Skip to content

Fix formatting in dependabot.yml - #123

Merged
lisagorewitdecker merged 3 commits into
devfrom
lisagorewitdecker-patch-1
Aug 17, 2026
Merged

Fix formatting in dependabot.yml#123
lisagorewitdecker merged 3 commits into
devfrom
lisagorewitdecker-patch-1

Conversation

@lisagorewitdecker

Copy link
Copy Markdown
Owner

No description provided.

Signed-off-by: lisagorewitdecker <50784106+lisagorewitdecker@users.noreply.github.com>
Copilot AI lite review requested due to automatic review settings August 17, 2026 19:29

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@lisagorewitdecker

Copy link
Copy Markdown
Owner Author

@copilot fix all security vulnerabilities associated with this PR, please.

Co-authored-by: lisagorewitdecker <50784106+lisagorewitdecker@users.noreply.github.com>

Copilot AI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot fix all security vulnerabilities associated with this PR, please.

Fixed in commit Pin GitHub Actions to SHA hashes in codeql-advanced.yml. The new codeql-advanced.yml workflow was using mutable version tags (@v4) for GitHub Actions, which is a supply chain security vulnerability. I've pinned all three actions to their specific commit SHAs:

  • actions/checkout@v4actions/checkout@11d5960a326750d5838078e36cf38b85af677262
  • github/codeql-action/init@v4github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd
  • github/codeql-action/analyze@v4github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd

@lisagorewitdecker lisagorewitdecker left a comment

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK

Signed-off-by: lisagorewitdecker <50784106+lisagorewitdecker@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@lisagorewitdecker lisagorewitdecker self-assigned this Aug 17, 2026
@lisagorewitdecker
lisagorewitdecker merged commit c547faf into dev Aug 17, 2026
6 of 7 checks passed
@lisagorewitdecker
lisagorewitdecker deleted the lisagorewitdecker-patch-1 branch August 17, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants