Skip to content

chore(deps): bump the github-actions-dependencies group across 1 directory with 9 updates#1432

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-dependencies-5f81d29e82
Open

chore(deps): bump the github-actions-dependencies group across 1 directory with 9 updates#1432
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-dependencies-5f81d29e82

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions-dependencies group with 9 updates in the / directory:

Package From To
hoverkraft-tech/ci-github-common/.github/workflows/linter.yml 0.37.1 0.37.3
actions/checkout 6.0.3 7.0.0
hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request 0.37.1 0.37.3
hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml 0.37.1 0.37.3
hoverkraft-tech/ci-dokumentor 0.3.1 0.4.0
hoverkraft-tech/ci-github-publish/actions/deploy/github-pages 0.26.3 0.26.5
hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml 0.37.1 0.37.3
hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml 0.37.1 0.37.3
hoverkraft-tech/ci-github-common/.github/workflows/stale.yml 0.37.1 0.37.3

Updates hoverkraft-tech/ci-github-common/.github/workflows/linter.yml from 0.37.1 to 0.37.3

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/linter.yml's releases.

0.37.3

Release Summary

actions/linter now supports Hoverkraft CRD schema validation with kubeconform, and the actions and workflows documentation has been refreshed.

Internal maintenance updates fast-xml-parser and the release actions workflow dependency.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.2...0.37.3

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 2334d39 chore: bump hoverkraft-tech/ci-github-publish/.github/workflows/release-actio...
  • 8b3b173 chore: bump fast-xml-parser
  • 82fe0aa feat(actions/linter): add Hoverkraft CRDs schema for kubeconform
  • 6e43da5 docs: update actions and workflows documentation
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates actions/checkout from 6.0.3 to 7.0.0

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request from 0.37.1 to 0.37.3

Release notes

Sourced from hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request's releases.

0.37.3

Release Summary

actions/linter now supports Hoverkraft CRD schema validation with kubeconform, and the actions and workflows documentation has been refreshed.

Internal maintenance updates fast-xml-parser and the release actions workflow dependency.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.2...0.37.3

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 2334d39 chore: bump hoverkraft-tech/ci-github-publish/.github/workflows/release-actio...
  • 8b3b173 chore: bump fast-xml-parser
  • 82fe0aa feat(actions/linter): add Hoverkraft CRDs schema for kubeconform
  • 6e43da5 docs: update actions and workflows documentation
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml from 0.37.1 to 0.37.3

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml's releases.

0.37.3

Release Summary

actions/linter now supports Hoverkraft CRD schema validation with kubeconform, and the actions and workflows documentation has been refreshed.

Internal maintenance updates fast-xml-parser and the release actions workflow dependency.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.2...0.37.3

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 2334d39 chore: bump hoverkraft-tech/ci-github-publish/.github/workflows/release-actio...
  • 8b3b173 chore: bump fast-xml-parser
  • 82fe0aa feat(actions/linter): add Hoverkraft CRDs schema for kubeconform
  • 6e43da5 docs: update actions and workflows documentation
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates hoverkraft-tech/ci-dokumentor from 0.3.1 to 0.4.0

Release notes

Sourced from hoverkraft-tech/ci-dokumentor's releases.

0.4.0

Release Summary

No new runtime features or bug fixes are included; the public update refreshes the action documentation.

Internal maintenance updates production, development, documentation, and GitHub Actions dependencies, including webpack-dev-server, ws, commander, and grouped npm/GitHub Actions upgrades.

Breaking changes

No Breaking changes.

What's Changed

Full Changelog: hoverkraft-tech/ci-dokumentor@0.3.1...0.4.0

Commits
  • 301ef70 build(deps-dev): Bump the npm-development-dependencies group across 1 directo...
  • 4a56281 build(deps): Bump the github-actions-dependencies group across 1 directory wi...
  • b7a6c68 build(deps): Bump commander in the npm-production-dependencies group
  • ae3a11d build(deps): Bump the npm-docs-dependencies group with 2 updates
  • c54bf05 build(deps): Bump ws from 8.18.3 to 8.20.1
  • 1ef67e8 docs: update action documentation
  • f448253 build(deps): Bump webpack-dev-server from 5.2.2 to 5.2.4
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-publish/actions/deploy/github-pages from 0.26.3 to 0.26.5

Release notes

Sourced from hoverkraft-tech/ci-github-publish/actions/deploy/github-pages's releases.

0.26.5

Release Summary

This release fixes failure reporting in the finish-deploy-argocd-app-of-apps workflow and updates the actions and workflows documentation.

Internal changes include dependency updates for GitHub Actions, npm packages, and hoverkraft-tech/ci-dokumentor.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-publish@0.26.4...0.26.5

0.26.4

Release Summary

Documentation now clarifies the token permissions required and updates the available actions and workflows documentation.

actions/argocd/get-manifest-files now correctly handles value assignment without mutating a constant unexpectedly.

Breaking changes

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-publish@0.26.3...0.26.4

Commits
  • 6070690 docs: update actions and workflows documentation
  • 5c93ca2 build(deps): Bump hoverkraft-tech/ci-dokumentor (#424)
  • 32549a8 build(deps): Bump the npm-dependencies group across 1 directory with 2 updates
  • 5812464 docs: update actions and workflows documentation
  • 0520f01 fix(workflows/finish-deploy-argocd-app-of-apps): handle failure report properly
  • b2c9cca docs: update actions and workflows documentation
  • 3f7c50f build(deps): Bump the github-actions-dependencies group across 1 directory wi...
  • 5ecd2fc docs: update actions and workflows documentation
  • 06ca00d build(deps): Bump the github-actions-dependencies group across 8 directories ...
  • 83646fa docs: update actions and workflows documentation
  • Additional commits viewable in compare view

Updates hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml from 0.37.1 to 0.37.3

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml's releases.

0.37.3

Release Summary

actions/linter now supports Hoverkraft CRD schema validation with kubeconform, and the actions and workflows documentation has been refreshed.

Internal maintenance updates fast-xml-parser and the release actions workflow dependency.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.2...0.37.3

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 2334d39 chore: bump hoverkraft-tech/ci-github-publish/.github/workflows/release-actio...
  • 8b3b173 chore: bump fast-xml-parser
  • 82fe0aa feat(actions/linter): add Hoverkraft CRDs schema for kubeconform
  • 6e43da5 docs: update actions and workflows documentation
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml from 0.37.1 to 0.37.3

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml's releases.

0.37.3

Release Summary

actions/linter now supports Hoverkraft CRD schema validation with kubeconform, and the actions and workflows documentation has been refreshed.

Internal maintenance updates fast-xml-parser and the release actions workflow dependency.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.2...0.37.3

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 2334d39 chore: bump hoverkraft-tech/ci-github-publish/.github/workflows/release-actio...
  • 8b3b173 chore: bump fast-xml-parser
  • 82fe0aa feat(actions/linter): add Hoverkraft CRDs schema for kubeconform
  • 6e43da5 docs: update actions and workflows documentation
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Updates hoverkraft-tech/ci-github-common/.github/workflows/stale.yml from 0.37.1 to 0.37.3

Release notes

Sourced from hoverkraft-tech/ci-github-common/.github/workflows/stale.yml's releases.

0.37.3

Release Summary

actions/linter now supports Hoverkraft CRD schema validation with kubeconform, and the actions and workflows documentation has been refreshed.

Internal maintenance updates fast-xml-parser and the release actions workflow dependency.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.2...0.37.3

0.37.2

Release Summary

Improved actions/parse-ci-reports LCOV support to handle more supported report formats. Updated actions and workflows documentation.

Internal changes include GitHub Actions dependency updates.

Breaking change(s)

There is no breaking change.

What's Changed

Full Changelog: hoverkraft-tech/ci-github-common@0.37.1...0.37.2

Commits
  • 2334d39 chore: bump hoverkraft-tech/ci-github-publish/.github/workflows/release-actio...
  • 8b3b173 chore: bump fast-xml-parser
  • 82fe0aa feat(actions/linter): add Hoverkraft CRDs schema for kubeconform
  • 6e43da5 docs: update actions and workflows documentation
  • 7034f6a fix(actions/parse-ci-reports): improve LCOV supported formats
  • fb50508 chore: bump the github-actions-dependencies group across 2 directories with 3...
  • 0ca7ebe chore: bump the github-actions-dependencies group across 2 directories with 3...
  • e259f76 docs: update actions and workflows documentation
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ctory with 9 updates

Bumps the github-actions-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hoverkraft-tech/ci-github-common/.github/workflows/linter.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.3` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.0` |
| [hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.3` |
| [hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.3` |
| [hoverkraft-tech/ci-dokumentor](https://github.com/hoverkraft-tech/ci-dokumentor) | `0.3.1` | `0.4.0` |
| [hoverkraft-tech/ci-github-publish/actions/deploy/github-pages](https://github.com/hoverkraft-tech/ci-github-publish) | `0.26.3` | `0.26.5` |
| [hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.3` |
| [hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.3` |
| [hoverkraft-tech/ci-github-common/.github/workflows/stale.yml](https://github.com/hoverkraft-tech/ci-github-common) | `0.37.1` | `0.37.3` |



Updates `hoverkraft-tech/ci-github-common/.github/workflows/linter.yml` from 0.37.1 to 0.37.3
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...2334d39)

Updates `actions/checkout` from 6.0.3 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

Updates `hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request` from 0.37.1 to 0.37.3
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...2334d39)

Updates `hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml` from 0.37.1 to 0.37.3
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...2334d39)

Updates `hoverkraft-tech/ci-dokumentor` from 0.3.1 to 0.4.0
- [Release notes](https://github.com/hoverkraft-tech/ci-dokumentor/releases)
- [Commits](hoverkraft-tech/ci-dokumentor@3258ef0...301ef70)

Updates `hoverkraft-tech/ci-github-publish/actions/deploy/github-pages` from 0.26.3 to 0.26.5
- [Release notes](https://github.com/hoverkraft-tech/ci-github-publish/releases)
- [Commits](hoverkraft-tech/ci-github-publish@b2562b4...6070690)

Updates `hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml` from 0.37.1 to 0.37.3
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...2334d39)

Updates `hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml` from 0.37.1 to 0.37.3
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...2334d39)

Updates `hoverkraft-tech/ci-github-common/.github/workflows/stale.yml` from 0.37.1 to 0.37.3
- [Release notes](https://github.com/hoverkraft-tech/ci-github-common/releases)
- [Commits](hoverkraft-tech/ci-github-common@624be17...2334d39)

---
updated-dependencies:
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml
  dependency-version: 0.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request
  dependency-version: 0.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml
  dependency-version: 0.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-dokumentor
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-publish/actions/deploy/github-pages
  dependency-version: 0.26.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml
  dependency-version: 0.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml
  dependency-version: 0.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml
  dependency-version: 0.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Jul 3, 2026
@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Hi, thank you for creating your PR, we will check it out very soon

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
GITHUB_ACTIONS Pass ✅
GITHUB_ACTIONS_ZIZMOR Pass ✅
GITLEAKS Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Pass ✅
YAML_PRETTIER Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

TRIVY

Report Summary

┌──────────────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│                        Target                        │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ .github/actions/generate-blog-post/package-lock.json │    npm     │        0        │         -         │    -    │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ .github/actions/share-blog-post/package-lock.json    │    npm     │        2        │         -         │    -    │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ .github/actions/validate-manifest/package-lock.json  │    npm     │        0        │         -         │    -    │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ application/package-lock.json                        │    npm     │       11        │         -         │    -    │
├──────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                                           │ dockerfile │        -        │         0         │    -    │
└──────────────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


.github/actions/share-blog-post/package-lock.json (npm)
=======================================================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                            │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ js-yaml │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge │
│         │                │          │        │                   │               │ keys                                                       │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                 │
│         │                │          │        ├───────────────────┤               │                                                            │
│         │                │          │        │ 4.1.1             │               │                                                            │
│         │                │          │        │                   │               │                                                            │
│         │                │          │        │                   │               │                                                            │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

application/package-lock.json (npm)
===================================
Total: 11 (UNKNOWN: 0, LOW: 3, MEDIUM: 4, HIGH: 4, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version         │                           Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼────────────────────────────────────────────────────────────┤
│ @babel/core │ CVE-2026-49356 │ LOW      │ fixed  │ 7.29.0            │ 8.0.0-rc.6, 7.29.6           │ @babel/core: @babel/core: Arbitrary file read via          │
│             │                │          │        │                   │                              │ sourceMappingURL comment                                   │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-49356                 │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │        │ 4.1.1             │ 4.2.0, 3.15.0                │ js-yaml: js-yaml: Denial of Service via crafted YAML merge │
│             │                │          │        │                   │                              │ keys                                                       │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-53550                 │
├─────────────┼────────────────┤          │        ├───────────────────┼──────────────────────────────┼────────────────────────────────────────────────────────────┤
│ tar         │ CVE-2026-53655 │          │        │ 7.5.14            │ 7.5.16                       │ node-tar is a full-featured Tar for Node.js. Prior to      │
│             │                │          │        │                   │                              │ 7.5.16, tar (nod...                                        │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-53655                 │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼────────────────────────────────────────────────────────────┤
│ undici      │ CVE-2026-12151 │ HIGH     │        │ 7.25.0            │ 6.27.0, 7.28.0, 8.5.0        │ undici: undici: Denial of Service due to unbounded memory  │
│             │                │          │        │                   │                              │ growth via WebSocket...                                    │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-12151                 │
│             ├────────────────┤          │        │                   ├──────────────────────────────┼────────────────────────────────────────────────────────────┤
│             │ CVE-2026-6734  │          │        │                   │ 7.28.0, 8.2.0                │ undici: undici: Information disclosure and data integrity  │
│             │                │          │        │                   │                              │ issues due to incorrect Socks5ProxyAgent...                │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-6734                  │
│             ├────────────────┤          │        │                   ├──────────────────────────────┼────────────────────────────────────────────────────────────┤
│             │ CVE-2026-9697  │          │        │                   │ 7.28.0, 8.5.0                │ undici: undici: Man-in-the-Middle attack via ignored TLS   │
│             │                │          │        │                   │                              │ options with SOCKS5 proxy                                  │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9697                  │
│             ├────────────────┼──────────┤        │                   │                              ├────────────────────────────────────────────────────────────┤
│             │ CVE-2026-9678  │ MEDIUM   │        │                   │                              │ undici: Undici: Information disclosure due to improper     │
│             │                │          │        │                   │                              │ cache-control header parsing                               │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9678                  │
│             ├────────────────┤          │        │                   ├──────────────────────────────┼────────────────────────────────────────────────────────────┤
│             │ CVE-2026-9679  │          │        │                   │ 6.27.0, 7.28.0, 8.5.0        │ undici: undici vulnerable to HTTP header injection via     │
│             │                │          │        │                   │                              │ Set-Cookie percent-decoding                                │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-9679                  │
│             ├────────────────┼──────────┤        │                   │                              ├────────────────────────────────────────────────────────────┤
│             │ CVE-2026-11525 │ LOW      │        │                   │                              │ undici: undici: Weakening of cookie SameSite policy due to │
│             │                │          │        │                   │                              │ incorrect parsing of...                                    │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-11525                 │
│             ├────────────────┤          │        │                   │                              ├────────────────────────────────────────────────────────────┤
│             │ CVE-2026-6733  │          │        │                   │                              │ undici: Undici: Response queue poisoning on reused         │
│             │                │          │        │                   │                              │ keep-alive sockets can lead to...                          │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-6733                  │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼────────────────────────────────────────────────────────────┤
│ ws          │ CVE-2026-48779 │ HIGH     │        │ 8.20.1            │ 5.2.5, 6.2.4, 7.5.11, 8.21.0 │ ws: ws: Denial of Service via memory exhaustion from small │
│             │                │          │        │                   │                              │ WebSocket fragments...                                     │
│             │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-48779                 │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴────────────────────────────────────────────────────────────┘

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Code Coverage Report

Coverage Results

Test Results

Status Count
✅ Passed 27
❌ Failed 0
⏭️ Skipped 0
Total 27

Pass Rate: 100.0%

Coverage

Metric Covered Total Percentage
Lines 100 108 92.59%
Branches 95 105 90.48%
Functions 22 23 95.65%

Overall: 92.59% 🟢
🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩⬜

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants