iframe-proxy

chore(ci): update bump-trivy workflow by @DmitriyLewen in #546
ci: use action.yaml as single source of truth for Trivy version by @nikpivkin in #552
ci: replace peter-evans/create-pull-request with gh CLI by @nikpivkin in #550
test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @nikpivkin in #555
ci: add dependabot config by @nikpivkin in #556
chore: add zizmor config by @nikpivkin in #557
chore(deps): bump the actions group with 5 updates by @dependabot[bot] in #558
fix: use portable shebang in entrypoint.sh by @Hayao0819 in #545
Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @patrik-csak in #547
Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #549 by @Aditya09-cse in #548
chore: use GitHub Actions as git commit author in bump-trivy workflow by @nikpivkin in #561
chore(deps): Update trivy to v0.70.0 by @Argon-DevOps-Mgt in #559
chore: update action version to v0.36.0 in examples by @nikpivkin in #563

New Contributors

@dependabot[bot] made their first contribution in #558
@Hayao0819 made their first contribution in #545
@patrik-csak made their first contribution in #547
@Aditya09-cse made their first contribution in #548
@Argon-DevOps-Mgt made their first contribution in #559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

astral-sh/setup-uv (astral-sh/setup-uv)

`v8.1.0`: 🌈 New input `no-project`

Compare Source

Changes

This add the a new boolean input no-project.
It only makes sense to use in combination with activate-environment: true and will append --no project to the uv venv call. This is for example useful if you have a pyproject.toml file with parts unparseable by uv

🚀 Enhancements

Add input no-project in combination with activate-environment @eifinger (#856)

🧰 Maintenance

fix: grant contents:write to validate-release job @eifinger (#860)
Add a release-gate step to the release workflow @zanieb (#859)
Draft commitish releases @eifinger (#858)
Add action-types.yml to instructions @eifinger (#857)
chore: update known checksums for 0.11.7 @github-actions[bot] (#853)
Refactor version resolving @eifinger (#852)
chore: update known checksums for 0.11.6 @github-actions[bot] (#850)
chore: update known checksums for 0.11.5 @github-actions[bot] (#845)
chore: update known checksums for 0.11.4 @github-actions[bot] (#843)
Add a release workflow @zanieb (#839)
chore: update known checksums for 0.11.3 @github-actions[bot] (#836)

📚 Documentation

Update ignore-nothing-to-cache documentation @eifinger (#833)
Pin setup-uv docs to v8 @eifinger (#829)

⬆️ Dependency updates

chore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 @dependabot[bot] (#855)

docker/build-push-action (docker/build-push-action)

`v7.1.0`

Compare Source

Git context query format support by @crazy-max in #1505
Bump @docker/actions-toolkit from 0.79.0 to 0.87.0 by @crazy-max in #1505
Bump brace-expansion from 1.1.12 to 1.1.13 in #1500
Bump fast-xml-parser from 5.4.2 to 5.5.7 in #1489
Bump flatted from 3.3.3 to 3.4.2 in #1491
Bump glob from 10.3.12 to 10.5.0 in #1490
Bump handlebars from 4.7.8 to 4.7.9 in #1497
Bump lodash from 4.17.23 to 4.18.1 in #1510
Bump picomatch from 4.0.3 to 4.0.4 in #1496
Bump undici from 6.23.0 to 6.24.1 in #1486
Bump vite from 7.3.1 to 7.3.2 in #1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

docker/login-action (docker/login-action)

`v4.1.0`

Compare Source

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in #945
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in #930
Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in #932 #936
Bump brace-expansion from 1.1.12 to 1.1.13 in #952
Bump fast-xml-parser from 5.3.4 to 5.3.6 in #942
Bump flatted from 3.3.3 to 3.4.2 in #944
Bump glob from 10.3.12 to 10.5.0 in #940
Bump handlebars from 4.7.8 to 4.7.9 in #949
Bump http-proxy-agent and https-proxy-agent to 8.0.0 in #937
Bump lodash from 4.17.23 to 4.18.1 in #958
Bump minimatch from 3.1.2 to 3.1.5 in #941
Bump picomatch from 4.0.3 to 4.0.4 in #948
Bump undici from 6.23.0 to 6.24.1 in #938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

github/codeql-action (github/codeql-action)

`v4.35.4`

Compare Source

Update default CodeQL bundle version to 2.25.4. #3881

`v4.35.3`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
Update default CodeQL bundle version to 2.25.3. #3865

`v4.35.2`

Compare Source

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
Update default CodeQL bundle version to 2.25.2. #3823

`v4.35.1`

Compare Source

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

`v4.35.0`

Compare Source

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767
Update default CodeQL bundle version to 2.25.1. #3773

gradle/actions (gradle/actions)

`v6.1.0`

Compare Source

New: Basic Cache Provider

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

Built on @actions/cache -- fully open source
Caches ~/.gradle/caches and ~/.gradle/wrapper directories
Cache key derived from build files (*.gradle*, gradle-wrapper.properties, etc.)
Clean cache on build file changes (no restore keys, preventing stale entry accumulation)

Limitations vs Enhanced Caching: No cache cleanup, no deduplication of cached content, cached content is fixed unless build files change.

Revamped Licensing & Distribution Documentation

New DISTRIBUTION.md documents the licensing of each component (particularly Basic Caching vs Enhanced Caching)
Simplified licensing notices in README, docs, and runtime log output
Clear usage tiers: Enhanced Caching is free for public repos and in Free Preview for private repos

What's Changed

Use a unique cache entry for wrapper-validation test by @bigdaz in #921
Update Dependencies by @bigdaz in #922
Update dependencies and resolve npm vulnerabilities by @bigdaz in #933
Add open-source 'basic' cache provider and revamp licensing documentation by @bigdaz in #930
Restructure caching documentation for basic and enhanced providers by @bigdaz in #934

Full Changelog: gradle/actions@v6.0.1...v6.1.0

`v6.0.1`

Compare Source

[!IMPORTANT]
The release of gradle/actions@v6 contains important changes to the license terms. More details in this blog post.
TL;DR: By upgrading to v6, you accept the Terms of Use for the gradle-actions-caching component.

Summary

The license changes in v6 introduced a gradle-actions-caching license notice that is printed in logs and in each job summary.

With this release, the license notice will be muted if build-scan terms have been accepted, or if a Develocity access key is provided.

What's Changed

Bump actions used in docs by @Goooler in #792
Add typing information for use by typesafegithub by @bigdaz in #910
Mute license warning when terms are accepted by @bigdaz in #911
Mention explicit license acceptance in notice by @bigdaz in #912
Bump com.fasterxml.jackson.dataformat:jackson-dataformat-smile from 2.21.1 to 2.21.2 in /sources/test/init-scripts in the gradle group across 1 directory by @dependabot[bot] in #907

Full Changelog: gradle/actions@v6.0.0...v6.0.1

marocchino/sticky-pull-request-comment (marocchino/sticky-pull-request-comment)

`v3.0.4`

Compare Source

What's Changed

build(deps-dev): Bump vite from 8.0.3 to 8.0.5 by @dependabot[bot] in #1679
build(deps-dev): Bump vitest from 4.1.2 to 4.1.3 by @dependabot[bot] in #1680
build(deps-dev): Bump @types/node from 25.5.2 to 25.6.0 by @dependabot[bot] in #1684
build(deps): Bump @actions/github from 9.0.0 to 9.1.0 by @dependabot[bot] in #1683
build(deps-dev): Bump vitest from 4.1.3 to 4.1.4 by @dependabot[bot] in #1682
build(deps-dev): Bump @biomejs/biome from 2.4.10 to 2.4.11 by @dependabot[bot] in #1681

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.3...v3.0.4

`v3.0.3`

Compare Source

What's Changed

Move validateExclusiveModes before getBody for fail-fast validation by @Copilot in #1663
Add number_force that overrides pull_request number by @rossjrw in #1652
build(deps-dev): Bump @biomejs/biome from 2.4.6 to 2.4.7 by @dependabot[bot] in #1666
build(deps): Bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in #1673
build(deps-dev): Bump vitest from 4.1.0 to 4.1.2 by @dependabot[bot] in #1674
build(deps-dev): Bump rollup from 4.59.0 to 4.60.1 by @dependabot[bot] in #1676
build(deps-dev): Bump @types/node from 25.5.0 to 25.5.2 by @dependabot[bot] in #1677
build(deps-dev): Bump @biomejs/biome from 2.4.7 to 2.4.10 by @dependabot[bot] in #1675
build(deps): Bump brace-expansion by @dependabot[bot] in #1678
build(deps-dev): Bump typescript from 5.9.3 to 6.0.2 by @dependabot[bot] in #1670

New Contributors

@rossjrw made their first contribution in #1652

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.2...v3.0.3

sigstore/cosign-installer (sigstore/cosign-installer)

`v4.1.2`

Compare Source

What's Changed

Bump cosign to 3.0.6 in #232

`v4.1.1`

Compare Source

What's Changed

chore: update default cosign-release to v3.0.5 in #223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

step-security/harden-runner (step-security/harden-runner)

`v2.19.1`

Compare Source

What's Changed

fix: detect ubuntu-slim runners early and bail out by @devantler in #657

What the fix changes

Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers
If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

@devantler made their first contribution in #657

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

`v2.19.0`

Compare Source

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.
System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0

`v2.18.0`

Compare Source

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

`v2.17.0`

Compare Source

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

`v2.16.1`

Compare Source

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list
Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-05-26T18:05:42Z

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	7	0	0	0.1s
✅ COPYPASTE	jscpd	yes	no	no	1.56s
✅ DOCKERFILE	hadolint	1	0	0	0.05s
✅ JSON	jsonlint	3	0	0	0.09s
⚠️ JSON	prettier	3	1	0	0.43s
✅ JSON	v8r	3	0	0	2.85s
✅ PYTHON	bandit	1	0	0	1.63s
✅ PYTHON	black	1	0	0	0.73s
✅ PYTHON	flake8	1	0	0	1.26s
✅ PYTHON	isort	1	0	0	0.38s
✅ PYTHON	mypy	1	0	0	3.44s
✅ PYTHON	pylint	1	0	0	2.88s
✅ PYTHON	pyright	1	0	0	1.79s
✅ PYTHON	ruff	1	0	0	0.04s
✅ REPOSITORY	checkov	yes	no	no	24.73s
✅ REPOSITORY	devskim	yes	no	no	1.58s
✅ REPOSITORY	dustilock	yes	no	no	0.02s
✅ REPOSITORY	gitleaks	yes	no	no	0.32s
✅ REPOSITORY	git_diff	yes	no	no	0.01s
✅ REPOSITORY	grype	yes	no	no	55.44s
✅ REPOSITORY	kics	yes	no	no	3.66s
✅ REPOSITORY	kingfisher	yes	no	no	6.5s
✅ REPOSITORY	secretlint	yes	no	no	1.36s
✅ REPOSITORY	syft	yes	no	no	2.45s
✅ REPOSITORY	trivy	yes	no	no	13.08s
✅ REPOSITORY	trivy-sbom	yes	no	no	0.17s
✅ REPOSITORY	trufflehog	yes	no	no	4.56s
✅ YAML	prettier	9	0	0	1.04s
✅ YAML	v8r	9	0	0	7.56s
✅ YAML	yamllint	9	0	0	0.83s

Detailed Issues

⚠️ JSON / prettier - 1 error

Checking formatting...
[warn] renovate/default.json
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@9.4.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_KICS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

github-actions · 2026-05-26T18:08:48Z

Trivy image scan report

`ghcr.io/miracum/github-reusable-workflow-without-test-image:pr-178 (debian 12.13)`

59 known vulnerabilities found (CRITICAL: 1 HIGH: 11 MEDIUM: 44 LOW: 3)

Show detailed table of vulnerabilities

Package	ID	Severity	Installed Version	Fixed Version
`libc6`	CVE-2026-0915	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4046	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4437	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2025-15281	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-0861	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4438	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libgssapi-krb5-2`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libgssapi-krb5-2`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libk5crypto3`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libk5crypto3`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5-3`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5-3`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5support0`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5support0`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libpython3.11-minimal`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libssl3`	CVE-2026-31789	CRITICAL	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28387	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28388	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28389	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28390	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-31790	MEDIUM	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`python3.11-minimal`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7

No Misconfigurations found

github-actions · 2026-05-26T18:09:00Z

Trivy image scan report

`ghcr.io/miracum/github-reusable-workflow:pr-178 (debian 12.13)`

59 known vulnerabilities found (HIGH: 11 MEDIUM: 44 LOW: 3 CRITICAL: 1)

Show detailed table of vulnerabilities

Package	ID	Severity	Installed Version	Fixed Version
`libc6`	CVE-2026-0915	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4046	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4437	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2025-15281	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-0861	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4438	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libgssapi-krb5-2`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libgssapi-krb5-2`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libk5crypto3`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libk5crypto3`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5-3`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5-3`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5support0`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5support0`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libpython3.11-minimal`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libssl3`	CVE-2026-31789	CRITICAL	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28387	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28388	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28389	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28390	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-31790	MEDIUM	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`python3.11-minimal`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7

No Misconfigurations found

github-actions · 2026-05-26T18:09:08Z

Trivy image scan report

`ghcr.io/miracum/github-reusable-workflow-with-fixed-image-tags:v1.2.3-beta.123 (debian 12.13)`

59 known vulnerabilities found (LOW: 3 CRITICAL: 1 HIGH: 11 MEDIUM: 44)

Show detailed table of vulnerabilities

Package	ID	Severity	Installed Version	Fixed Version
`libc6`	CVE-2026-0915	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4046	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4437	MEDIUM	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2025-15281	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-0861	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libc6`	CVE-2026-4438	LOW	2.36-9+deb12u13	2.36-9+deb12u14
`libgssapi-krb5-2`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libgssapi-krb5-2`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libk5crypto3`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libk5crypto3`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5-3`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5-3`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5support0`	CVE-2026-40356	HIGH	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libkrb5support0`	CVE-2026-40355	MEDIUM	1.20.1-2+deb12u4	1.20.1-2+deb12u5
`libpython3.11-minimal`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-minimal`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libpython3.11-stdlib`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`libssl3`	CVE-2026-31789	CRITICAL	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28387	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28388	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28389	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-28390	HIGH	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`libssl3`	CVE-2026-31790	MEDIUM	3.0.18-1~deb12u2	3.0.19-1~deb12u2
`python3.11-minimal`	CVE-2025-13836	HIGH	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-11468	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-12084	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-13837	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-15282	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-4516	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-6069	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-6075	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-8194	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2025-8291	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-0672	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-0865	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7
`python3.11-minimal`	CVE-2026-1299	MEDIUM	3.11.2-6+deb12u6	3.11.2-6+deb12u7

No Misconfigurations found

github-actions · 2026-05-26T19:07:31Z

chore(deps): update github-actions

1dca874

renovate Bot force-pushed the renovate/github-actions branch from 4320709 to 1dca874 Compare May 26, 2026 18:07

chgl merged commit 602a4dd into master May 26, 2026
33 checks passed

github-actions Bot added the released label May 26, 2026

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update github-actions#178

chore(deps): update github-actions#178
chgl merged 1 commit into
masterfrom
renovate/github-actions

renovate Bot commented May 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Package	Type	Update	Change	Pending
actions/cache	action	patch	`v5.0.4` → `v5.0.5`
actions/create-github-app-token	action	minor	`v3.0.0` → `v3.1.1`	`v3.2.0`
actions/setup-node	action	minor	`v6.3.0` → `v6.4.0`
actions/upload-artifact	action	patch	`v7.0.0` → `v7.0.1`
aquasecurity/trivy-action	action	minor	`0.35.0` → `v0.36.0`
astral-sh/setup-uv	action	minor	`v8.0.0` → `v8.1.0`
docker/build-push-action	action	minor	`v7.0.0` → `v7.1.0`	`v7.2.0`
docker/login-action	action	minor	`v4.0.0` → `v4.1.0`	`v4.2.0`
github/codeql-action	action	minor	`v4.34.1` → `v4.35.4`	`v4.36.0` (+1)
gradle/actions	action	minor	`v6.0.0` → `v6.1.0`
marocchino/sticky-pull-request-comment	action	patch	`v3.0.2` → `v3.0.4`
sigstore/cosign-installer	action	patch	`v4.1.0` → `v4.1.2`
step-security/harden-runner	action	minor	`v2.16.0` → `v2.19.1`	`v2.19.4` (+2)

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Conversation

renovate Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Bug Fixes

Bug Fixes

Features

What's Changed

What's Changed

New Contributors

v8.1.0: 🌈 New input no-project

Changes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

New: Basic Cache Provider

Revamped Licensing & Distribution Documentation

What's Changed

Summary

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Runner Support

Automated Incident Response for Supply Chain Attacks

Bug Fixes

What's Changed

What's Changed

Policy Store Support

What's Changed

Configuration

Uh oh!

github-actions Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅⚠️MegaLinter analysis: Success with warnings

Detailed Issues

Uh oh!

github-actions Bot commented May 26, 2026

Trivy image scan report

ghcr.io/miracum/github-reusable-workflow-without-test-image:pr-178 (debian 12.13)

59 known vulnerabilities found (CRITICAL: 1 HIGH: 11 MEDIUM: 44 LOW: 3)

No Misconfigurations found

Uh oh!

github-actions Bot commented May 26, 2026

Trivy image scan report

ghcr.io/miracum/github-reusable-workflow:pr-178 (debian 12.13)

59 known vulnerabilities found (HIGH: 11 MEDIUM: 44 LOW: 3 CRITICAL: 1)

No Misconfigurations found

Uh oh!

github-actions Bot commented May 26, 2026

Trivy image scan report

ghcr.io/miracum/github-reusable-workflow-with-fixed-image-tags:v1.2.3-beta.123 (debian 12.13)

59 known vulnerabilities found (LOW: 3 CRITICAL: 1 HIGH: 11 MEDIUM: 44)

No Misconfigurations found

Uh oh!

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented May 26, 2026 •

edited

Loading

`v8.1.0`: 🌈 New input `no-project`

github-actions Bot commented May 26, 2026 •

edited

Loading

`ghcr.io/miracum/github-reusable-workflow-without-test-image:pr-178 (debian 12.13)`

`ghcr.io/miracum/github-reusable-workflow:pr-178 (debian 12.13)`

`ghcr.io/miracum/github-reusable-workflow-with-fixed-image-tags:v1.2.3-beta.123 (debian 12.13)`