build(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 - #1132
build(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2#1132dependabot[bot] wants to merge 2 commits into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
@dependabot rebase |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact head b214f940e8904594d9467e705199db0274cf5fb0 only advances the pinned anchore/sbom-action revision from v0.24.0 to v0.24.2 in the existing SBOM workflow locations; no product/runtime dependency or permission surface is added. The live protected-base movement since this PR was opened is one disjoint Tauri Cargo.lock uuid update, so there is no semantic overlap. Existing local CI/security/build/SBOM runs on this head were successful; the previously cancelled Strix job has been explicitly re-requested and current central OpenCode evidence remains non-passing until it actually completes. This approval is exact-head review evidence only and does not treat queued/cancelled checks as passing.
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.24.0 to 0.24.2. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@e22c389...3ad7283) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
b214f94 to
e7f59f1
Compare
…/sbom-action-0.24.2
1 participant
Bumps anchore/sbom-action from 0.24.0 to 0.24.2.
Release notes
Sourced from anchore/sbom-action's releases.
Commits
3ad7283ops: update write permissions for release (#723)31f5287chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#724)aa80c8cchore(deps): update Syft to latest release (#722)74b54e9chore(deps): bump lodash from 4.17.23 to 4.18.1 (#623)6b92ff5chore(deps-dev): bump tsx from 4.23.11 to 4.23.12 (#721)4f8983bchore(deps-dev): bump typescript-eslint from 8.65.0 to 8.67.0 (#719)10f27f4chore(deps-dev): bump eslint from 10.5.0 to 10.8.1 (#720)249403achore(deps-dev): bump@types/nodefrom 26.1.0 to 26.2.0 (#718)cbf8daachore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml (#693)6afc793fix: pin syft install.sh to the release tag being installed (#716)