Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dependabot updates for week of 9 October 2023 #2705

Merged
merged 32 commits into from
Oct 9, 2023
Merged

Dependabot updates for week of 9 October 2023 #2705

merged 32 commits into from
Oct 9, 2023

Conversation

jmgrady
Copy link
Collaborator

@jmgrady jmgrady commented Oct 9, 2023 •
edited
Loading

Additional changes:

  • sets the egress-policy to block and updates the allowed endpoints for:

    • .github/workflows/combine_deploy_image.yml, and
    • .github/workflows/scorecards.yml.

  • Dependabot update schedule is set to monthly.

This change is Reviewable

dependabot bot and others added 29 commits October 8, 2023 12:01
@dependabot
Bump mongo from 7.0.1-jammy to 7.0.2-jammy in /database
67f7535 
Bumps mongo from 7.0.1-jammy to 7.0.2-jammy.

---
updated-dependencies:
- dependency-name: mongo
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump step-security/harden-runner from 2.5.1 to 2.6.0
27b7e77 
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.5.1 to 2.6.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@8ca2b8b...1b05615)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump ossf/scorecard-action from 2.2.0 to 2.3.0
1d31a41 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.2.0 to 2.3.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@08b4669...483ef80)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump actions/setup-python from 4.7.0 to 4.7.1
90bf541 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4.7.0 to 4.7.1.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@61a6322...65d7f2d)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump aws-actions/configure-aws-credentials from 4.0.0 to 4.0.1
209f7ff 
Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@v4.0.0...v4.0.1)

---
updated-dependencies:
- dependency-name: aws-actions/configure-aws-credentials
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github/codeql-action from 2.21.9 to 2.22.0
b02b345 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.21.9 to 2.22.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ddccb87...2cb752a)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump System.IdentityModel.Tokens.Jwt from 6.32.3 to 6.33.0 in /Backend
81d1989 
Bumps [System.IdentityModel.Tokens.Jwt](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet) from 6.32.3 to 6.33.0.
- [Release notes](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases)
- [Changelog](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md)
- [Commits](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@6.32.3...v6.33.0)

---
updated-dependencies:
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump Microsoft.IdentityModel.Tokens from 6.32.3 to 6.33.0 in /Backend
abc3c8b 
Bumps [Microsoft.IdentityModel.Tokens](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet) from 6.32.3 to 6.33.0.
- [Release notes](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases)
- [Changelog](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md)
- [Commits](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@6.32.3...v6.33.0)

---
updated-dependencies:
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump react-router-dom from 6.15.0 to 6.16.0
9153773 
Bumps [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) from 6.15.0 to 6.16.0.
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@6.16.0/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: react-router-dom
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump @material-table/core from 6.2.4 to 6.2.11
7ba6b50 
Bumps [@material-table/core](https://github.com/material-table-core/core) from 6.2.4 to 6.2.11.
- [Release notes](https://github.com/material-table-core/core/releases)
- [Changelog](https://github.com/material-table-core/core/blob/master/CHANGELOG.md)
- [Commits](material-table-core/core@v6.2.4...v6.2.11)

---
updated-dependencies:
- dependency-name: "@material-table/core"
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump @mui/material from 5.14.11 to 5.14.12
eecba2c 
Bumps [@mui/material](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material) from 5.14.11 to 5.14.12.
- [Release notes](https://github.com/mui/material-ui/releases)
- [Changelog](https://github.com/mui/material-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/material-ui/commits/v5.14.12/packages/mui-material)

---
updated-dependencies:
- dependency-name: "@mui/material"
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump @types/redux-mock-store from 1.0.3 to 1.0.4
3439bac 
Bumps [@types/redux-mock-store](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/redux-mock-store) from 1.0.3 to 1.0.4.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/redux-mock-store)

---
updated-dependencies:
- dependency-name: "@types/redux-mock-store"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump react-redux from 8.1.2 to 8.1.3
5c2740a 
Bumps [react-redux](https://github.com/reduxjs/react-redux) from 8.1.2 to 8.1.3.
- [Release notes](https://github.com/reduxjs/react-redux/releases)
- [Changelog](https://github.com/reduxjs/react-redux/blob/master/CHANGELOG.md)
- [Commits](reduxjs/react-redux@v8.1.2...v8.1.3)

---
updated-dependencies:
- dependency-name: react-redux
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@jmgrady
Update Python dependencies
c8811b8
@jmgrady
Merge remote-tracking branch 'origin/dependabot/docker/database/mongo…
4131346 
…-7.0.2-jammy' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/github_actions/step-s…
13f905e 
…ecurity/harden-runner-2.6.0' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/github_actions/ossf/s…
17afcc8 
…corecard-action-2.3.0' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/github_actions/action…
8a79c2a 
…s/setup-python-4.7.1' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/github_actions/aws-ac…
b88d5df 
…tions/configure-aws-credentials-4.0.1' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/github_actions/github…
d5d739c 
…/codeql-action-2.22.0' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/nuget/Backend/System.…
dedec47 
…IdentityModel.Tokens.Jwt-6.33.0' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/nuget/Backend/Microso…
eeddd97 
…ft.IdentityModel.Tokens-6.33.0' into dependabot-2023-10-09

# Conflicts:
#	Backend/BackendFramework.csproj
@jmgrady
Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/react-ro…
b44e01b 
…uter-dom-6.16.0' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/react-re…
047b0d8 
…dux-8.1.3' into dependabot-2023-10-09

# Conflicts:
#	package-lock.json
#	package.json
@jmgrady
Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/material…
0000dcc 
…-table/core-6.2.11' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/mui/mate…
008995d 
…rial-5.14.12' into dependabot-2023-10-09
@jmgrady
Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/types/re…
92a7567 
…dux-mock-store-1.0.4' into dependabot-2023-10-09
@jmgrady
Update endpoints for building combine_deploy container
71d945e
@jmgrady
Update security scorecards allowed endpoints
7f14e05
@jmgrady jmgrady added the docker label Oct 9, 2023
@jmgrady jmgrady added python javascript Pull requests that update Javascript code .NET Pull requests that update .net code github_actions Pull requests that update GitHub Actions code labels Oct 9, 2023
@jmgrady jmgrady self-assigned this Oct 9, 2023
@codecov-commenter
Copy link

codecov-commenter commented Oct 9, 2023 •
edited
Loading

Codecov Report

All modified lines are covered by tests ✅

see 1 file with indirect coverage changes

📢 Thoughts on this report? Let us know!.

imnasnainaec
imnasnainaec reviewed Oct 9, 2023
View reviewed changes
Copy link
Collaborator

@imnasnainaec imnasnainaec left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed 15 of 19 files at r2, all commit messages.
Reviewable status: 15 of 19 files reviewed, 1 unresolved discussion (waiting on @jmgrady)

.github/workflows/combine_deploy_image.yml line 23 at r2 (raw file):

          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >

Looking at https://app.stepsecurity.io/github/sillsdev/TheCombine/actions/runs/6458600501, does the list of allowed-endpoints not also need *.dkr.ecr.us-east-1.amazonaws.com:443?

jmgrady
jmgrady commented Oct 9, 2023
View reviewed changes
Copy link
Collaborator Author

@jmgrady jmgrady left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: 15 of 21 files reviewed, 1 unresolved discussion (waiting on @imnasnainaec and @jmgrady)

.github/workflows/combine_deploy_image.yml line 23 at r2 (raw file):

Previously, imnasnainaec (D. Ror.) wrote…

Looking at https://app.stepsecurity.io/github/sillsdev/TheCombine/actions/runs/6458600501, does the list of allowed-endpoints not also need *.dkr.ecr.us-east-1.amazonaws.com:443?

No, it does not. The combine_deploy image is never pushed to the private repository.

imnasnainaec
imnasnainaec reviewed Oct 9, 2023
View reviewed changes
Copy link
Collaborator

@imnasnainaec imnasnainaec left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed 4 of 19 files at r2, 2 of 2 files at r3, all commit messages.
Reviewable status: :shipit: complete! all files reviewed, all discussions resolved (waiting on @jmgrady)

@jmgrady jmgrady marked this pull request as ready for review October 9, 2023 17:25
@jmgrady jmgrady enabled auto-merge (squash) October 9, 2023 17:27
@imnasnainaec imnasnainaec merged commit 6dc3e91 into master Oct 9, 2023
16 checks passed
@imnasnainaec imnasnainaec deleted the dependabot-2023-10-09 branch October 9, 2023 17:55
This was referenced Oct 9, 2023
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@imnasnainaec imnasnainaec imnasnainaec left review comments

Assignees

@jmgrady jmgrady

Labels
docker github_actions Pull requests that update GitHub Actions code javascript Pull requests that update Javascript code .NET Pull requests that update .net code python
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@jmgrady @codecov-commenter @imnasnainaec