Bump the minor-and-patch group across 1 directory with 4 updates#179
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the minor-and-patch group across 1 directory with 4 updates#179dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the minor-and-patch group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [oxsecurity/megalinter](https://github.com/oxsecurity/megalinter), [github/codeql-action](https://github.com/github/codeql-action) and [wesley-dean/publish_container](https://github.com/wesley-dean/publish_container). Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) Updates `oxsecurity/megalinter` from 9.4.0 to 9.5.0 - [Release notes](https://github.com/oxsecurity/megalinter/releases) - [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md) - [Commits](oxsecurity/megalinter@8fbdead...0e3ce9b) Updates `github/codeql-action` from 4.35.3 to 4.36.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...87557b9) Updates `wesley-dean/publish_container` from 1.0.16 to 1.0.19 - [Release notes](https://github.com/wesley-dean/publish_container/releases) - [Commits](wesley-dean/publish_image@f9a254a...6d4b9c6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: oxsecurity/megalinter dependency-version: 9.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github/codeql-action dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: wesley-dean/publish_container dependency-version: 1.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 3 | 0 | 0 | 0.27s | |
| zizmor | 3 | 0 | 1 | 0 | 0.34s | |
| ✅ DOCKERFILE | hadolint | 1 | 0 | 0 | 0.07s | |
| ✅ JSON | jsonlint | 2 | 0 | 0 | 0.4s | |
| ✅ JSON | prettier | 2 | 0 | 0 | 0 | 0.33s |
| ✅ JSON | v8r | 2 | 0 | 0 | 2.5s | |
| ✅ MARKDOWN | markdownlint | 1 | 0 | 0 | 0 | 0.66s |
| ✅ MARKDOWN | markdown-table-formatter | 1 | 0 | 0 | 0 | 0.26s |
| ✅ PYTHON | bandit | 1 | 0 | 0 | 2.6s | |
| ✅ PYTHON | black | 1 | 0 | 0 | 0 | 1.6s |
| ✅ PYTHON | flake8 | 1 | 0 | 0 | 1.1s | |
| ✅ PYTHON | isort | 1 | 0 | 0 | 0 | 0.29s |
| ✅ PYTHON | mypy | 1 | 0 | 0 | 3.88s | |
| ✅ PYTHON | pylint | 1 | 0 | 0 | 4.0s | |
| ✅ PYTHON | pyright | 1 | 0 | 0 | 3.01s | |
| ✅ PYTHON | ruff | 1 | 0 | 0 | 0 | 0.03s |
| ✅ REPOSITORY | checkov | yes | no | no | 25.87s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.32s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.0s | |
| grype | yes | 2 | 1 | 53.71s | ||
| osv-scanner | yes | 3 | no | 0.88s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.43s | |
| ✅ REPOSITORY | syft | yes | no | no | 2.08s | |
| trivy | yes | 2 | 1 | 12.72s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.18s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.75s | |
| ✅ SPELL | lychee | 10 | 0 | 0 | 1.46s | |
| ✅ YAML | prettier | 6 | 0 | 0 | 0 | 0.51s |
| ✅ YAML | v8r | 6 | 0 | 0 | 8.01s | |
| ✅ YAML | yamllint | 6 | 0 | 0 | 0.54s |
Detailed Issues
⚠️ REPOSITORY / grype - 2 errors
error: A high vulnerability in python package: urllib3, version 2.6.3 was found at: /requirements.txt
error: A high vulnerability in python package: urllib3, version 2.6.3 was found at: /requirements.txt
warning: A medium vulnerability in python package: idna, version 3.11 was found at: /requirements.txt
warning: 1 warnings emitted
error: 2 errors emitted
⚠️ REPOSITORY / osv-scanner - 3 errors
Scanning dir .
Starting filesystem walk for root: /
Scanned requirements.txt file and found 13 packages
End status: 32 dirs visited, 90 inodes visited, 1 Extract calls, 11.015787ms elapsed, 11.015948ms wall time
Total 3 packages affected by 7 known vulnerabilities (0 Critical, 3 High, 3 Medium, 1 Low, 0 Unknown) from 1 ecosystem.
7 vulnerabilities can be fixed.
+-------------------------------------+------+-----------+---------+---------+---------------+------------------+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
+-------------------------------------+------+-----------+---------+---------+---------------+------------------+
| https://osv.dev/GHSA-65pc-fj4g-8rjx | 6.9 | PyPI | idna | 3.11 | 3.15 | requirements.txt |
| https://osv.dev/PYSEC-2026-175 | 4.2 | PyPI | pyjwt | 2.12.1 | 2.13.0 | requirements.txt |
| https://osv.dev/PYSEC-2026-177 | 3.7 | PyPI | pyjwt | 2.12.1 | 2.13.0 | requirements.txt |
| https://osv.dev/PYSEC-2026-178 | 5.3 | PyPI | pyjwt | 2.12.1 | 2.13.0 | requirements.txt |
| https://osv.dev/PYSEC-2026-179 | 7.4 | PyPI | pyjwt | 2.12.1 | 2.13.0 | requirements.txt |
| https://osv.dev/PYSEC-2026-141 | 8.2 | PyPI | urllib3 | 2.6.3 | 2.7.0 | requirements.txt |
| https://osv.dev/GHSA-qccp-gfcp-xxvc | | | | | | |
| https://osv.dev/PYSEC-2026-142 | 8.9 | PyPI | urllib3 | 2.6.3 | 2.7.0 | requirements.txt |
| https://osv.dev/GHSA-mf9v-mfxr-j63j | | | | | | |
+-------------------------------------+------+-----------+---------+---------+---------------+------------------+
⚠️ REPOSITORY / trivy - 2 errors
warning: Package: idna
Installed Version: 3.11
Vulnerability CVE-2026-45409
Severity: MEDIUM
Fixed Version: 3.15
Link: [CVE-2026-45409](https://avd.aquasec.com/nvd/cve-2026-45409)
┌─ requirements.txt:281:1
│
281 │ idna==3.11 \
│ ^
│
= Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
= This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.
### Impact
A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.
### Patches
Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).
### Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
error: Package: urllib3
Installed Version: 2.6.3
Vulnerability CVE-2026-44431
Severity: HIGH
Fixed Version: 2.7.0
Link: [CVE-2026-44431](https://avd.aquasec.com/nvd/cve-2026-44431)
┌─ requirements.txt:336:1
│
336 │ urllib3==2.6.3 \
│ ^
│
= urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
= urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
error: Package: urllib3
Installed Version: 2.6.3
Vulnerability CVE-2026-44432
Severity: HIGH
Fixed Version: 2.7.0
Link: [CVE-2026-44432](https://avd.aquasec.com/nvd/cve-2026-44432)
┌─ requirements.txt:336:1
│
336 │ urllib3==2.6.3 \
│ ^
│
= urllib3: urllib3: Denial of Service due to excessive HTTP response decompression
= urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
warning: 1 warnings emitted
error: 2 errors emitted
⚠️ ACTION / zizmor - 1 error
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'impostor-commit' audit failed on file://.github/workflows/dependabot_automerge.yml
Caused by:
0: error in 'impostor-commit' audit
1: couldn't list tags for dependabot/fetch-metadata
2: request error while accessing GitHub API
3: HTTP status client error (401 Unauthorized) for url (https://github.com/dependabot/fetch-metadata.git/git-upload-pack)
[ZizmorLinter] Zizmor failed to reach the GitHub API.
To allow zizmor to use GITHUB_TOKEN, add the following to your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
- GITHUB_TOKEN
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the minor-and-patch group with 4 updates in the / directory: actions/checkout, oxsecurity/megalinter, github/codeql-action and wesley-dean/publish_container.
Updates
actions/checkoutfrom 6.0.2 to 6.0.3Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
df4cb1cUpdate changelog for v6.0.3 (#2446)1cce339Fix checkout init for SHA-256 repositories (#2439)900f221fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)0c366fdUpdate changelog (#2357)Updates
oxsecurity/megalinterfrom 9.4.0 to 9.5.0Release notes
Sourced from oxsecurity/megalinter's releases.
... (truncated)
Changelog
Sourced from oxsecurity/megalinter's changelog.
... (truncated)
Commits
0e3ce9bFix release workflows.3e132b1Release MegaLinter v9.5.0cbb7fe9Doc + prepare 9.5.0 release (#7836)29bcf10[automation] Auto-update linters version, help and documentation (#7832)ed753c5chore(deps): update jdkato/vale docker tag to v3.14.2 (#7829)e04f202feat: implement user notifications system and replace migration warnings (#7833)54bfad8chore(deps): update dependency@stoplight/spectral-clito v6.16.0 (#7830)f809408Eslint legacy detection & warning (#7831)6725b65chore(deps): update dependency langsmith to v0.8.5 (#7828)cbcc02fchore(deps): update dependency rumdl to v0.1.93 (#7825)Updates
github/codeql-actionfrom 4.35.3 to 4.36.1Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
87557b9Merge pull request #3940 from github/update-v4.36.1-2a1689ed49431011Update changelog for v4.36.12a1689eMerge pull request #3939 from github/henrymercer/skip-overlay-revert-when-exp...5245323Disable missing diff-ranges fallback when overlay enabled manuallyd1eb120Merge pull request #3933 from github/update-supported-enterprise-server-versions115001bMerge pull request #3934 from github/dependabot/npm_and_yarn/npm-minor-86fb5c...cef2e7aMerge pull request #3925 from github/dependabot/github_actions/dot-github/wor...5e6adf7Merge pull request #3936 from github/dependabot/npm_and_yarn/tmp-0.2.7ad170e6Merge branch 'main' into dependabot/github_actions/dot-github/workflows/actio...6a37b3aRebuildUpdates
wesley-dean/publish_containerfrom 1.0.16 to 1.0.19Release notes
Sourced from wesley-dean/publish_container's releases.
Commits
6d4b9c6Merge pull request #88 from wesley-dean/dependabot/github_actions/dependabot/...856faa9Merge pull request #86 from wesley-dean/dependabot/github_actions/docker/buil...9aeb362Merge pull request #84 from wesley-dean/dependabot/github_actions/minor-and-p...6fac9e6Merge pull request #85 from wesley-dean/dependabot/github_actions/crazy-max/g...b5d7fb0Merge pull request #76 from wesley-dean/renamec456226Merge branch 'main' into renameb744269build(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.1.0697fe10build(deps): bump docker/build-push-action from 6.18.0 to 7.1.046e0d92build(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.088a1b86build(deps): bump github/codeql-action in the minor-and-patch groupDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions