actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-11-05 19:45:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
954 commits 2 branches 41 tags 20 MiB
Commit graph

150 commits

Author SHA1 Message Date
renovate[bot]
c736581f85 chore(deps): update all dependencies 2023-11-13 09:45:27 +01:00
renovate[bot]
870103b709 chore(deps): update module golang.org/x/text to v0.14.0 2023-11-06 09:43:30 +01:00
renovate[bot]
b50e4936af chore(deps): update all dependencies 2023-10-30 10:16:50 +01:00
renovate[bot]
4656817593 chore(deps): update module github.com/onsi/gomega to v1.28.1 2023-10-23 09:37:22 +02:00
renovate[bot]
7846db034c chore(deps): update all dependencies 2023-10-16 09:29:43 +02:00
dependabot[bot]
5b7867d125
Bump golang.org/x/net from 0.16.0 to 0.17.0 (#1037) 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.16.0 to 0.17.0.
- [Commits](https://github.com/golang/net/compare/v0.16.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-10-12 09:10:25 +02:00
renovate[bot]
7f7c47fefe
chore(deps): update all dependencies (#1026) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-10-09 09:22:00 +02:00
renovate[bot]
665e87b287 chore(deps): update all dependencies 2023-10-05 12:58:26 +02:00
Cosmin Cojocar
ac482cb87c Update ginkgo to latest version 
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
 2023-09-20 10:19:51 +02:00
renovate[bot]
b192f06cca
chore(deps): update all dependencies (#1011) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-09-11 10:53:32 +02:00
renovate[bot]
325eb19a54
chore(deps): update all dependencies (#1008) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-09-04 09:12:42 +02:00
renovate[bot]
4b458c4f59
chore(deps): update all dependencies (#997) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-08-14 09:36:16 +02:00
renovate[bot]
fc2f66bbbb
chore(deps): update all dependencies (#992) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-08-07 09:54:19 +02:00
renovate[bot]
2cf2f96697
chore(deps): update module github.com/onsi/gomega to v1.27.10 (#991) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-07-31 10:23:04 +02:00
renovate[bot]
2292ed5e91
chore(deps): update all dependencies (#989) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-07-24 10:01:22 +02:00
Cosmin Cojocar
36f69332a4
Switch to a maintained fork of zxcvbn module (#984) 
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
 2023-07-17 12:47:26 +02:00
Cosmin Cojocar
ed7b33420e
Fix dependencies after bot update (#983) 
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
 2023-07-17 10:25:11 +02:00
renovate[bot]
e76ad70182
chore(deps): update all dependencies (#982) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-07-17 10:13:40 +02:00
Cosmin Cojocar
ea39309b36
Fix and tidy the dependencies (#977) 
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
 2023-07-10 10:52:16 +02:00
renovate[bot]
ef8f560d84
chore(deps): update all dependencies (#976) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-07-10 10:37:30 +02:00
renovate[bot]
82364a710c
chore(deps): update all dependencies (#974) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-06-19 09:15:01 +02:00
renovate[bot]
022584d770 chore(deps): update all dependencies 2023-06-05 09:29:32 +02:00
renovate[bot]
e1484658ac chore(deps): update all dependencies 2023-05-30 08:25:13 +02:00
renovate[bot]
8632a8c58a
chore(deps): update all dependencies (#956) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-05-15 12:05:59 +02:00
renovate[bot]
970cc2957f
chore(deps): update all dependencies (#955) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-05-03 09:46:14 +02:00
renovate[bot]
440141a948
chore(deps): update all dependencies (#952) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-04-18 10:08:02 +02:00
renovate[bot]
780ebd0819
chore(deps): update all dependencies (#947) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-04-03 10:17:38 +02:00
renovate[bot]
6bad723dfa chore(deps): update all dependencies 2023-03-27 09:16:10 +02:00
renovate[bot]
e7bfcd1d53
chore(deps): update all dependencies (#942) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-03-20 09:23:03 +01:00
dependabot[bot]
e7b896f234 Bump golang.org/x/net from 0.6.0 to 0.7.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.6.0 to 0.7.0.
- [Release notes](https://github.com/golang/net/releases)
- [Commits](https://github.com/golang/net/compare/v0.6.0...v0.7.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-02-20 08:58:52 +01:00
renovate[bot]
e795d75a46
chore(deps): update all dependencies (#931) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-02-13 10:25:24 +01:00
renovate[bot]
54f56c7d6a
chore(deps): update all dependencies (#922) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-02-06 14:16:49 +01:00
renovate[bot]
7dcb8c7436
chore(deps): update module github.com/onsi/ginkgo/v2 to v2.7.0 (#914) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-01-16 09:16:37 +01:00
Cosmin Cojocar
a522ae6f5f
Fix build after updating the dependencies (#910) 2023-01-09 09:42:20 +01:00
renovate[bot]
4cc97adbef
chore(deps): update all dependencies (#909) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-01-09 09:27:57 +01:00
Cosmin Cojocar
05a7bc585d
Fix dependencies after renovate update (#907) 2023-01-02 17:43:42 +01:00
renovate[bot]
11898d512a
chore(deps): update all dependencies (#906) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2023-01-02 17:35:12 +01:00
renovate[bot]
e06bbf9175
chore(deps): update all dependencies (#904) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-12-12 08:46:48 +01:00
renovate[bot]
f79c584dbb
chore(deps): update all dependencies (#898) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-12-05 09:23:50 +01:00
renovate[bot]
2fe6c5b64a
chore(deps): update all dependencies (#894) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-11-27 17:44:24 +01:00
renovate[bot]
a0b7ebb312
chore(deps): update all dependencies (#892) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-11-14 09:16:07 +01:00
renovate[bot]
6a964b2a86
chore(deps): update all dependencies (#888) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-11-08 09:37:54 +01:00
renovate[bot]
26f038913f
chore(deps): update all dependencies (#886) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-31 09:23:49 +01:00
renovate[bot]
7f91d85b65
chore(deps): update all dependencies (#884) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-24 09:20:26 +02:00
renovate[bot]
a2719d3248
chore(deps): update all dependencies (#881) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-17 10:14:22 +02:00
Sebastiaan van Stijn
ed386818fd
go.mod: ginkgo/v2 v2.3.1, golang.org/x/text v0.3.8, update go versions (#880) 
* gha: remove go1.17, temporarily force 1.18.7, 1.19.2

The  security scanner is flagging the code to have a vulnerability, but it's
detecting that we're running go1.18.6, not "latest" (go1.18.7 at time of writing).

Temporarily pinning to go1.18.7 to force installing the latest version:

    Vulnerability #1: GO-2022-1039
      Programs which compile regular expressions from untrusted
      sources may be vulnerable to memory exhaustion or denial of
      service. The parsed regexp representation is linear in the size
      of the input, but in some cases the constant factor can be as
      high as 40,000, making relatively small regexps consume much
      larger amounts of memory. After fix, each regexp being parsed is
      limited to a 256 MB memory footprint. Regular expressions whose
      representation would use more space than that are rejected.
      Normal use of regular expressions is unaffected.

      Call stacks in your code:
      Error:       helpers.go:463:26: github.com/securego/gosec/v2.ExcludedDirsRegExp calls regexp.MustCompile, which eventually calls regexp/syntax.Parse

      Found in: regexp/syntax@go1.18.6
      Fixed in: regexp/syntax@go1.19.2
      More info: https://pkg.go.dev/vuln/GO-2022-1039

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

* go.mod: github.com/onsi/ginkgo/v2 v2.3.1

CI was failing because of a mismatch:

    /home/runner/go/bin/ginkgo -v --fail-fast
    Ginkgo detected a version mismatch between the Ginkgo CLI and the version of Ginkgo imported by your packages:
      Ginkgo CLI Version:
        2.3.1
      Mismatched package versions found:
       2.2.0 used by gosec

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

* go.mod: golang.org/x/text v0.3.8

to address GO-2022-1059

    The vulnerabilities below are in packages that you import, but your code
    doesn't appear to call any vulnerable functions. You may not need to take any
    action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
    for details.

    Vulnerability #1: GO-2022-1059
      An attacker may cause a denial of service by crafting an Accept-Language
      header which ParseAcceptLanguage will take significant time to parse.

      Found in: golang.org/x/text/language@v0.3.7
      Fixed in: golang.org/x/text/language@v0.3.8
      More info: https://pkg.go.dev/vuln/GO-2022-1059

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2022-10-17 10:05:13 +02:00
renovate[bot]
f9ad0d88a1
chore(deps): update all dependencies (#875) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-10 09:27:01 +02:00
renovate[bot]
bb4a1e3544
chore(deps): update all dependencies (#872) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-04 09:23:21 +02:00
renovate[bot]
e244c811ea
chore(deps): update all dependencies (#868) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-09-22 11:18:20 +02:00
renovate[bot]
180fc23b72 chore(deps): update all dependencies 2022-09-12 09:35:57 +02:00