From c8ea225274c2f4ebde3a1584691860a6f290ee67 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 13 Oct 2025 09:18:19 +0000 Subject: [PATCH 1/5] Bump github/codeql-action from 3 to 4 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql-analysis.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 96d94b4..820be1f 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -34,7 +34,7 @@ jobs: - name: Initialize CodeQL id: initialize - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: config-file: .github/codeql/codeql-config.yml languages: ${{ matrix.language }} @@ -42,8 +42,8 @@ jobs: - name: Autobuild id: autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@v4 - name: Perform CodeQL Analysis id: analyze - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 From 5ab30f98e3906497e6860d518c64f12128c058cc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Oct 2025 09:24:01 +0000 Subject: [PATCH 2/5] Bump @rollup/rollup-linux-x64-gnu in the npm-production group Bumps the npm-production group with 1 update: [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup). Updates `@rollup/rollup-linux-x64-gnu` from 4.52.4 to 4.52.5 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](https://github.com/rollup/rollup/compare/v4.52.4...v4.52.5) --- updated-dependencies: - dependency-name: "@rollup/rollup-linux-x64-gnu" dependency-version: 4.52.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index e2e77d4..f40071b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3885,9 +3885,9 @@ ] }, "node_modules/@rollup/rollup-linux-x64-gnu": { - "version": "4.52.4", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.52.4.tgz", - "integrity": "sha512-Wi6AXf0k0L7E2gteNsNHUs7UMwCIhsCTs6+tqQ5GPwVRWMaflqGec4Sd8n6+FNFDw9vGcReqk2KzBDhCa1DLYg==", + "version": "4.52.5", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.52.5.tgz", + "integrity": "sha512-hXGLYpdhiNElzN770+H2nlx+jRog8TyynpTVzdlc6bndktjKWyZyiCsuDAlpd+j+W+WNqfcyAWz9HxxIGfZm1Q==", "cpu": [ "x64" ], From 8653c26735956031a0379f5a475805905397b054 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Oct 2025 09:56:21 +0000 Subject: [PATCH 3/5] Bump actions/setup-node from 5 to 6 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-dist.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/licensed.yml | 2 +- .github/workflows/linter.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/check-dist.yml b/.github/workflows/check-dist.yml index a9a8bac..dff65b7 100644 --- a/.github/workflows/check-dist.yml +++ b/.github/workflows/check-dist.yml @@ -32,7 +32,7 @@ jobs: - name: Setup Node.js id: setup-node - uses: actions/setup-node@v5 + uses: actions/setup-node@v6 with: node-version-file: .node-version cache: npm diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f2c7a05..02ff8bc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: - name: Setup Node.js id: setup-node - uses: actions/setup-node@v5 + uses: actions/setup-node@v6 with: node-version-file: .node-version cache: npm diff --git a/.github/workflows/licensed.yml b/.github/workflows/licensed.yml index 00be788..9de7f57 100644 --- a/.github/workflows/licensed.yml +++ b/.github/workflows/licensed.yml @@ -31,7 +31,7 @@ jobs: - name: Setup Node.js id: setup-node - uses: actions/setup-node@v5 + uses: actions/setup-node@v6 with: node-version-file: .node-version cache: npm diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index ee667ca..6b9ef0f 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -32,7 +32,7 @@ jobs: - name: Setup Node.js id: setup-node - uses: actions/setup-node@v5 + uses: actions/setup-node@v6 with: node-version-file: .node-version cache: npm From 4d273edceb27fdba5f10d30f7636983bf1581db2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Oct 2025 09:21:54 +0000 Subject: [PATCH 4/5] Bump actions/upload-artifact from 4 to 5 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-dist.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-dist.yml b/.github/workflows/check-dist.yml index a9a8bac..b64b3f6 100644 --- a/.github/workflows/check-dist.yml +++ b/.github/workflows/check-dist.yml @@ -66,7 +66,7 @@ jobs: - if: ${{ failure() && steps.diff.outcome == 'failure' }} name: Upload Artifact id: upload - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: dist path: dist/ From 2301a6c72e495f470fc8e2b6ff0f3f72a420dd02 Mon Sep 17 00:00:00 2001 From: Nick Alteen Date: Fri, 31 Oct 2025 10:35:06 -0400 Subject: [PATCH 5/5] Add checkov config --- .checkov.yml | 7 +++++++ .github/workflows/linter.yml | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 .checkov.yml diff --git a/.checkov.yml b/.checkov.yml new file mode 100644 index 0000000..63bfa27 --- /dev/null +++ b/.checkov.yml @@ -0,0 +1,7 @@ +# See: https://www.checkov.io/1.Welcome/Quick%20Start.html + +compact: true +quiet: true +skip-path: + - coverage + - node_modules diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index ee667ca..c199bb4 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -32,7 +32,7 @@ jobs: - name: Setup Node.js id: setup-node - uses: actions/setup-node@v5 + uses: actions/setup-node@v6 with: node-version-file: .node-version cache: npm @@ -45,6 +45,7 @@ jobs: id: super-linter uses: super-linter/super-linter/slim@v8 env: + CHECKOV_FILE_NAME: .checkov.yml DEFAULT_BRANCH: main FILTER_REGEX_EXCLUDE: dist/**/* GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}