build(deps): bump advanced-security/maven-dependency-submission-action from 4.0.3 to 4.1.0

[dependabot[bot]]

Bumps advanced-security/maven-dependency-submission-action from 4.0.3 to 4.1.0.

Release notes

Sourced from advanced-security/maven-dependency-submission-action's releases.

v4.1.0

• Adds the ability to change the detector details for the dependency snapshots via the optional input parameters:

  • detector-name
  • detector-url
  • detector-version

  If the detector-name is specified, then all three become mandatory as there are no sensible defaults that can be attributed to the values.

Commits

• bb3f733 chore: Updating release files
• 747e676 4.1.0
• 09cc6cf Merge pull request #82 from mario-campos/patch-1
• 930cebc Adding detector settings into the CLI executables
• 828a337 Fixing audit warnings on dependencies
• 2219818 Merge pull request #86 from advanced-security/detector-input
• 97fd7ee Input to set detector information
• 1203a18 Merge pull request #85 from advanced-security/hmaurer-patch-1
• cf49e89 Delete .github/workflows/sync-fork.yml
• 5a174b1 Update sync-fork.yml
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions[bot]]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 22220eb5dd857ccbd6eb486c47aa143bb7d43ce6.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
actions/advanced-security/maven-dependency-submission-action	bb3f7338b5bd0e3b225d8082e26b7b6289e17ef3	:green_circle: 4.3	Details Check Score Reason Code-Review :warning: 0 Found 2/21 approved changesets -- score normalized to 0 Maintained :green_circle: 10 12 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices :warning: 0 no effort to earn an OpenSSF best practices badge detected License :green_circle: 10 license file detected Signed-Releases :warning: 0 Project has not signed or included provenance with any releases. Packaging :warning: -1 packaging workflow not detected Binary-Artifacts :green_circle: 9 binaries present in source code Token-Permissions :warning: 0 detected GitHub workflow tokens with excessive permissions Security-Policy :green_circle: 10 security policy file detected Dangerous-Workflow :green_circle: 10 no dangerous workflow patterns detected Branch-Protection :warning: 0 branch protection not enabled on development/release branches Pinned-Dependencies :green_circle: 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing :warning: 0 project is not fuzzed SAST :green_circle: 8 SAST tool is not run on all commits -- score normalized to 8 Vulnerabilities :warning: 0 14 existing vulnerabilities detected
actions/advanced-security/maven-dependency-submission-action	5d0f9011b55d6268922128af45275986303459c3	:green_circle: 4.3	Details Check Score Reason Code-Review :warning: 0 Found 2/21 approved changesets -- score normalized to 0 Maintained :green_circle: 10 12 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices :warning: 0 no effort to earn an OpenSSF best practices badge detected License :green_circle: 10 license file detected Signed-Releases :warning: 0 Project has not signed or included provenance with any releases. Packaging :warning: -1 packaging workflow not detected Binary-Artifacts :green_circle: 9 binaries present in source code Token-Permissions :warning: 0 detected GitHub workflow tokens with excessive permissions Security-Policy :green_circle: 10 security policy file detected Dangerous-Workflow :green_circle: 10 no dangerous workflow patterns detected Branch-Protection :warning: 0 branch protection not enabled on development/release branches Pinned-Dependencies :green_circle: 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing :warning: 0 project is not fuzzed SAST :green_circle: 8 SAST tool is not run on all commits -- score normalized to 8 Vulnerabilities :warning: 0 14 existing vulnerabilities detected

Scanned Manifest Files

.github/workflows/codeql-analysis.yml

• advanced-security/maven-dependency-submission-action@bb3f7338b5bd0e3b225d8082e26b7b6289e17ef3
• advanced-security/maven-dependency-submission-action@5d0f9011b55d6268922128af45275986303459c3

[sonarcloud[bot]]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud