build(deps): bump github/codeql-action from 4.36.0 to 4.36.1

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.0 to 4.36.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...87557b9c84dde89fdd9b10e88954ac2f4248e463) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #297 from crazy-max/yarn-update
2026-06-07 01:18:43 +02:00 · 2026-06-04 06:13:42 +00:00 · 2026-05-28 18:45:24 +02:00 · 2026-05-28 15:14:00 +02:00 · 2026-05-28 10:24:19 +02:00 · 2026-05-28 10:23:54 +02:00
8 changed files with 97 additions and 95 deletions
@@ -35,12 +35,12 @@ jobs:
          node-version: ${{ env.NODE_VERSION }}
      -
        name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
        with:
          languages: javascript-typescript
          build-mode: none
      -
        name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
        with:
          category: "/language:javascript-typescript"
@@ -29,7 +29,7 @@ jobs:
          targets: test
      -
        name: Upload coverage
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
        with:
          files: ./coverage/clover.xml
          token: ${{ secrets.CODECOV_TOKEN }}
@@ -21,7 +21,7 @@ jobs:
      -
        name: GitHub auth token from GitHub App
        id: docker-read-app
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
@@ -1,10 +1,10 @@
 # https://yarnpkg.com/configuration/yarnrc

-compressionLevel: mixed
-enableGlobalCache: false
-enableHardenedMode: true
+nodeLinker: node-modules

 logFilters:
+  - code: YN0004
+    level: discard
  - code: YN0013
    level: discard
  - code: YN0019
@@ -14,6 +14,8 @@ logFilters:
  - code: YN0086
    level: discard

-nodeLinker: node-modules
-
-npmAuthToken: "${NODE_AUTH_TOKEN:-fallback}"
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+enableScripts: false
+npmMinimalAgeGate: 2d
@@ -21,9 +21,9 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
-  "packageManager": "yarn@4.9.2",
+  "packageManager": "yarn@4.15.0",
  "dependencies": {
-    "@actions/core": "^3.0.0",
+    "@actions/core": "^3.0.1",
    "@docker/actions-toolkit": "^0.91.0"
  },
  "devDependencies": {
@@ -2,7 +2,7 @@
 # Manual changes might be lost - proceed with caution!

 __metadata:
-  version: 8
+  version: 10
  cacheKey: 10

 "@aashutoshrathi/word-wrap@npm:^1.2.3":
@@ -2822,7 +2822,7 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "docker-setup-qemu@workspace:."
  dependencies:
-    "@actions/core": "npm:^3.0.0"
+    "@actions/core": "npm:^3.0.1"
    "@docker/actions-toolkit": "npm:^0.91.0"
    "@eslint/js": "npm:^9.39.3"
    "@types/node": "npm:^24.11.0"
Author	SHA1	Message	Date
dependabot[bot]	d86caeb5a9	build(deps): bump github/codeql-action from 4.36.0 to 4.36.1 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.0 to 4.36.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...87557b9c84dde89fdd9b10e88954ac2f4248e463) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-04 06:13:42 +00:00
CrazyMax	259a565a6f	Merge pull request #297 from crazy-max/yarn-update update yarn to 4.15.0	2026-05-28 18:45:24 +02:00
CrazyMax	ed4e33e0a6	update yarn to 4.15.0 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-05-28 15:14:00 +02:00
CrazyMax	1a577caf9f	Merge pull request #295 from docker/dependabot/npm_and_yarn/actions/core-3.0.1 build(deps): bump @actions/core from 3.0.0 to 3.0.1	2026-05-28 10:24:19 +02:00
CrazyMax	95b57d86c4	Merge pull request #293 from docker/dependabot/github_actions/actions/create-github-app-token-3.2.0 build(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0	2026-05-28 10:23:54 +02:00
CrazyMax	5841650303	Merge pull request #294 from docker/dependabot/github_actions/codecov/codecov-action-6.0.1 build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1	2026-05-28 10:23:33 +02:00
CrazyMax	468c4616f9	Merge pull request #296 from docker/dependabot/github_actions/github/codeql-action-4.36.0 build(deps): bump github/codeql-action from 4.35.2 to 4.36.0	2026-05-28 10:23:12 +02:00
CrazyMax	db6b4cfde3	Merge pull request #292 from docker/sec-cli/ignore-scripts-fix-20260527-193437 ci: add ignore-scripts to Node package manager config (20260527-193437)	2026-05-28 10:01:41 +02:00
dependabot[bot]	44cc945d98	build(deps): bump github/codeql-action from 4.35.2 to 4.36.0 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.36.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...7211b7c8077ea37d8641b6271f6a365a22a5fbfa) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-28 06:23:45 +00:00
github-actions[bot]	a42c0c12dd	chore: update generated content	2026-05-28 06:23:40 +00:00
dependabot[bot]	c3e57563e9	build(deps): bump @actions/core from 3.0.0 to 3.0.1 Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 3.0.0 to 3.0.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) --- updated-dependencies: - dependency-name: "@actions/core" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-28 06:22:51 +00:00
dependabot[bot]	e02729e804	build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.0 to 6.0.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-28 06:22:15 +00:00
dependabot[bot]	bb5d7babc7	build(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 3.1.1 to 3.2.0. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/1b10c78c7865c340bc4f6099eb2f838309f1e8c3...bcd2ba49218906704ab6c1aa796996da409d3eb1) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-28 06:22:02 +00:00
securityeng-bot[bot]	8864a83d99	ci: enforce ignore-scripts policy for Node package managers	2026-05-27 20:05:13 +00:00