Skip to content

Conversation

@renovate-sh-app
Copy link

This PR contains the following updates:

Package Change Age Confidence
github.com/mstoykov/envconfig v1.4.1-0.20220114105314-765c6d8c76f1 -> v1.5.0 age confidence

Release Notes

mstoykov/envconfig (github.com/mstoykov/envconfig)

v1.5.0

Compare Source


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

| datasource | package                       | from                                 | to     |
| ---------- | ----------------------------- | ------------------------------------ | ------ |
| go         | github.com/mstoykov/envconfig | v1.4.1-0.20220114105314-765c6d8c76f1 | v1.5.0 |


Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
@github-actions
Copy link

github-actions bot commented Dec 2, 2025

😢 zizmor failed with exit code 14.

Expand for full output
error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/all.yml:34:9
   |
34 |         uses: golangci/golangci-lint-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/all.yml:26:9
   |
 2 | / on:
 3 | |   # Enable manually triggering this workflow via the API or web UI
 4 | |   workflow_dispatch:
 5 | |   push:
...  |
 9 | |       - v*
10 | |   pull_request:
   | |_______________- generally used when publishing artifacts generated at runtime
...
26 |           uses: actions/setup-go@v3
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/all.yml:51:9
   |
 2 | / on:
 3 | |   # Enable manually triggering this workflow via the API or web UI
 4 | |   workflow_dispatch:
 5 | |   push:
...  |
 9 | |       - v*
10 | |   pull_request:
   | |_______________- generally used when publishing artifacts generated at runtime
...
51 |           uses: actions/setup-go@v3
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/all.yml:56:9
   |
 2 | / on:
 3 | |   # Enable manually triggering this workflow via the API or web UI
 4 | |   workflow_dispatch:
 5 | |   push:
...  |
 9 | |       - v*
10 | |   pull_request:
   | |_______________- generally used when publishing artifacts generated at runtime
...
56 |           uses: actions/setup-go@v3
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/all.yml:81:9
   |
 2 | / on:
 3 | |   # Enable manually triggering this workflow via the API or web UI
 4 | |   workflow_dispatch:
 5 | |   push:
...  |
 9 | |       - v*
10 | |   pull_request:
   | |_______________- generally used when publishing artifacts generated at runtime
...
81 |           uses: actions/setup-go@v3
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

15 findings (7 ignored, 3 suppressed, 4 fixable): 0 informational, 0 low, 0 medium, 5 high

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants