chore(deps): update github-actions

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/dependency-review-action	action	patch	v3.1.0 -> v3.1.5
actions/setup-node	action	patch	v3.8.1 -> v3.8.2
github/codeql-action	action	minor	v2.22.1 -> v2.24.8
ossf/scorecard-action	action	patch	v2.3.0 -> v2.3.1
slsa-framework/slsa-github-generator	action	minor	v1.9.0 -> v1.10.0
slsa-framework/slsa-verifier	action	patch	v2.4.0 -> v2.4.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/dependency-review-action (actions/dependency-review-action)

v3.1.5: 3.1.5

Compare Source

What's Changed

• Smaller per_page when requesting diff by @​hmaurer in https://github.com/actions/dependency-review-action/pull/649
• Update dependencies:
  • Bump @​typescript-eslint/parser from 6.10.0 to 6.13.1 by @​dependabot in https://github.com/actions/dependency-review-action/pull/630
  • Bump prettier from 3.0.3 to 3.1.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/629
  • Bump @​types/jest from 29.5.8 to 29.5.11 by @​dependabot in https://github.com/actions/dependency-review-action/pull/637
  • Bump nodemon from 3.0.1 to 3.0.2 by @​dependabot in https://github.com/actions/dependency-review-action/pull/636
  • Replace pip -> pypi in PURL examples by @​febuiles in https://github.com/actions/dependency-review-action/pull/638
  • Bump @​typescript-eslint/eslint-plugin from 6.12.0 to 6.15.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/644
  • Bump eslint from 8.53.0 to 8.56.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/640
  • Bump @​typescript-eslint/parser from 6.13.1 to 6.16.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/645
  • Bump prettier from 3.1.0 to 3.1.1 by @​dependabot in https://github.com/actions/dependency-review-action/pull/646

Full Changelog: actions/dependency-review-action@v3.1.4...v3.1.5

v3.1.4: 3.1.4

Compare Source

What's Changed

• Fixed a bug with severity filtering when using the allow_ghsas option: https://github.com/actions/dependency-review-action/pull/623.

• Updates dependencies:

  • Bump @​types/node from 16.18.61 to 16.18.62 by @​dependabot in https://github.com/actions/dependency-review-action/pull/619
    action/pull/620
  • Bump @​typescript-eslint/eslint-plugin from 6.11.0 to 6.12.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/625
  • Bump typescript from 5.2.2 to 5.3.2 by @​dependabot in https://github.com/actions/dependency-review-action/pull/624

Full Changelog: actions/dependency-review-action@v3...v3.1.4

v3.1.3: 3.1.3

Compare Source

What's Changed

• Fixes purl "version must be percent-encoded" by @​theztefan in https://github.com/actions/dependency-review-action/pull/617

Full Changelog: actions/dependency-review-action@v3...v3.1.3

v3.1.2: 3.1.2

Compare Source

What's Changed

• Fix a regression for setups using self-hosted runners behind HTTP proxies:@​febuiles in https://github.com/actions/dependency-review-action/pull/611

Full Changelog: actions/dependency-review-action@v3...v3.1.2

v3.1.1: 3.1.1

Compare Source

What's Changed

• Update a bunch of dependencies, including major version upgrades for octokit, @actions/github and typescript.

Full Changelog: actions/dependency-review-action@v3.1.0...v3.1.1

actions/setup-node (actions/setup-node)

v3.8.2

Compare Source

What's Changed

• Update semver by @​dmitry-shibanov in https://github.com/actions/setup-node/pull/861
• Update temp directory creation by @​nikolai-laevskii in https://github.com/actions/setup-node/pull/859
• Bump @​babel/traverse from 7.15.4 to 7.23.2 by @​dependabot in https://github.com/actions/setup-node/pull/870
• Add notice about binaries not being updated yet by @​nikolai-laevskii in https://github.com/actions/setup-node/pull/872
• Update toolkit cache and core by @​dmitry-shibanov and @​seongwon-privatenote in https://github.com/actions/setup-node/pull/875

Full Changelog: actions/setup-node@v3...v3.8.2

github/codeql-action (github/codeql-action)

v2.24.8

Compare Source

v2.24.7

Compare Source

v2.24.6

Compare Source

v2.24.5

Compare Source

v2.24.4

Compare Source

v2.24.3

Compare Source

v2.24.2

Compare Source

v2.24.1

Compare Source

v2.24.0

Compare Source

v2.23.2

Compare Source

v2.23.1

Compare Source

v2.23.0

Compare Source

v2.22.12

Compare Source

v2.22.11

Compare Source

v2.22.10

Compare Source

v2.22.9

Compare Source

v2.22.8

Compare Source

v2.22.7

Compare Source

v2.22.6

Compare Source

v2.22.5

Compare Source

v2.22.4

Compare Source

v2.22.3

Compare Source

v2.22.2

Compare Source

ossf/scorecard-action (ossf/scorecard-action)

v2.3.1

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1282
  • Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes

Full Changelog: ossf/scorecard-action@v2.3.0...v2.3.1

slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)

v1.10.0

Compare Source

Release [v1.10.0] includes bug fixes and new features.

See the full change list.

v1.10.0: TUF fix

• The cosign TUF roots were fixed (#​3350). More details here.

v1.10.0: Gradle Builder

• The Gradle Builder was fixed when the project root is the same as the
  repository root (#​2727)

v1.10.0: Go Builder

• The go-version-file input was fixed so that it can find the go.mod file
  (#​2661)

v1.10.0: Container Generator

• A new provenance-repository input was added to allow reading provenance from
  a different container repository than the image itself (#​2956)

v1.9.1

Compare Source

This is an un-finalized release.

See the CHANGELOG for details.

slsa-framework/slsa-verifier (slsa-framework/slsa-verifier)

v2.4.1

Compare Source

What's Changed

• Fix a verification issue when verifying npm's publish attestations - Low severity GHSA-r2xv-vpr2-42m9. This part of the code remains experimental.

New Contributors

• @​trishankatdatadog made their first contribution in https://github.com/slsa-framework/slsa-verifier/pull/702

Full Changelog: v2.4.0...v2.4.1

---

Configuration

📅 Schedule: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.