From 66493a2f02ef52aba0108f4a6b012965e8af0074 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Apr 2025 13:05:25 +0000 Subject: [PATCH 1/3] Bump actions/setup-node in the actions-dependencies group Bumps the actions-dependencies group with 1 update: [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/setup-node` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4.2.0...v4.4.0) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/check-dist.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-dist.yml b/.github/workflows/check-dist.yml index 21bcd10..7ab150c 100644 --- a/.github/workflows/check-dist.yml +++ b/.github/workflows/check-dist.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@v4 - name: Set Node.js 16.x - uses: actions/setup-node@v4.2.0 + uses: actions/setup-node@v4.4.0 with: node-version: 16.x From 7eebd4d574f0e74e2407113d7a0bc7256188e12c Mon Sep 17 00:00:00 2001 From: Chad Bentz <1760475+felickz@users.noreply.github.com> Date: Mon, 12 May 2025 17:29:23 -0400 Subject: [PATCH 2/3] Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .github/workflows/check-dist.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/check-dist.yml b/.github/workflows/check-dist.yml index 21bcd10..3e1880b 100644 --- a/.github/workflows/check-dist.yml +++ b/.github/workflows/check-dist.yml @@ -4,6 +4,8 @@ # For our project, we generate this file through a build process from other source files. # We need to make sure the checked-in `index.js` actually matches what we expect it to be. name: Check dist/ +permissions: + contents: read on: push: From 7cfdb92164a643cf688bfb5367291f58b4542ea2 Mon Sep 17 00:00:00 2001 From: Chad Bentz <1760475+felickz@users.noreply.github.com> Date: Mon, 12 May 2025 17:30:29 -0400 Subject: [PATCH 3/3] Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .github/workflows/test.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a85fb07..90e30ff 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,4 +1,6 @@ name: "Test" +permissions: + contents: read on: pull_request: workflow_dispatch: