Search before asking
Enhancement Request
It looks like there are new unpinned dependencies that are being reported against Shiro:
Pinned-Dependencies
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/labeler.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/shiro/labeler.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pre-commit.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/shiro/pre-commit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pre-commit.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/shiro/pre-commit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pre-commit.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/shiro/pre-commit.yml/main?enable=pin
Warn: pipCommand not pinned by hash: .github/workflows/pre-commit.yml:42
Warn: pipCommand not pinned by hash: .github/workflows/pre-commit.yml:43
Info: 13 out of 17 GitHub-owned GitHubAction dependencies pinned
Info: 1 out of 1 third-party GitHubAction dependencies pinned
Info: 0 out of 2 pipCommand dependencies pinned
Describe the solution you'd like
Fix this / pin with a hash
Are you willing to submit PR?
Search before asking
Enhancement Request
It looks like there are new unpinned dependencies that are being reported against Shiro:
Describe the solution you'd like
Fix this / pin with a hash
Are you willing to submit PR?