Empty commit to open PR

Merge upstream:main
Bump the npm_and_yarn group across 2 directories with 2 updates (#190 )
2026-04-20 00:56:27 +00:00 · 2026-04-20 00:56:27 +00:00 · 2026-04-14 16:57:05 -04:00 · 2026-04-14 16:54:49 -04:00 · 2026-04-14 16:41:04 -04:00 · 2026-03-19 17:29:33 +01:00
16 changed files with 64237 additions and 6132 deletions
@@ -23,10 +23,10 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Set Node.js 16.x
-        uses: actions/setup-node@v6.2.0
+        uses: actions/setup-node@v4.4.0
        with:
          node-version: 16.x

@@ -46,7 +46,7 @@ jobs:
        id: diff

      # If index.js was different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v4
        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
        with:
          name: dist
@@ -0,0 +1,42 @@
+name: Sync Fork with Upstream
+on:
+  schedule:
+    - cron: '0 0 * * 1'  # Runs at midnight UTC every Monday
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Fetch Upstream Remote
+        run: |
+          git remote add upstream https://github.com/advanced-security/component-detection-dependency-submission-action.git
+          git fetch upstream
+      - name: Set Git Config
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - name: Create and Push Branch
+        run: |
+          git checkout -b weekly-sync-branch-${{ github.run_id }}
+          git merge upstream/main --no-commit
+          git reset -- ./.github
+          git commit -m "Merge upstream:main"
+          git commit --allow-empty -m "Empty commit to open PR"
+          git push --set-upstream origin weekly-sync-branch-${{ github.run_id }}
+      - name: Open Pull Request
+        run: |
+          gh repo set-default actions/component-detection-dependency-submission-action
+          gh pr create -B main -H weekly-sync-branch-${{ github.run_id }} --title 'Sync Fork with Upstream' --body 'Weekly Cron. Created by GitHub Actions.'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -16,7 +16,7 @@ jobs:
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 
    steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
    - name: Unit test
      run: |
        npm install
@@ -1 +1 @@
-* @advanced-security/advanced-security-dependency-graph @advanced-security/oss-maintainers
+* @advanced-security/advanced-security-dependency-graph
@@ -2,7 +2,7 @@

 This GitHub Action runs the [microsoft/component-detection](https://github.com/microsoft/component-detection) library to automate dependency extraction at build time. It uses a combination of static and dynamic scanning to build a dependency tree and then uploads that to GitHub's dependency graph via the dependency submission API. This gives you more accurate Dependabot alerts, and support for a bunch of additional ecosystems.

-### Example workflow
+### Example workflows

 ```yaml

@@ -25,13 +25,40 @@ jobs:
        uses: advanced-security/[email protected]
 ```

+Additional `Experimental` and `DefaultOff`  detectors:
+- For a list of experimental and default-off detectors that require explicit enablement, see the [Detectors README](https://github.com/microsoft/component-detection/blob/main/docs/detectors/README.md). See [enable-default-off.md](https://github.com/microsoft/component-detection/blob/main/docs/enable-default-off.md) for more details.
+
+```yaml
+name: Component Detection
+
+on:
+  workflow_dispatch:
+  push:
+
+permissions:
+  id-token: write
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Component detection
+        uses: advanced-security/[email protected]
+        with:
+          # Experimental detectors: Poetry, UvLock, NpmLockfile3, Ivy
+          # Default-off detectors: ConanLock, CondaLock, Dockerfile, Pip, SimplePip, Spdx22, Swift
+          detectorArgs: Poetry=EnableIfDefaultOff,UvLock=EnableIfDefaultOff,NpmLockfile3=EnableIfDefaultOff,Ivy=EnableIfDefaultOff,ConanLock=EnableIfDefaultOff,CondaLock=EnableIfDefaultOff,Dockerfile=EnableIfDefaultOff,Pip=EnableIfDefaultOff,SimplePip=EnableIfDefaultOff,Spdx22=EnableIfDefaultOff,Swift=EnableIfDefaultOff
+```
+
 ### Configuration options

 | Parameter | Description | Example |
 | --- | --- | --- |
 filePath | The path to the directory containing the environment files to upload. Defaults to Actions working directory. | `'.'`
 directoryExclusionList | Filters out specific directories following a minimatch pattern. | `test`
-detectorArgs | Comma separated list of properties that can affect the detectors execution, like EnableIfDefaultOff that allows a specific detector that is in beta to run, the format for this property is DetectorId=EnableIfDefaultOff, for example Pip=EnableIfDefaultOff. | `Pip=EnableIfDefaultOff`
+detectorArgs | Comma separated list of properties that can affect the detectors execution, like EnableIfDefaultOff that allows a specific detector that is `Experimental` or `DefaultOff` to run, the format for this property is DetectorId=EnableIfDefaultOff, for example Pip=EnableIfDefaultOff. | `Pip=EnableIfDefaultOff`
 dockerImagesToScan |Comma separated list of docker image names or hashes to execute container scanning on |  ubuntu:16.04,56bab49eef2ef07505f6a1b0d5bd3a601dfc3c76ad4460f24c91d6fa298369ab |
 detectorsFilter | A comma separated list with the identifiers of the specific detectors to be used. | `Pip, RustCrateDetector`
 detectorsCategories | A comma separated list with the categories of components that are going to be scanned. The detectors that are going to run are the ones that belongs to the categories. | `NuGet,Npm`
@@ -43,7 +43,7 @@ inputs:
    description: 'The Git reference to associate with the snapshot. If provided, snapshot-sha must also be provided.'
    required: false
 runs:
-  using: 'node20'
+  using: 'node24'
  main: 'dist/index.js'
 branding:
  icon: 'upload-cloud'
@@ -14,7 +14,6 @@ import tar from 'tar'
 import fs from 'fs'
 import * as exec from '@actions/exec';
 import dotenv from 'dotenv'
-import { Context } from '@actions/github/lib/context'
 import { unmockedModulePathPatterns } from './jest.config'
 import path from 'path';
 dotenv.config();
@@ -26,23 +26,23 @@
  },
  "homepage": "https://github.com/advanced-security/component-detection-dependency-submission-action#readme",
  "dependencies": {
-    "@actions/core": "^2.0.2",
-    "@actions/github": "^7.0.0",
+    "@actions/core": "^3.0.0",
+    "@actions/github": "^9.0.0",
    "@github/dependency-submission-toolkit": "^2.0.5",
    "cross-fetch": "^4.1.0",
-    "dotenv": "^17.2.3",
+    "dotenv": "^17.3.1",
    "fs": "^0.0.1-security",
    "octokit": "^5.0.5",
-    "tar": "^7.5.4",
+    "tar": "^7.5.11",
    "yaml": "^2.8.2"
  },
  "devDependencies": {
-    "@babel/preset-env": "^7.28.6",
+    "@babel/preset-env": "^7.29.0",
    "@babel/preset-typescript": "^7.28.5",
-    "@eslint/js": "^9.39.2",
+    "@eslint/js": "^10.0.1",
    "@types/jest": "^30.0.0",
    "@vercel/ncc": "^0.38.4",
-    "eslint": "^9.39.2",
+    "eslint": "^10.0.3",
    "jest": "^30.2.0",
    "jest-transform-stub": "^2.0.0",
    "ts-jest": "^29.4.6"
@@ -8,7 +8,7 @@
      "name": "nested-test-package",
      "version": "1.0.0",
      "dependencies": {
-        "lodash": "^4.17.23"
+        "lodash": "^4.18.1"
      },
      "devDependencies": {
        "jest": "^29.0.0"
@@ -24,9 +24,9 @@
      }
    },
    "node_modules/lodash": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
      "license": "MIT"
    }
  }
@@ -4,7 +4,7 @@
  "description": "A nested test package for component detection testing",
  "main": "index.js",
  "dependencies": {
-    "lodash": "^4.17.23"
+    "lodash": "^4.18.1"
  },
  "devDependencies": {
    "jest": "^29.0.0"
@@ -15,7 +15,7 @@
        "cross-fetch": "^3.1.5",
        "dotenv": "^16.0.3",
        "fs": "^0.0.1-security",
-        "tar": "^7.5.4",
+        "tar": "^7.5.11",
        "yaml": "^2.2.2"
      },
      "devDependencies": {
@@ -2533,10 +2533,11 @@
      }
    },
    "node_modules/flatted": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.4.tgz",
-      "integrity": "sha512-8/sOawo8tJ4QOBX8YlQBMxL8+RLZfxMQOif9o0KUKTNTjMYElWPE0r/m5VNFxTRd0NSw8qSy8dajrwX4RYI1Hw==",
-      "dev": true
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "dev": true,
+      "license": "ISC"
    },
    "node_modules/fs": {
      "version": "0.0.1-security",
@@ -3716,9 +3717,9 @@
      }
    },
    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
      "dev": true,
      "dependencies": {
        "brace-expansion": "^1.1.7"
@@ -4368,9 +4369,9 @@
      }
    },
    "node_modules/tar": {
-      "version": "7.5.4",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.4.tgz",
-      "integrity": "sha512-AN04xbWGrSTDmVwlI4/GTlIIwMFk/XEv7uL8aa57zuvRy6s4hdBed+lVq2fAZ89XDa7Us3ANXcE3Tvqvja1kTA==",
+      "version": "7.5.11",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.11.tgz",
+      "integrity": "sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==",
      "dependencies": {
        "@isaacs/fs-minipass": "^4.0.0",
        "chownr": "^3.0.0",
@@ -6739,9 +6740,9 @@
      }
    },
    "flatted": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.4.tgz",
-      "integrity": "sha512-8/sOawo8tJ4QOBX8YlQBMxL8+RLZfxMQOif9o0KUKTNTjMYElWPE0r/m5VNFxTRd0NSw8qSy8dajrwX4RYI1Hw==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
      "dev": true
    },
    "fs": {
@@ -7633,9 +7634,9 @@
      "dev": true
    },
    "minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
      "dev": true,
      "requires": {
        "brace-expansion": "^1.1.7"
@@ -8091,9 +8092,9 @@
      "dev": true
    },
    "tar": {
-      "version": "7.5.4",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.4.tgz",
-      "integrity": "sha512-AN04xbWGrSTDmVwlI4/GTlIIwMFk/XEv7uL8aa57zuvRy6s4hdBed+lVq2fAZ89XDa7Us3ANXcE3Tvqvja1kTA==",
+      "version": "7.5.11",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.11.tgz",
+      "integrity": "sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==",
      "requires": {
        "@isaacs/fs-minipass": "^4.0.0",
        "chownr": "^3.0.0",
@@ -31,7 +31,7 @@
    "cross-fetch": "^3.1.5",
    "dotenv": "^16.0.3",
    "fs": "^0.0.1-security",
-    "tar": "^7.5.4",
+    "tar": "^7.5.11",
    "yaml": "^2.2.2"
  },
  "devDependencies": {
@@ -1,7 +1,8 @@
 {
    "compilerOptions": {
-      "target": "es6", /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-      "module": "commonjs", /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
+      "target": "ES2022", /* Specify ECMAScript target version */
+      "module": "ES2022", /* Specify module code generation */
+      "moduleResolution": "node", /* Specify module resolution strategy: 'node' or 'classic'. */
      "outDir": "./dist", /* Redirect output structure to the directory. */
      "rootDir": "./", /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
      "strict": true, /* Enable all strict type-checking options. */