Skip to content

chore(deps): bump securego/gosec from 2.22.9 to 2.27.1#10147

Merged
mudler merged 1 commit into
masterfrom
dependabot/github_actions/securego/gosec-2.27.1
Jun 3, 2026
Merged

chore(deps): bump securego/gosec from 2.22.9 to 2.27.1#10147
mudler merged 1 commit into
masterfrom
dependabot/github_actions/securego/gosec-2.27.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 3, 2026

Copy link
Copy Markdown
Contributor

Bumps securego/gosec from 2.22.9 to 2.27.1.

Release notes

Sourced from securego/gosec's releases.

v2.27.1

Changelog

  • 9e6a9843d7a4a6e3e9a8539b02612c8a4aa3f889 Downgrade google lib to avoid min Go version bump (#1687)

v2.27.0

Changelog

  • 0a5c6504c46569257663726ac54c7cfdad42e846 Downgrade the jsonschema dep to v0.13.0 due to incompatibility with anthropick-sdk-go (#1686)
  • b48e668764ca9fd826a7b84c9e9194af3227fade Update all dependencies (#1685)
  • bd17b2589eb634e511b352f14fc30cb40863eefe Downgrade the github.com/invopop/jsonschema v0.13.0 to solve incopatibility with anthropic-sdk (#1683)
  • c6f8c3d9a75d897612c7beb55007ac5f29b2e3a2 Update all dependencies (#1682)
  • 5676cbccda635b33fab15bb85e32b2e741c9372f Update vulnerabilities alerts for indirect dependencies
  • ce167d4a37bc5fe3f49bb9be3209f9759b69ff6f Pin dependencies (#1681)
  • 74b726dfcebf218a1984a51b44fe962aecef5921 Skip pining for my repos
  • a68f8825bfa51b46cc517a5cd8baf4848e03a8d1 Update renovate configuration
  • 2f8791bad7bf8f6a11f0b29e41aec54ddb9fcb0b Fix typo
  • ad3778a7be907bf4e5cf5ed5c63333a377f3fb3b Update branch config in renovate config
  • b1583fe2f3ffb41074cb11996e58ca554c6c04e7 Migrate config renovate.json (#1678)
  • 139e33d474374c8e26a0e480f077526e131f43bb Update renovate to refresh the branch creation
  • f3c03ebb7f077f9b9ddfc64f710e0a2d2e92ded4 Update the renovate branch prefix
  • 85814f2e3964a6d38aeb6e6002ac9268c16fcab5 Update renovate config to pin the actions dependencies by digests (#1676)
  • 55f051973281b15900b2b8b30aaf467a7b9127ea Migrate the html remport to react v19. (#1675)
  • 6ad4476d269895a4a9b77883b3e3503f7e5e4103 Manually update version to fix renovate (#1674)
  • 8f88312a5f80dbf04d2248d75c372d165e54e589 feat: integrate Atlas Cloud provider (#1672)
  • 6351b0c6fcc7d75acb230a9be7f9047aada322ae Refactor error position parsing to support path with colon. (#1673)
  • de65614d10a6b84029e3e1215567b8ce7e490f23 Add two options to require rule ID and justificaiton for inline annotations (#1671)
  • e354c572d957eb8bf63481cc9ba2704b58a6ae35 Fix false positive in G118 when cancel is stored in a slice/map (#1670)
  • 4161f0b4333859990584c9fb3fd377a892eaf477 chore(go): update supported Go versions to 1.25.10 and 1.26.3 (#1669)
  • b4f29347566880540afec8205b633d2859377cec Harden the github workflows and action (#1665)
  • b7aca268861108d4446959fa92d2fe808eb7aa6f Fix justification delimiter in annotation format doc (#1661)
  • 945bce72d26a794e25a122d87527d063bf887903 Update all dependencies (#1664)
  • 5f4eec95fa28ce5dc6cf555de8c242cb57545f01 Update action to use gosec version v2.26.1 (#1660)

v2.26.1

Changelog

  • 4a3bd8af174872c778439083ded7adbf3747e770 Update cosign to v3.0.6 (#1659)

v2.25.0

Changelog

  • 223e19b8856e00f02cc67804499a83f77e208f3c chore(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#1617)
  • b23a9e534822ec656207d6d33116b9c48fcde6c7 fix: allow barry action to access secrets on fork PRs (#1616)
  • 355cfa5a43916c57b7727eece120dd54665c1427 fix: reduce G117 false positives for custom marshalers and transformed values (#1614) (#1615)
  • 744bfb5ef06e24230087a2470dd1eda8cf5ac48a Add barry security scanner as a step in the CI (#1612)
  • 4fde15d2287caa7ba8480e14d3ccd49579d17f42 chore(deps): update all dependencies (#1611)
  • dec52c4101b534ac9bc8cf22ac051a65c90d75e0 fix: prevent taint analysis hang on packages with many CHA call graph edges (#1608) (#1610)
  • a0de8b6aab054e0fe97bec94d1f5e635dc5dc495 Add some skills for claude code to automate some tasks (#1609)
  • c2dfcec7f34bdbb3591c1dccd4aafde1d49c5bd6 Add G701-G706 rule-to-CWE mappings and CWE-117, CWE-918 entries (#1606)
  • 8aec3f48a22ee5404185b01ac7667302ba73e51c fix: skip SSA analysis on ill-typed packages to prevent panic (#1607)
  • 1ced32df147e2dd7bb9400023c246235bb32be92 Port G120 from SSA-based to taint analysis (fixes #1600, #1603) (#1605)
  • befce8de5da965121ad143b3c1eba58b0c3941bb fix(G118): eliminate false positive for package-level cancel variables (#1602)
  • b7b2c7b668f3f2bef8a8ae04d72f0eb60492322c feat: add G124 rule for insecure HTTP cookie configuration (#1599)

... (truncated)

Commits
  • 9e6a984 Downgrade google lib to avoid min Go version bump (#1687)
  • 0a5c650 Downgrade the jsonschema dep to v0.13.0 due to incompatibility with anthropic...
  • b48e668 Update all dependencies (#1685)
  • bd17b25 Downgrade the github.com/invopop/jsonschema v0.13.0 to solve incopatibility w...
  • c6f8c3d Update all dependencies (#1682)
  • 5676cbc Update vulnerabilities alerts for indirect dependencies
  • ce167d4 Pin dependencies (#1681)
  • 74b726d Skip pining for my repos
  • a68f882 Update renovate configuration
  • 2f8791b Fix typo
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [securego/gosec](https://github.com/securego/gosec) from 2.22.9 to 2.27.1.
- [Release notes](https://github.com/securego/gosec/releases)
- [Commits](securego/gosec@v2.22.9...v2.27.1)

---
updated-dependencies:
- dependency-name: securego/gosec
  dependency-version: 2.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies github_actions Pull requests that update GitHub Actions code labels Jun 3, 2026
@mudler mudler merged commit 1531fab into master Jun 3, 2026
57 checks passed
@mudler mudler deleted the dependabot/github_actions/securego/gosec-2.27.1 branch June 3, 2026 08:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant