Bump the action-packages group across 1 directory with 6 updates

Bumps the action-packages group with 6 updates in the / directory:

Package	From	To
actions/checkout	`3`	`4`
step-security/harden-runner	`2.7.0`	`2.7.1`
actions/dependency-review-action	`4.2.5`	`4.3.2`
ossf/scorecard-action	`2.3.1`	`2.3.3`
actions/upload-artifact	`4.3.1`	`4.3.3`
codecov/codecov-action	`4.1.1`	`4.3.1`

Updates actions/checkout from 3 to 4

Release notes

Sourced from actions/checkout's releases.

v4.0.0

What's Changed

Update default runtime to node20 by @takost in actions/checkout#1436

Support fetching without the --progress option by @simonbaird in actions/checkout#1067

Release 4.0.0 by @takost in actions/checkout#1447

New Contributors

@takost made their first contribution in actions/checkout#1436

@simonbaird made their first contribution in actions/checkout#1067

Full Changelog: https://github.com/actions/checkout/compare/v3...v4.0.0

v3.6.0

What's Changed

Mark test scripts with Bash'isms to be run via Bash by @dscho in actions/checkout#1377

Add option to fetch tags even if fetch-depth > 0 by @RobertWieczoreck in actions/checkout#579

Release 3.6.0 by @luketomlinson in actions/checkout#1437

New Contributors

@RobertWieczoreck made their first contribution in actions/checkout#579

@luketomlinson made their first contribution in actions/checkout#1437

Full Changelog: https://github.com/actions/checkout/compare/v3.5.3...v3.6.0

v3.5.3

What's Changed

Fix: Checkout Issue in self hosted runner due to faulty submodule check-ins by @megamanics in actions/checkout#1196

Fix typos found by codespell by @DimitriPapadopoulos in actions/checkout#1287

Add support for sparse checkouts by @dscho and @dfdez in actions/checkout#1369

Release v3.5.3 by @TingluoHuang in actions/checkout#1376

New Contributors

@megamanics made their first contribution in actions/checkout#1196

@DimitriPapadopoulos made their first contribution in actions/checkout#1287

@dfdez made their first contribution in actions/checkout#1369

Full Changelog: https://github.com/actions/checkout/compare/v3...v3.5.3

v3.5.2

What's Changed

Fix: Use correct API url / endpoint in GHES by @fhammerl in actions/checkout#1289 based on #1286 by @1newsr

Full Changelog: https://github.com/actions/checkout/compare/v3.5.1...v3.5.2

v3.5.1

What's Changed

Improve checkout performance on Windows runners by upgrading @actions/github dependency by @BrettDong in actions/checkout#1246

New Contributors

@BrettDong made their first contribution in actions/checkout#1246

... (truncated)

Commits

0ad4b8f Prep Release v4.1.4 (#1704)
43045ae Disable extensions.worktreeConfig when disabling sparse-checkout (#1692)
37b0821 Bump the minor-actions-dependencies group with 2 updates (#1693)
9839dc1 Add dependabot config (#1688)
9b4c13b Bump word-wrap from 1.2.3 to 1.2.5 (#1643)
1d96c77 Add SSH user parameter (#1685)
cd7d8d6 Check git version before attempting to disable sparse-checkout (#1656)
8410ad0 Update actions/checkout version in update-main-version.yml (#1650)
9bb5618 Prep for release of v4.1.2 (#1649)
8eb1f6a Bump @babel/traverse from 7.20.5 to 7.24.0 (#1642)
Additional commits viewable in compare view

Updates step-security/harden-runner from 2.7.0 to 2.7.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.7.1

What's Changed

Release v2.7.1 by @varunsh-coder, @h0x0er, @ashishkurmi in step-security/harden-runner#397 This release:

Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners

Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project

Addresses minor bugs

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.7.0...v2.7.1

Commits

a4aa98b Release v2.7.1 (#397)
6c3b1c9 Merge pull request #379 from step-security/dependabot/github_actions/step-sec...
3498091 Bump step-security/harden-runner from 2.6.1 to 2.7.0
63a88e2 Merge pull request #378 from step-security/update-readme3
07e5965 Update README
See full diff in compare view

Updates actions/dependency-review-action from 4.2.5 to 4.3.2

Release notes

Sourced from actions/dependency-review-action's releases.

v4.3.2

What's Changed

Fix package-url parsing for allow-dependencies-licenses by @juxtin in actions/dependency-review-action#761

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.3.1...v4.3.2

v4.3.1

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See actions/dependency-review-action#753.

Full Changelog: https://github.com/actions/dependency-review-action/compare/V4.3.0...v4.3.1

v4.3.0

New Features

The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

Fix action variable name for scorecard by @lukehinds in actions/dependency-review-action#735

Fix extra https:// in summary by @jhutchings1 in actions/dependency-review-action#748

Bump typescript from 5.3.3 to 5.4.5 by @dependabot in actions/dependency-review-action#744

Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @dependabot in actions/dependency-review-action#737

Show denied packages with red X by @juxtin in actions/dependency-review-action#750

deny-packages configuration option can deny specified version or all packages by @febuiles and @bteng22 in actions/dependency-review-action#733

New Contributors

@bteng22 made their first contribution in actions/dependency-review-action#733

@lukehinds made their first contribution in actions/dependency-review-action#735

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.2.5...V4.3.0

Commits

0c155c5 Merge pull request #762 from actions/juxtin/prepare-4.3.2
f3dac32 Merge pull request #761 from actions/juxtin/fix-allow-dependencies-licenses
d0d5cc3 Update version number to 4.3.2
49fbbe0 Fix package-url parsing for allow-dependencies-licenses
e58c696 Merge pull request #758 from actions/juxtin/prepare-4.3.1
9b7c72d Change version to 4.3.1
7dcfabf Merge pull request #753 from actions/juxtin/debug-purl
5f0808f Validate that deny-packages purls are complete
fcc66c2 Refine purl parsing and tests
1dd418b Basic tests for PURL validation in config
Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.3.1 to 2.3.3

Release notes

Sourced from ossf/scorecard-action's releases.

v2.3.3

[!NOTE]
There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

:seedling: Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by @spencerschrock in ossf/scorecard-action#1366

:seedling: Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by @spencerschrock in ossf/scorecard-action#1374

:seedling: Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by @spencerschrock in ossf/scorecard-action#1377

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

:book: Move token discussion out of main README. by @spencerschrock in ossf/scorecard-action#1279

:book: link to ossf/scorecard workflow instead of maintaining an example by @spencerschrock in ossf/scorecard-action#1352

:book: update api links to new scorecard.dev site by @spencerschrock in ossf/scorecard-action#1376

Full Changelog: https://github.com/ossf/scorecard-action/compare/v2.3.1...v2.3.3

Commits

dc50aa9 :seedling: Bump docker tag for v2.3.3 release (#1368)
8ff5700 :seedling: Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0....
8ba5e73 update api links to new scorecard.dev site (#1376)
92ddde3 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 (#1374)
6c55905 :seedling: Bump golang.org/x/net from 0.24.0 to 0.25.0 (#1373)
09bb953 :seedling: Bump distroless/base in the docker-images group (#1372)
1511e13 :seedling: Bump the github-actions group across 1 directory with 6 updates (#...
df66cd8 :seedling: Bump the docker-images group with 2 updates (#1370)
fad9a3c :seedling: Bump distroless/base in the docker-images group (#1364)
1e01a30 :seedling: Bump the github-actions group with 3 updates (#1365)
Additional commits viewable in compare view

Updates actions/upload-artifact from 4.3.1 to 4.3.3

Release notes

Sourced from actions/upload-artifact's releases.

v4.3.3

What's Changed

updating @actions/artifact dependency to v2.1.6 by @eggyhead in actions/upload-artifact#565

Full Changelog: https://github.com/actions/upload-artifact/compare/v4.3.2...v4.3.3

v4.3.2

What's Changed

Update release-new-action-version.yml by @konradpabjan in actions/upload-artifact#516

Minor fix to the migration readme by @andrewakim in actions/upload-artifact#523

Update readme with v3/v2/v1 deprecation notice by @robherley in actions/upload-artifact#561

updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @eggyhead in actions/upload-artifact#562

New Contributors

@andrewakim made their first contribution in actions/upload-artifact#523

Full Changelog: https://github.com/actions/upload-artifact/compare/v4.3.1...v4.3.2

Commits

6546280 updating package version
c004fb4 Merge branch 'main' into eggyhead/use-artifact-v2.1.6
90aba49 updating toolkit artifact dependency to 2.1.6
b06cde3 Merge pull request #563 from actions/eggyhead/release-4.3.2
1746f4a Revert "updating to release 4.3.2"
31685d0 updating to release 4.3.2
18bf333 Merge pull request #562 from actions/eggyhead/update-artifact-v215
dac413b update package lock version
bb3b4a3 updating package version
3e3da83 updating artifact and core dependencies
Additional commits viewable in compare view

Updates codecov/codecov-action from 4.1.1 to 4.3.1

Release notes

Sourced from codecov/codecov-action's releases.

v4.3.1

What's Changed

build(deps-dev): bump typescript from 5.4.4 to 5.4.5 by @dependabot in codecov/codecov-action#1370

fix: more verbose log message when failing to import pgp key by @ReenigneArcher in codecov/codecov-action#1371

build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.6.0 to 7.7.0 by @dependabot in codecov/codecov-action#1374

build(deps-dev): bump @typescript-eslint/parser from 7.6.0 to 7.7.0 by @dependabot in codecov/codecov-action#1375

build(deps): bump actions/checkout from 4.1.2 to 4.1.3 by @dependabot in codecov/codecov-action#1382

build(deps): bump github/codeql-action from 3.24.10 to 3.25.1 by @dependabot in codecov/codecov-action#1381

build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.2 by @dependabot in codecov/codecov-action#1380

build(deps-dev): bump @typescript-eslint/parser from 7.7.0 to 7.7.1 by @dependabot in codecov/codecov-action#1384

build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.7.0 to 7.7.1 by @dependabot in codecov/codecov-action#1383

Update README.md to point to docs about tokenless by @rohan-at-sentry in codecov/codecov-action#1395

build(deps): bump actions/upload-artifact from 4.3.2 to 4.3.3 by @dependabot in codecov/codecov-action#1393

build(deps): bump actions/checkout from 4.1.3 to 4.1.4 by @dependabot in codecov/codecov-action#1392

build(deps): bump github/codeql-action from 3.25.1 to 3.25.3 by @dependabot in codecov/codecov-action#1391

style: Node Packages by @marcobiedermann in codecov/codecov-action#1394

build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.7.1 to 7.8.0 by @dependabot in codecov/codecov-action#1402

build(deps-dev): bump @typescript-eslint/parser from 7.7.1 to 7.8.0 by @dependabot in codecov/codecov-action#1401

docs: Type Annotations by @marcobiedermann in codecov/codecov-action#1397

docs: main branch by @marcobiedermann in codecov/codecov-action#1396

fix: bypass token checks for forks and OIDC by @thomasrockhu-codecov in codecov/codecov-action#1404

chore(release): 4.3.1. by @thomasrockhu-codecov in codecov/codecov-action#1405

New Contributors

@ReenigneArcher made their first contribution in codecov/codecov-action#1371

@rohan-at-sentry made their first contribution in codecov/codecov-action#1395

@marcobiedermann made their first contribution in codecov/codecov-action#1394

Full Changelog: https://github.com/codecov/codecov-action/compare/v4.3.0...v4.3.1

v4.3.0

What's Changed

fix: automatically detect if using GitHub enterprise by @thomasrockhu-codecov in codecov/codecov-action#1356

build(deps-dev): bump typescript from 5.4.3 to 5.4.4 by @dependabot in codecov/codecov-action#1355

build(deps): bump github/codeql-action from 3.24.9 to 3.24.10 by @dependabot in codecov/codecov-action#1360

build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.5.0 to 7.6.0 by @dependabot in codecov/codecov-action#1364

build(deps-dev): bump @typescript-eslint/parser from 7.5.0 to 7.6.0 by @dependabot in codecov/codecov-action#1363

feat: add network params by @thomasrockhu-codecov in codecov/codecov-action#1365

build(deps): bump undici from 5.28.3 to 5.28.4 by @dependabot in codecov/codecov-action#1361

chore(release): v4.3.0 by @thomasrockhu-codecov in codecov/codecov-action#1366

Full Changelog: https://github.com/codecov/codecov-action/compare/v4.2.0...v4.3.0

v4.2.0

What's Changed

chore(deps): update deps by @thomasrockhu-codecov in codecov/codecov-action#1351

feat: allow for authentication via OIDC token by @thomasrockhu-codecov in codecov/codecov-action#1330

fix: use_oidc shoudl be required false by @thomasrockhu-codecov in codecov/codecov-action#1353

... (truncated)

Commits

5ecb98a chore(release): 4.3.1. (#1405)
5a299d1 fix: bypass token checks for forks and OIDC (#1404)
dad251d docs: main branch (#1396)
e8bbe5f docs: Type Annotations (#1397)
a6fd87f build(deps-dev): bump @typescript-eslint/parser from 7.7.1 to 7.8.0 (#1401)
76c8cd6 build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.7.1 to 7.8.0 (#...
1290bdd style: Node Packages (#1394)
951ef79 build(deps): bump github/codeql-action from 3.25.1 to 3.25.3 (#1391)
bb71c1b build(deps): bump actions/checkout from 4.1.3 to 4.1.4 (#1392)
acc5d43 build(deps): bump actions/upload-artifact from 4.3.2 to 4.3.3 (#1393)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

fiaisis / run-detection

Bump the action-packages group across 1 directory with 6 updates #268

v4.0.0

What's Changed

New Contributors

v3.6.0

What's Changed

New Contributors

v3.5.3

What's Changed

New Contributors

v3.5.2

What's Changed

v3.5.1

What's Changed

New Contributors

v2.7.1

What's Changed

v4.3.2

What's Changed

v4.3.1

What's Changed

v4.3.0

New Features

What's Changed

New Contributors

v2.3.3

What's Changed

Documentation

v4.3.3

What's Changed

v4.3.2

What's Changed

New Contributors

v4.3.1

What's Changed

New Contributors

v4.3.0

What's Changed

v4.2.0

What's Changed