From d18463bdd20ec7f2bbc879268c8b7a2eaf3091c8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 Mar 2024 12:01:22 +0100
Subject: [PATCH] chore(deps): bump anchore/sbom-action from 0.15.9 to 0.15.10
(#30)
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from
0.15.9 to 0.15.10.
Release notes
Sourced from anchore/sbom-action's
releases.
v0.15.10
Changes in v0.15.10
Commits
ab5d7b5
chore(deps): update Syft to v1.1.0 (#454)6e7f9d7
chore(deps): bump release-drafter/release-drafter from 5.25.0 to 6.0.0
(#450)2d906a3
chore(deps): bump peter-evans/create-or-update-comment (#452)691c762
chore(deps): bump peter-evans/create-pull-request from 5.0.2 to 6.0.2
(#453)f0dafef
chore(deps): bump actions/checkout from 4.1.1 to 4.1.2 (#451)c6d7b2a
chore: add dependabot configuration for actions (#449)31e2bb2
chore(deps): update @types/node to Node 20 (#443)670514f
chore: Bump Node to v20 on download-syft/publish-sbom actions (#448)a5afbb1
chore(deps): update Syft to v1.0.1 (#444)- See full diff in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/build.yml | 2 +-
.github/workflows/release.yml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b7205bd..6f76d09 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -89,7 +89,7 @@ jobs:
- uses: sigstore/cosign-installer@v3.4.0
- - uses: anchore/sbom-action/download-syft@v0.15.9
+ - uses: anchore/sbom-action/download-syft@v0.15.10
- name: setup-validate-krew-manifest
run: go install sigs.k8s.io/krew/cmd/validate-krew-manifest@latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e0fb547..4ff442a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
- uses: sigstore/cosign-installer@v3.4.0
- - uses: anchore/sbom-action/download-syft@v0.15.9
+ - uses: anchore/sbom-action/download-syft@v0.15.10
- name: ghcr-login
uses: docker/login-action@v3