chore(debt): Backport upstream changes - #39
Conversation
![semgrep-code-scalingo[bot]](https://avatars.githubusercontent.com/u/4868969?s=60&v=4){kind=small}
|
Tests seems to be very flaky |
|
before merging to master, maybe we want our client to rely on a tag rather than on master branch!? |
|
ping @leo-scalingo |
leo-scalingo
left a comment
leo-scalingo
left a comment
There was a problem hiding this comment.
The logics which is changed here seems good to me
Bumps [rack](https://github.com/rack/rack) from 2.2.4 to 2.2.6.2. - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@2.2.4...v2.2.6.2) --- updated-dependencies: - dependency-name: rack dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.9 to 1.14.0. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.13.9...v1.14.0) --- updated-dependencies: - dependency-name: nokogiri dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [rack](https://github.com/rack/rack) from 2.2.6.2 to 2.2.6.3. - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.6.2...v2.2.6.3) --- updated-dependencies: - dependency-name: rack dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [rack](https://github.com/rack/rack) from 2.2.6.3 to 2.2.6.4. - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.6.3...v2.2.6.4) --- updated-dependencies: - dependency-name: rack dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.14.0 to 1.14.3. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.14.0...v1.14.3) --- updated-dependencies: - dependency-name: nokogiri dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [nsq-cluster](https://github.com/wistia/nsq-cluster) from 2.1.0 to 2.2.0. - [Release notes](https://github.com/wistia/nsq-cluster/releases) - [Changelog](https://github.com/wistia/nsq-cluster/blob/master/CHANGELOG.md) - [Commits](wistia/nsq-cluster@v2.1.0...v2.2.0) --- updated-dependencies: - dependency-name: nsq-cluster dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.14.3 to 1.16.2. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.14.3...v1.16.2) --- updated-dependencies: - dependency-name: nokogiri dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Commit reword for signing requirement
Commit reworded for signature requirement
…a#66) * Update Gemfile + gemspec * Remove jeweler gem * Use VERSION file * Update Gemfile.lock * Add GHA workflow to run tests against several ruby versions * Update certs so openSSL stops complaining * Remove old .ruby-version and .travis.yml + add .tool-versions Reworded for signature requirement
Reworded for signature requirement
reworded for signature requirement
reworded for signature requirement
reworded for signature requirement
* Update CHANGELOG.md * Bump VERSION to 2.4.0 Reworded for signature requirement
Co-authored-by: wistia-gha-security-bot[bot] <275146629+wistia-gha-security-bot[bot]@users.noreply.github.com>
* GHA/run-tests: Bump ruby/nsq versions * Bump Gemfile.lock * Add logger dependency in Gemfile for Ruby 4.0 compatibility
4b6239f to
c12faf0
Compare
| - package-ecosystem: "github-actions" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "monthly" | ||
| reviewers: | ||
| - "leo-scalingo" |
There was a problem hiding this comment.
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
🧼 Removed in commit 72ede13 🧼
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - name: Automatically merge Dependabot PRs | ||
| uses: Scalingo/actions/dependabot-automerge@main |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🥳 Removed in commit 72ede13 🥳
|
Semgrep found 1 This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a |
7 participants
ref #32
ref #34
ref #35
ref #38