Bump the action-deps group across 1 directory with 5 updates

[dependabot]

Bumps the action-deps group with 5 updates in the / directory:

Package	From	To
github/codeql-action	3.30.5	4.30.8
actions/dependency-review-action	4.8.0	4.8.1
sigstore/cosign-installer	3.10.0	4.0.0
anchore/sbom-action	0.20.6	0.20.8
anchore/scan-action	7.0.0	7.0.2

Updates github/codeql-action from 3.30.5 to 4.30.8

Release notes

Sourced from github/codeql-action's releases.

v4.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.30.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.7 - 06 Oct 2025

• [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

See the full CHANGELOG.md for more information.

v3.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.7 - 06 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

• [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

• Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

• We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

3.30.4 - 25 Sep 2025

• We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
• We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
• You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
• Update default CodeQL bundle version to 2.23.1. #3118

3.30.3 - 10 Sep 2025

No user facing changes.

3.30.2 - 09 Sep 2025

• Fixed a bug which could cause language autodetection to fail. #3084
• Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #3064

3.30.1 - 05 Sep 2025

• Update default CodeQL bundle version to 2.23.0. #3077

3.30.0 - 01 Sep 2025

• Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. #3054

3.29.11 - 21 Aug 2025

... (truncated)

Commits

• f443b60 Merge pull request #3198 from github/update-v4.30.8-527f0f324
• 7a2cb62 Update changelog for v4.30.8
• 527f0f3 Merge pull request #3195 from github/dependabot/npm_and_yarn/npm-minor-37415c...
• f402506 Merge pull request #3196 from github/dependabot/github_actions/dot-github/wor...
• f5e53f9 Merge pull request #3197 from github/dependabot/github_actions/dot-github/wor...
• 4e90a42 Merge pull request #3193 from github/mbg/ff/tools-toolcache
• 413a4a4 Rebuild
• 4521864 Bump github/codeql-action from 3 to 4 in /.github/workflows
• eadf14b Bump ruby/setup-ruby
• e1257b6 Rebuild
• Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.8.0 to 4.8.1

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action v4.8.1

What's Changed

• (bug) Fix spamming link test in deprecation warning (again) by @​ahpook in actions/dependency-review-action#1000
• Bump version for 4.8.1 release by @​ahpook in actions/dependency-review-action#1001

Full Changelog: actions/dependency-review-action@v4...v4.8.1

Commits

• 40c09b7 Merge pull request #1001 from actions/ahpook/v4.8.1-release
• 4552948 Bump version for 4.8.1 release
• e63da9a Merge pull request #1000 from actions/ahpook/deprecation-redux
• 71365c7 (bug) Fix spamming link test in deprecation warning (again)
• See full diff in compare view

Updates sigstore/cosign-installer from 3.10.0 to 4.0.0

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.0.0

What's Changed?

Note: You must upgrade to cosign-installer v4 if you want to install Cosign v3+. You may still install Cosign v2.x with cosign-installer v4.

• Add support for Cosign v3 releases (#201)

v3.10.1

What's Changed?

Note: cosign-installer v3.x cannot be used to install Cosign v3.x. You must upgrade to cosign-installer v4 in order to use Cosign v3.

Note: This is planned to be the final release of Cosign v2, though we will cut new releases for any critical security or bug fixes. We recommend transitioning to Cosign v3.

• Bump default Cosign to v2.6.1 (#203)

Commits

• faadad0 add support for cosign v3 releases (#201)
• See full diff in compare view

Updates anchore/sbom-action from 0.20.6 to 0.20.8

Release notes

Sourced from anchore/sbom-action's releases.

v0.20.8

Changes in v0.20.8

• chore(deps): update Syft to v1.34.2 (#545) [[anchore-actions-token-generator[bot]](https://github.com/[anchore-actions-token-generator[bot]](https://github.com/apps/anchore-actions-token-generator))]

v0.20.7

Changes in v0.20.7

• chore(deps): update Syft to v1.34.1 (#544)

Commits

• aa0e114 chore(deps): update Syft to v1.34.2 (#545)
• d8a2c01 chore(deps): update Syft to v1.34.1 (#544)
• c73dd3f Add llms.txt to describe this repo to our AI overlords 🤖 (#534)
• See full diff in compare view

Updates anchore/scan-action from 7.0.0 to 7.0.2

Release notes

Sourced from anchore/scan-action's releases.

v7.0.2

New in scan-action v7.0.2

• chore(deps): update Grype to v0.101.1 (#532) [[anchore-actions-token-generator[bot]](https://github.com/[anchore-actions-token-generator[bot]](https://github.com/apps/anchore-actions-token-generator))]

v7.0.1

scan-action v7.0.1

Commits

• a5605eb chore(deps): update Grype to v0.101.1 (#532)
• 9e84288 chore(deps): update Grype to v0.101.0 (#530)
• 109c104 chore(deps): bump @​actions/cache from 4.0.3 to 4.1.0 (#522)
• c455b6f chore(deps-dev): bump eslint from 9.36.0 to 9.37.0 (#526)
• cdad80a chore(deps-dev): bump jest from 30.1.3 to 30.2.0 (#525)
• 45eec0d chore(deps-dev): bump lint-staged from 16.2.1 to 16.2.4 (#528)
• a20799d chore(deps): bump actions/setup-node from 5.0.0 to 6.0.0 (#529)
• 56e320f chore(deps-dev): bump @​vercel/ncc from 0.38.3 to 0.38.4 (#517)
• 05c485f chore(deps-dev): bump eslint from 9.35.0 to 9.36.0 (#519)
• 0c215f8 chore(deps-dev): bump tar from 7.4.3 to 7.5.1 (#521)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (aabe8ca) to head (3b40138).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #919   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            8         8           
  Lines          151       151           
  Branches        11        11           
=========================================
  Hits           151       151           

Flag	Coverage Δ
python-3.10	100.00% <ø> (ø)
python-3.11	100.00% <ø> (ø)
python-3.12	100.00% <ø> (ø)
python-3.13	100.00% <ø> (ø)
python-3.9	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

Test Results

  5 files  ±0    5 suites  ±0   6s ⏱️ -1s
 36 tests ±0   36 ✅ ±0  0 💤 ±0  0 ❌ ±0 
180 runs  ±0  180 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 3b40138. ± Comparison against base commit aabe8ca.

♻️ This comment has been updated with latest results.

[github-actions]

🔍 Vulnerabilities of jkreileder/cf-ips-to-hcloud-fw:pr-919

📦 Image Reference jkreileder/cf-ips-to-hcloud-fw:pr-919

digest	sha256:40f049cd24c6bf9bf3da97f7b7e6fc929c9896f195ada7ee555c2797080ce8fc
vulnerabilities
platform	linux/amd64
size	26 MB
packages	60

📦 Base Image python:3-alpine

also known as	3-alpine3.22 3.13-alpine 3.13-alpine3.22 3.13.7-alpine 3.13.7-alpine3.22 alpine alpine3.22
digest	sha256:527c28b29498575b851ad88e7522ac7201bbd9e920d2c11b00ff2b39b315f5f8
vulnerabilities

h11 0.14.0 (pypi) pkg:pypi/[email protected] OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <0.16.0 Fixed version 0.16.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Description A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range <0.16.0 Fixed version 0.16.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.047% EPSS Percentile 14th percentile Description Impact A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. Details HTTP/1.1 Chunked-Encoding bodies are formatted as a sequence of "chunks", each of which consists of: chunk length \r\n length bytes of content \r\n In versions of h11 up to 0.14.0, h11 instead parsed them as: chunk length \r\n length bytes of content any two bytes i.e. it did not validate that the trailing \r\n bytes were correct, and if you put 2 bytes of garbage there it would be accepted, instead of correctly rejecting the body as malformed. By itself this is harmless. However, suppose you have a proxy or reverse-proxy that tries to analyze HTTP requests, and your proxy has a different bug in parsing Chunked-Encoding, acting as if the format is: chunk length \r\n length bytes of content more bytes of content, as many as it takes until you find a \r\n For example, pound had this bug -- it can happen if an implementer uses a generic "read until end of line" helper to consumes the trailing \r\n. In this case, h11 and your proxy may both accept the same stream of bytes, but interpret them differently. For example, consider the following HTTP request(s) (assume all line breaks are \r\n): GET /one HTTP/1.1 Host: localhost Transfer-Encoding: chunked 5 AAAAAXX2 45 0 GET /two HTTP/1.1 Host: localhost Transfer-Encoding: chunked 0 Here h11 will interpret it as two requests, one with body AAAAA45 and one with an empty body, while our hypothetical buggy proxy will interpret it as a single request, with body AAAAXX20\r\n\r\nGET /two .... And any time two HTTP processors both accept the same string of bytes but interpret them differently, you have the conditions for a "request smuggling" attack. For example, if /two is a dangerous endpoint and the job of the reverse proxy is to stop requests from getting there, then an attacker could use a bytestream like the above to circumvent this protection. Even worse, if our buggy reverse proxy receives two requests from different users: GET /one HTTP/1.1 Host: localhost Transfer-Encoding: chunked 5 AAAAAXX999 0 GET /two HTTP/1.1 Host: localhost Cookie: SESSION_KEY=abcdef... ...it will consider the first request to be complete and valid, and send both on to the h11-based web server over the same socket. The server will then see the two concatenated requests, and interpret them as one request to /one whose body includes /two's session key, potentially allowing one user to steal another's credentials. Patches Fixed in h11 0.15.0. Workarounds Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue. Credits Reported by Jeppe Bonde Weikop on 2025-01-09.

openssl 3.5.1-r0 (apk) pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22 Affected range <3.5.4-r0 Fixed version 3.5.4-r0 EPSS Score 0.026% EPSS Percentile 6th percentile Description Affected range <3.5.4-r0 Fixed version 3.5.4-r0 EPSS Score 0.013% EPSS Percentile 1st percentile Description Affected range <3.5.4-r0 Fixed version 3.5.4-r0 EPSS Score 0.023% EPSS Percentile 5th percentile Description

urllib3 2.3.0 (pypi) pkg:pypi/[email protected] URL Redirection to Untrusted Site ('Open Redirect') Affected range >=2.2.0 <2.5.0 Fixed version 2.5.0 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N EPSS Score 0.014% EPSS Percentile 2nd percentile Description urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects. However, the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. Affected usages Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime. Impact Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable. Remediation If you use urllib3 in Node.js, upgrade to a patched version of urllib3. Unfortunately, browsers provide no suitable way which urllib3 can use: XMLHttpRequest provides no control over redirects, the Fetch API returns opaqueredirect responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects. URL Redirection to Untrusted Site ('Open Redirect') Affected range <2.5.0 Fixed version 2.5.0 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N EPSS Score 0.023% EPSS Percentile 5th percentile Description urllib3 handles redirects and retries using the same mechanism, which is controlled by the Retry object. The most common way to disable redirects is at the request level, as follows: resp = urllib3.request("GET", "https://httpbin.org/redirect/1", redirect=False) print(resp.status) # 302 However, it is also possible to disable redirects, for all requests, by instantiating a PoolManager and specifying retries in a way that disable redirects: import urllib3 http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above http = urllib3.PoolManager(retries=False) # should return the first response resp = http.request("GET", "https://httpbin.org/redirect/1") However, the retries parameter is currently ignored, which means all the above examples don't disable redirects. Affected usages Passing retries on PoolManager instantiation to disable redirects or restrict their number. By default, requests and botocore users are not affected. Impact Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. Remediation You can remediate this vulnerability with the following steps: Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [email protected] to discuss sponsorship or contribution opportunities. Disable redirects at the request() level instead of the PoolManager() level.

pip 25.2 (pypi) pkg:pypi/[email protected] Improper Link Resolution Before File Access ('Link Following') Affected range <=25.2 Fixed version Not Fixed CVSS Score 5.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N EPSS Score 0.018% EPSS Percentile 3rd percentile Description Summary In the fallback extraction path for source distributions, pip used Python’s tarfile module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during pip install. Impact Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running pip. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system. Conditions The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running pip install; active user action is necessary. Remediation The fix, while available as a patch that can be manually applied, has not yet been put into a numbered version but is planned for 25.3. Using a Python interpreter that implements the safe-extraction behavior described by PEP 706 provides additional defense in depth for other tarfile issues but is not a substitute for upgrading pip for this specific flaw.

requests 2.32.3 (pypi) pkg:pypi/[email protected] Insufficiently Protected Credentials Affected range <2.32.4 Fixed version 2.32.4 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N EPSS Score 0.104% EPSS Percentile 29th percentile Description Impact Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Workarounds For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs). References psf/requests#6965 https://seclists.org/fulldisclosure/2025/Jun/2

busybox 1.37.0-r18 (apk) pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.22 Affected range <=1.37.0-r19 Fixed version Not Fixed EPSS Score 0.015% EPSS Percentile 2nd percentile Description Affected range <=1.37.0-r19 Fixed version Not Fixed EPSS Score 0.017% EPSS Percentile 3rd percentile Description

[github-actions]

Recommended fixes for image jkreileder/cf-ips-to-hcloud-fw:pr-919

Base image is python:3-alpine

Name	3.13.7-alpine3.22
Digest	sha256:527c28b29498575b851ad88e7522ac7201bbd9e920d2c11b00ff2b39b315f5f8
Vulnerabilities
Pushed	2 months ago
Size	17 MB
Packages	39
Flavor	alpine
OS	3.22
Runtime	3.13.7

The base image is also available under the supported tag(s): 3-alpine3.22, 3.13-alpine, 3.13-alpine3.22, alpine, alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

Tag	Details	Pushed	Vulnerabilities
3-alpine Newer image for same tag Also known as: alpine alpine3.22 3.14.0-alpine 3.14.0-alpine3.22 3.14-alpine 3.14-alpine3.22 3-alpine3.22	Benefits: Same OS detected Minor runtime version update Newer image for same tag Tag is preferred tag Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 3 Image contains similar number of packages 3-alpine was pulled 51K times last month Image details: Size: 18 MB Flavor: alpine OS: 3.22 Runtime: 3.14.0	1 week ago

Change base image

Tag	Details	Pushed	Vulnerabilities
3.13-alpine Minor runtime version update Also known as: 3.13.9-alpine 3.13.9-alpine3.22 3.13-alpine3.22	Benefits: Same OS detected Minor runtime version update Tag was pushed more recently Image has similar size Image introduces no new vulnerability but removes 3 Image contains equal number of packages Image details: Size: 17 MB Flavor: alpine OS: 3.22 Runtime: 3.13.9	6 days ago

[github-actions]

Overview

Image reference	jkreileder/cf-ips-to-hcloud-fw:1	quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-919
- digest	a013f898285a	40f049cd24c6
- tag	1	pr-919
- provenance	90ebdb0	757a5fa
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	23 MB	26 MB (+3.4 MB)
- packages	60	60
Base Image	python:3-alpine also known as: • 3-alpine3.22 • 3.13-alpine • 3.13-alpine3.22 • alpine • alpine3.22	python:3-alpine also known as: • 3-alpine3.22 • 3.13-alpine • 3.13-alpine3.22 • alpine • alpine3.22
- vulnerabilities

Environment Variables (2 changes)

• ± 2 changed
• 4 unchanged

 GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305
 PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 PYTHONDONTWRITEBYTECODE=1
 PYTHONFAULTHANDLER=1
-PYTHON_SHA256=93e583f243454e6e9e4588ca2c2662206ad961659863277afcdb96801647d640
+PYTHON_SHA256=5462f9099dfd30e238def83c71d91897d8caa5ff6ebc7a50f14d4802cdaaa79a
-PYTHON_VERSION=3.13.5
+PYTHON_VERSION=3.13.7

Labels (3 changes)

• ± 3 changed
• 5 unchanged

-org.opencontainers.image.created=2025-06-20T11:12:42.735Z
+org.opencontainers.image.created=2025-10-21T15:04:14.422Z
 org.opencontainers.image.description=Update Hetzner Cloud firewall rules with current Cloudflare IP ranges
 org.opencontainers.image.licenses=MIT
-org.opencontainers.image.revision=90ebdb0cde09868906e19bfb8b149a1abd09824b
+org.opencontainers.image.revision=757a5fafa28e429c97b68ff02d408256e138f9f0
 org.opencontainers.image.source=https://github.com/jkreileder/cf-ips-to-hcloud-fw
 org.opencontainers.image.title=cf-ips-to-hcloud-fw
 org.opencontainers.image.url=https://github.com/jkreileder/cf-ips-to-hcloud-fw
-org.opencontainers.image.version=1.0.17
+org.opencontainers.image.version=pr-919

Policies (0 improved, 2 worsened, 2 missing data)

Policy Name	jkreileder/cf-ips-to-hcloud-fw:1	quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-919	Change	Standing
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	⚠️ 2	⚠️ 3	+1	Worsened
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	❓ No data
No unapproved base images	✅	❓ No data
Supply chain attestations	✅	⚠️ 2	+2	Worsened

Packages and Vulnerabilities (13 package changes and 2 vulnerability changes)

• ♾️ 13 packages changed
• 47 packages unchanged

• ✔️ 2 vulnerabilities removed

Changes for packages of type apk (10 changes)

	Package	Version jkreileder/cf-ips-to-hcloud-fw:1	Version quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-919
♾️	.python-rundeps	20250619.205442	20250819.144338
♾️	alpine-base	3.22.0-r0	3.22.1-r0
♾️	alpine-release	3.22.0-r0	3.22.1-r0
♾️	ca-certificates	20241121-r2	20250619-r0
♾️	ca-certificates-bundle	20241121-r2	20250619-r0
♾️	libcrypto3	3.5.0-r0	3.5.1-r0
♾️	libssl3	3.5.0-r0	3.5.1-r0
♾️	openssl	3.5.0-r0	3.5.1-r0
		Removed vulnerabilities (1):
♾️	sqlite	3.49.2-r0	3.49.2-r1
		Removed vulnerabilities (1):
♾️	sqlite-libs	3.49.2-r0	3.49.2-r1

Changes for packages of type generic (1 changes)

	Package	Version jkreileder/cf-ips-to-hcloud-fw:1	Version quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-919
♾️	python	3.13.5	3.13.7

Changes for packages of type pypi (2 changes)

	Package	Version jkreileder/cf-ips-to-hcloud-fw:1	Version quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-919
♾️	cf-ips-to-hcloud-fw	1.0.17	1.0.18.dev0
♾️	pip	25.1.1	25.2

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.