.com/google/guava/releases/tag/v32.0.1). The previous Guava version, 32.0.0, contained a bug under Windows, which did not affect Truth's functionality but [could cause problems](https://togithub.com/google/truth/issues/1137) for people who use Guava's I/O functionality in their codebase. Affected users can already manually update their Guava dependency to 32.0.1, but if they don't depend directly on Guava, they may find it easier to upgrade to this new Truth release instead. - Fixed `IterableOfProtosSubject` to produce a proper failure message instead of NPE when the actual value is `null`.

Configuration

📅 Schedule: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

GoogleCloudPlatform / functions-framework-java